e2ceaf706f99d6d21cafb23d945a3354c20e066804ae12294eccb9c016998183

Sharing

Copy URL

Twitter E-mail

General

Target

e2ceaf706f99d6d21cafb23d945a3354c20e066804ae12294eccb9c016998183
Size

542KB
MD5

af1b363fcfdb909a9a1243129a9c01ad
SHA1

1a625808e54773d0c091907a7c6482d89689091d
SHA256

e2ceaf706f99d6d21cafb23d945a3354c20e066804ae12294eccb9c016998183
SHA512

deed3a68efa314739cdb4d62fe104feaacd8f6313838fc3b256644745bcfb855b4ff689d6d13e02a03272ca4253a7782d9895d29848ad078d6c04bf8136d1fa1
SSDEEP

12288:0rpPNGwENVxfdZNlMAIqS82WOdXGd3P4AY7PeHh:1VxfdZNNT2Ww2dQAaeHh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
e2ceaf706f99d6d21cafb23d945a3354c20e066804ae12294eccb9c016998183

Files

e2ceaf706f99d6d21cafb23d945a3354c20e066804ae12294eccb9c016998183
.exe windows:5 windows x86 arch:x86

296622fe6d93ca5407882b3ad42a3a64

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\DC\_main\Output\Release\VssFreeze-Server.pdb

Imports

vssapi

?CreateVssBackupComponents@@YGJPAPAVIVssBackupComponents@@@Z
ord6

kernel32

GetSystemTimeAsFileTime
CompareStringW
CompareStringA
GetLastError
GetVolumeNameForVolumeMountPointW
CloseHandle
CreateEventW
WideCharToMultiByte
GetVolumePathNamesForVolumeNameW
WriteFile
CreateFileW
GetVolumePathNameW
FindNextFileW
FindFirstFileW
GetFileAttributesW
QueryDosDeviceW
FindClose
GetTimeFormatW
GetDateFormatW
GetThreadLocale
FileTimeToSystemTime
FileTimeToLocalFileTime
DeleteFileW
GetModuleFileNameW
LocalFree
FormatMessageW
GetCommandLineW
WaitForSingleObject
SetEvent
CreateProcessW
ReadFile
GetFileSize
ExpandEnvironmentStringsW
GetProcessHeap
SetEndOfFile
CreateFileA
LoadLibraryA
GetLocaleInfoW
InitializeCriticalSectionAndSpinCount
SetStdHandle
WriteConsoleW
GetConsoleOutputCP
InterlockedIncrement
InterlockedDecrement
InterlockedCompareExchange
InterlockedExchange
MultiByteToWideChar
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
RtlUnwind
RaiseException
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
HeapFree
SetEnvironmentVariableA
LCMapStringA
LCMapStringW
GetStringTypeW
GetModuleHandleW
GetProcAddress
TlsGetValue
TlsAlloc
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
HeapAlloc
GetACP
GetOEMCP
IsValidCodePage
GetConsoleCP
GetConsoleMode
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
SetFilePointer
FlushFileBuffers
GetStringTypeA
GetModuleHandleA
HeapCreate
VirtualFree
VirtualAlloc
HeapReAlloc
GetTimeZoneInformation
HeapSize
ExitProcess
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetUserDefaultLCID
GetLocaleInfoA
EnumSystemLocalesA
IsValidLocale
WriteConsoleA

ole32

CLSIDFromString
CoTaskMemFree
CoCreateInstance
CoInitialize
CoUninitialize
CoInitializeSecurity

oleaut32

SysAllocString
SysFreeString

Sections

.text
Size: 310KB - Virtual size: 310KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 140KB - Virtual size: 139KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 6KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 70KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

296622fe6d93ca5407882b3ad42a3a64

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

vssapi

kernel32

ole32

oleaut32

Sections

.text Size: 310KB - Virtual size: 310KB

.rdata Size: 140KB - Virtual size: 139KB

.data Size: 6KB - Virtual size: 13KB

.rsrc Size: 70KB - Virtual size: 72KB

.text
Size: 310KB - Virtual size: 310KB

.rdata
Size: 140KB - Virtual size: 139KB

.data
Size: 6KB - Virtual size: 13KB

.rsrc
Size: 70KB - Virtual size: 72KB