9e428504c94d39d5b922dc323bf6f2a9e782aec26f87782cb7e488b7919bd67e

Sharing

Copy URL Twitter E-mail

General

Target

9e428504c94d39d5b922dc323bf6f2a9e782aec26f87782cb7e488b7919bd67e
Size

519KB
MD5

d9763d8c96fdead98f249aa0f4beebad
SHA1

2b1082ad7099cc3e6a11adb4da4b02f76acdeae9
SHA256

9e428504c94d39d5b922dc323bf6f2a9e782aec26f87782cb7e488b7919bd67e
SHA512

4e069ff21b77936d6e652f83bf19ef6c633e8f8ccb24098a7cd44c84bd2ccf6f6cc72cffb45ca523f054a56be0983b4081dd6a34dcb2c781036a7da5b829a580
SSDEEP

12288:PDg93ZnCvClCnK00Po2DnI9zRJaSDfUvMejqpCRWU4ZCLUXSoEay:LWZnCvNnK3PbrY1wSLU9j0Cx4EGSo

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9e428504c94d39d5b922dc323bf6f2a9e782aec26f87782cb7e488b7919bd67e

Files

9e428504c94d39d5b922dc323bf6f2a9e782aec26f87782cb7e488b7919bd67e
.exe windows:6 windows x64 arch:x64

8e37ac9f8f196118462c6b8145a82f1c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Jenkins\workspace\consumer-12-0-1-service\bin\Release\x64\Run64.pdb

Imports

kernel32

GetStdHandle
CreateProcessW
WaitForSingleObject
GetExitCodeProcess
CloseHandle
GetLastError
HeapDestroy
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
SizeofResource
LockResource
LoadResource
FindResourceW
FindResourceExW
InitializeCriticalSectionAndSpinCount
RaiseException
DecodePointer
DeleteCriticalSection
IsDebuggerPresent
OutputDebugStringW
EnterCriticalSection
LeaveCriticalSection
CreateFileW
ReadConsoleW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
EncodePointer
SetLastError
CreateEventW
Sleep
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
LCMapStringW
GetLocaleInfoW
GetCPInfo
SetEvent
ResetEvent
WaitForSingleObjectEx
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
GetCurrentProcess
TerminateProcess
RtlUnwindEx
RtlPcToFileHeader
FreeLibrary
LoadLibraryExW
SetStdHandle
GetFileType
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetACP
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadFile
SetFilePointerEx
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
WriteConsoleW

shlwapi

PathRemoveArgsW
PathRemoveFileSpecW

Sections

.text
Size: 161KB - Virtual size: 161KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 89KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 250KB - Virtual size: 249KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8e37ac9f8f196118462c6b8145a82f1c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

shlwapi

Sections

.text Size: 161KB - Virtual size: 161KB

.rdata Size: 89KB - Virtual size: 88KB

.data Size: 5KB - Virtual size: 12KB

.pdata Size: 9KB - Virtual size: 9KB

.rsrc Size: 250KB - Virtual size: 249KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 161KB - Virtual size: 161KB

.rdata
Size: 89KB - Virtual size: 88KB

.data
Size: 5KB - Virtual size: 12KB

.pdata
Size: 9KB - Virtual size: 9KB

.rsrc
Size: 250KB - Virtual size: 249KB

.reloc
Size: 3KB - Virtual size: 3KB