7U6MlhDuolio[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

7U6MlhDuolio.exe
Size

27.0MB
MD5

57925054bb644d81c4b5052e52403e65
SHA1

53765f8014a27604ecb1d754b193a2ca4ebcd226
SHA256

07bb52729c5e50263e1bee0d1b93f7bdad40c9f92a7cf6cc0360217deda51f44
SHA512

937b6445108356c1ab992acfcea5f69a4aabf57320bb5da53ccd693ea0fd9a106e5f179fc5987b18886aeb2a9957f89ddea1adcbdf47f7ccfba23c8eb13d0a56
SSDEEP

786432:cGLfNrE2ixRls8RoS0fZtRLwrdz1C7s8b/vq:1L1rezeS0fFwrdkwo/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7U6MlhDuolio.exe

Files

7U6MlhDuolio.exe
.exe windows:6 windows x64 arch:x64

2ac08ccff9d3a3f9e1471ad33165560c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

user32

ClientToScreen

kernel32

AcquireSRWLockExclusive
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress

shell32

CommandLineToArgvW

advapi32

CreateProcessAsUserW

gdi32

CreateSolidBrush

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

ws2_32

WSACleanup

imm32

ImmGetContext

xinput1_4

ord4

ntdll

NtCreateFile

shlwapi

PathFindFileNameW

ole32

CoCreateInstance

bcrypt

BCryptGenRandom

crypt32

CertCloseStore

Sections

.text
Size: - Virtual size: 3.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 6.7MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 140KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gxfg
Size: - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_sysc
Size: - Virtual size: 76B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.XBk0
Size: - Virtual size: 15.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.XBk1
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.XBk2
Size: 27.0MB - Virtual size: 27.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 422B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2ac08ccff9d3a3f9e1471ad33165560c

Headers

DLL Characteristics

File Characteristics

Imports

user32

kernel32

shell32

advapi32

gdi32

d3d11

dwmapi

ws2_32

imm32

xinput1_4

ntdll

shlwapi

ole32

bcrypt

crypt32

Sections

.text Size: - Virtual size: 3.2MB

.rdata Size: - Virtual size: 1.4MB

.data Size: - Virtual size: 6.7MB

.pdata Size: - Virtual size: 140KB

.00cfg Size: - Virtual size: 56B

.gxfg Size: - Virtual size: 12KB

.tls Size: - Virtual size: 9B

_RDATA Size: - Virtual size: 348B

_sysc Size: - Virtual size: 76B

.XBk0 Size: - Virtual size: 15.7MB

.XBk1 Size: 4KB - Virtual size: 4KB

.XBk2 Size: 27.0MB - Virtual size: 27.0MB

.rsrc Size: 512B - Virtual size: 422B

.text
Size: - Virtual size: 3.2MB

.rdata
Size: - Virtual size: 1.4MB

.data
Size: - Virtual size: 6.7MB

.pdata
Size: - Virtual size: 140KB

.00cfg
Size: - Virtual size: 56B

.gxfg
Size: - Virtual size: 12KB

.tls
Size: - Virtual size: 9B

_RDATA
Size: - Virtual size: 348B

_sysc
Size: - Virtual size: 76B

.XBk0
Size: - Virtual size: 15.7MB

.XBk1
Size: 4KB - Virtual size: 4KB

.XBk2
Size: 27.0MB - Virtual size: 27.0MB

.rsrc
Size: 512B - Virtual size: 422B