a655a9bf68efd7b554b6facc11bc3eb0[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

a655a9bf68efd7b554b6facc11bc3eb0.exe
Size

5.0MB
MD5

a655a9bf68efd7b554b6facc11bc3eb0
SHA1

7c9684dd555fbac32cc305a5a30c56f9af1ef19a
SHA256

bc5a0f9c35a6bc41dd1907b97092dc01de10913394d82fbd8c6864ccd1a5990a
SHA512

d27b256dd7bfe35c8d6216a254d9a720ec8ca0123d6ede3901e6ee48d823bc6eb5b5274eb33d0930c14180c451adf8c39deba176ab3646bf10640c8530bcb8d9
SSDEEP

98304:9kN/T9DX/wnjtCenWDtTcqgFHA++sGfdhCRukE5:Ylfq9Hn7RukE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a655a9bf68efd7b554b6facc11bc3eb0.exe

Files

a655a9bf68efd7b554b6facc11bc3eb0.exe
.exe windows:6 windows x64 arch:x64

25e150ef972b7b928229d2d175fd08f4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ntdll

NtReadFile
RtlLookupFunctionEntry
NtWriteFile
RtlGetNtVersionNumbers
NtCreateFile
NtDeviceIoControlFile
RtlNtStatusToDosError
NtCancelIoFileEx
RtlVirtualUnwind
RtlCaptureContext

kernel32

GetConsoleScreenBufferInfo
GetEnvironmentVariableW
TryAcquireSRWLockExclusive
GetCurrentThreadId
FreeLibrary
LoadLibraryW
lstrlenW
DeviceIoControl
GetOverlappedResult
CancelIo
ResetEvent
CreateEventA
MultiByteToWideChar
WideCharToMultiByte
GetConsoleMode
CreateMutexW
WriteFile
ReadFile
GetCurrentProcess
AcquireSRWLockShared
GetSystemInfo
SetConsoleMode
LoadLibraryExA
HeapAlloc
HeapFree
GetProcessHeap
GetModuleHandleW
LoadLibraryExW
ReleaseSRWLockShared
WaitForSingleObject
GetLastError
ExitProcess
GetFileAttributesW
GetModuleHandleA
CreateFileW
OutputDebugStringA
OutputDebugStringW
InitializeSListHead
IsDebuggerPresent
CloseHandle
UnhandledExceptionFilter
ReleaseSRWLockExclusive
SetUnhandledExceptionFilter
AcquireSRWLockExclusive
GetFullPathNameW
GetProcAddress
FormatMessageW
SetConsoleTextAttribute
GetModuleFileNameW
SetHandleInformation
CreateIoCompletionPort
GetQueuedCompletionStatusEx
PostQueuedCompletionStatus
SetFileCompletionNotificationModes
CreateMutexA
LoadLibraryA
Sleep
WaitForSingleObjectEx
AddVectoredExceptionHandler
SetThreadStackGuarantee
SwitchToThread
CreateWaitableTimerExW
SetWaitableTimer
QueryPerformanceCounter
SetLastError
GetCurrentDirectoryW
IsProcessorFeaturePresent
GetSystemTimeAsFileTime
SetFileInformationByHandle
GetCurrentThread
GetStdHandle
GetCurrentProcessId
TerminateProcess
WakeAllConditionVariable
SleepConditionVariableSRW
QueryPerformanceFrequency
CreateThread
HeapReAlloc
ReleaseMutex
DeleteFileW
GetFinalPathNameByHandleW
CopyFileExW
WriteConsoleW

user32

PeekMessageA
TranslateMessage
DispatchMessageW
GetMessageA
DispatchMessageA
SetWindowLongPtrW
SendMessageA
GetWindowLongPtrW
LoadImageA
CreateWindowExW
RegisterClassW
CreateWindowExA
PostThreadMessageW
DefWindowProcW
GetClientRect
FindWindowExA
FindWindowA
SendMessageTimeoutA
UpdateWindow
EnumWindows
PostMessageW
LoadImageW
RegisterWindowMessageW
GetCursorPos
TrackPopupMenu
GetMenuItemID
GetMessageW
SetMenuInfo
PostQuitMessage
MessageBoxW
LoadIconW
RegisterClassA
EnumDisplayMonitors
InsertMenuItemW
SetWindowPos
SetForegroundWindow
ShowWindow
CreatePopupMenu

