0a908477e880c9d32218effced356725f7b9c02b647c3d0f3fb893703d744b24[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

0a908477e880c9d32218effced356725f7b9c02b647c3d0f3fb893703d744b24.exe
Size

3.9MB
MD5

b96bb63f6f8c06a51ba0abceb77825ec
SHA1

92fca47979e7d76fd81d3ae4ab2b466cebc5995f
SHA256

0a908477e880c9d32218effced356725f7b9c02b647c3d0f3fb893703d744b24
SHA512

927c5908c58cfb5b0989d4387b52932afeabe4457b90c4deab92b1fb9f7d5c17377ec8af43fd2df6c0a0998612104c0b833736b1df66b4c64b516b6b1351b262
SSDEEP

49152:YlGnmk8AN0jwOUUhC4igt0+28bTOjT2HN4JqVac4+Gm1nerHltWVdiUyE0yLzhFX:4GnWUtgG+9VaPtfTUBJIxqoc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0a908477e880c9d32218effced356725f7b9c02b647c3d0f3fb893703d744b24.exe

Files

0a908477e880c9d32218effced356725f7b9c02b647c3d0f3fb893703d744b24.exe
.exe windows:6 windows x64 arch:x64

f81d0cd312945790cb77821773546428

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

oleaut32

SysAllocStringLen
SafeArrayUnaccessData
SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
SysFreeString
VariantClear
SafeArrayDestroy

kernel32

GetFileInformationByHandle
GetModuleHandleA
GetCurrentThread
GetStdHandle
GetConsoleMode
WaitForSingleObject
WriteConsoleW
WaitForSingleObjectEx
CreateMutexA
ReleaseMutex
GetEnvironmentVariableW
RtlLookupFunctionEntry
GetModuleHandleW
FormatMessageW
GetTempPathW
GetModuleFileNameW
CreateFileW
GetFileInformationByHandleEx
GetFullPathNameW
GetProcessHeap
WakeAllConditionVariable
CreateDirectoryW
FindFirstFileW
FindClose
HeapReAlloc
GetSystemInfo
SetThreadStackGuarantee
AddVectoredExceptionHandler
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
DuplicateHandle
GetCurrentProcessId
CreateNamedPipeW
CreateThread
ReadFileEx
SleepEx
WriteFileEx
GlobalAlloc
ExitProcess
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
GetCurrentDirectoryW
RtlCaptureContext
AcquireSRWLockShared
ReleaseSRWLockShared
SleepConditionVariableSRW
SetHandleInformation
WakeConditionVariable
PostQueuedCompletionStatus
MultiByteToWideChar
WideCharToMultiByte
GlobalSize
GlobalLock
Sleep
ReleaseSRWLockExclusive
SetFileCompletionNotificationModes
CreateIoCompletionPort
TryAcquireSRWLockExclusive
GetFinalPathNameByHandleW
SetLastError
GetQueuedCompletionStatusEx
AcquireSRWLockExclusive
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
SystemTimeToFileTime
GetTimeZoneInformation
RtlVirtualUnwind
FlushFileBuffers
GetTickCount
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
FreeLibrary
GetFileSize
LockFileEx
LocalFree
UnlockFile
HeapDestroy
HeapCompact
LoadLibraryW
DeleteFileW
DeleteFileA
CreateFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesExW
GetFileAttributesA
GetDiskFreeSpaceA
GetTempPathA
HeapSize
HeapValidate
UnmapViewOfFile
CreateMutexW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
GetDiskFreeSpaceW
WriteFile
HeapCreate
ReadFile
AreFileApisANSI
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
SwitchToThread
IsProcessorFeaturePresent
GlobalUnlock
GetLastError
HeapAlloc
GlobalFree
FindNextFileW
GetCurrentProcess
GetProcAddress
LoadLibraryA
CloseHandle
HeapFree
InitializeSListHead
IsDebuggerPresent
SetFilePointerEx
CopyFileExW

bcrypt

BCryptGenRandom

user32

GetMonitorInfoW
EnumDisplaySettingsExW
SetClipboardData
EmptyClipboard
CloseClipboard
GetClipboardData
OpenClipboard
EnumDisplayMonitors

ws2_32

accept
recv
ioctlsocket
socket
setsockopt
send
connect
getaddrinfo
freeaddrinfo
WSAStartup
getsockopt
WSAIoctl
shutdown
closesocket
WSACleanup
WSASocketW
getsockname
WSAGetLastError
getpeername
WSASend
listen
bind

ntdll

NtDeviceIoControlFile
NtCreateFile
NtCancelIoFileEx
RtlNtStatusToDosError

crypt32

CertDuplicateStore
CertCloseStore
CertFreeCertificateContext
CertVerifyCertificateChainPolicy
CertDuplicateCertificateContext
CertFreeCertificateChain
CertOpenStore
CertDuplicateCertificateChain
CertAddCertificateContextToStore
CertEnumCertificatesInStore
CertGetCertificateChain
CryptUnprotectData

secur32

QueryContextAttributesW
FreeContextBuffer
DeleteSecurityContext
EncryptMessage
ApplyControlToken
FreeCredentialsHandle
AcceptSecurityContext
InitializeSecurityContextW
AcquireCredentialsHandleA
DecryptMessage

advapi32

AllocateAndInitializeSid
RegCloseKey
CheckTokenMembership
RegOpenKeyExW
RegQueryValueExW
SystemFunction036
FreeSid

gdi32

DeleteDC
GetDeviceCaps
CreateDCW
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
SetStretchBltMode
StretchBlt
GetDIBits
GetObjectW
DeleteObject

ole32

CoInitializeEx
CoCreateInstance
CoSetProxyBlanket
CoInitializeSecurity

vcruntime140

__C_specific_handler
__CxxFrameHandler3
memmove
memset
memcmp
memcpy
__current_exception
__current_exception_context
strrchr

api-ms-win-crt-string-l1-1-0

strncmp
strlen
strcspn
strcmp

api-ms-win-crt-utility-l1-1-0

_rotl64
qsort

api-ms-win-crt-heap-l1-1-0

_set_new_mode
free
malloc
_msize
realloc

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-math-l1-1-0

log
__setusermatherr
_dclass

api-ms-win-crt-runtime-l1-1-0

exit
__p___argc
__p___argv
_initterm_e
_endthreadex
_exit
_seh_filter_exe
terminate
_beginthreadex
_crt_atexit
_cexit
_get_initial_narrow_environment
_c_exit
_register_thread_local_exe_atexit_callback
_register_onexit_function
_initialize_onexit_table
_set_app_type
_initialize_narrow_environment
_initterm
_configure_narrow_argv

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f81d0cd312945790cb77821773546428

Headers

DLL Characteristics

File Characteristics

Imports

oleaut32

kernel32

bcrypt

user32

ws2_32

ntdll

crypt32

secur32

advapi32

gdi32

ole32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 2.6MB - Virtual size: 2.6MB

.rdata Size: 1.1MB - Virtual size: 1.1MB

.data Size: 24KB - Virtual size: 27KB

.pdata Size: 64KB - Virtual size: 64KB

.reloc Size: 26KB - Virtual size: 26KB

.text
Size: 2.6MB - Virtual size: 2.6MB

.rdata
Size: 1.1MB - Virtual size: 1.1MB

.data
Size: 24KB - Virtual size: 27KB

.pdata
Size: 64KB - Virtual size: 64KB

.reloc
Size: 26KB - Virtual size: 26KB