ws2_32

getaddrinfo
socket
WSAGetLastError
WSAIoctl
WSAStartup
WSACleanup
setsockopt
getsockopt
WSASocketW
connect
ioctlsocket
recv
send
freeaddrinfo
closesocket
WSASend
bind

shell32

ShellExecuteW
Shell_NotifyIconW
SHGetKnownFolderPath

ole32

CoTaskMemFree
CoTaskMemAlloc
CoInitializeEx

api-ms-win-shcore-scaling-l1-1-1

SetProcessDpiAwareness

advapi32

SystemFunction036
EventUnregister
EventSetInformation
EventWriteTransfer
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
EventRegister
RegGetValueW

oleaut32

SysStringLen
SysFreeString
SetErrorInfo
GetErrorInfo

secur32

FreeContextBuffer
DecryptMessage
AcceptSecurityContext
InitializeSecurityContextW
EncryptMessage
AcquireCredentialsHandleA
FreeCredentialsHandle
DeleteSecurityContext
QueryContextAttributesW

crypt32

CertEnumCertificatesInStore
CertGetCertificateChain
CertVerifyCertificateChainPolicy
CertAddCertificateContextToStore
CertOpenStore
CertCloseStore
CertDuplicateStore
CertDuplicateCertificateContext
CertFreeCertificateChain
CertDuplicateCertificateChain
CertFreeCertificateContext

bcrypt

BCryptGenRandom

vcruntime140

__C_specific_handler
__std_exception_copy
__CxxFrameHandler3
memcpy
memset
memmove
wcsrchr
_purecall
memcmp
wcsstr
_CxxThrowException
__current_exception_context
__current_exception
__std_exception_destroy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

_wcsicmp
wcsncpy
_wcsdup
towupper
wcscmp
wcslen

api-ms-win-crt-convert-l1-1-0

_ultow_s
_wtoi
wcstol

api-ms-win-crt-math-l1-1-0

fmod
__setusermatherr
pow
floor
trunc
log2
ceil

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode
__stdio_common_vswprintf

api-ms-win-crt-heap-l1-1-0

_set_new_mode
_callnewh
free
malloc
calloc

api-ms-win-crt-runtime-l1-1-0

__p___argv
__p___argc
_exit
exit
_cexit
_register_onexit_function
_initterm_e
terminate
_initialize_narrow_environment
_register_thread_local_exe_atexit_callback
_get_initial_narrow_environment
_initterm
_seh_filter_exe
_set_app_type
_configure_narrow_argv
_crt_atexit
_c_exit
_initialize_onexit_table

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Exports

Exports

hid_close
hid_enumerate
hid_error
hid_exit
hid_free_enumeration
hid_get_device_info
hid_get_feature_report
hid_get_indexed_string
hid_get_input_report
hid_get_manufacturer_string
hid_get_product_string
hid_get_report_descriptor
hid_get_serial_number_string
hid_init
hid_open
hid_open_path
hid_read
hid_read_timeout
hid_send_feature_report
hid_set_nonblocking
hid_version
hid_version_str
hid_winapi_descriptor_reconstruct_pp_data
hid_winapi_get_container_id
hid_write

Sections

.text
Size: 2.7MB - Virtual size: 2.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 188KB - Virtual size: 188KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 264KB - Virtual size: 264KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

25e150ef972b7b928229d2d175fd08f4

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

kernel32

user32

ws2_32

shell32

ole32

api-ms-win-shcore-scaling-l1-1-1

advapi32

oleaut32

secur32

crypt32

bcrypt

vcruntime140

vcruntime140_1

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

Exports

Exports

Sections

.text Size: 2.7MB - Virtual size: 2.7MB

.rdata Size: 1.9MB - Virtual size: 1.9MB

.data Size: 4KB - Virtual size: 6KB

.pdata Size: 188KB - Virtual size: 188KB

.rsrc Size: 264KB - Virtual size: 264KB

.reloc Size: 34KB - Virtual size: 34KB

.text
Size: 2.7MB - Virtual size: 2.7MB

.rdata
Size: 1.9MB - Virtual size: 1.9MB

.data
Size: 4KB - Virtual size: 6KB

.pdata
Size: 188KB - Virtual size: 188KB

.rsrc
Size: 264KB - Virtual size: 264KB

.reloc
Size: 34KB - Virtual size: 34KB