runnonelevated3[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

runnonelevated3.exe
Size

94KB
MD5

00969fb89a9ffcaf81b3b008a1d91ab1
SHA1

bca843fa342083e530bf3826fbe309bc983ca944
SHA256

e75aa7e501e065b2e37e291e508caa8a6e2e2576b35a36efeff8cd7d671edc7a
SHA512

9b63bfabcf25ee17120f4a61e32fa5d8f36678f2429ed10afc4cca0789bae41abb4551ac762dde203f92d486b91d8142f0a1dd83af3f4dd2f1e8d4085a03e529
SSDEEP

1536:2fKpe4TN/cP9G3ZxraK8rTdkk7+Zy5c5VuenJB5++LDofv5P/mR:4v45CCZx4rlSyzec+3Kv5PeR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
runnonelevated3.exe

Files

runnonelevated3.exe
.exe windows:5 windows x86 arch:x86

0eb1fc38e09f7f2a331b6a001c759c21

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\ninite\Output\Tools\runnonelevated.pdb

Imports

kernel32

LocalFree
GetCurrentProcessId
CloseHandle
LockResource
GetLastError
GetModuleFileNameW
GetExitCodeProcess
FormatMessageW
SizeofResource
OpenProcess
WaitForSingleObject
GetCurrentProcess
LoadResource
FindResourceW
FindResourceExW
WriteConsoleW
SetStdHandle
FlushFileBuffers
LoadLibraryW
RaiseException
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
GetProcessHeap
VirtualProtect
VirtualAlloc
GetProcAddress
GetModuleHandleW
GetSystemInfo
VirtualQuery
GetCommandLineW
HeapSetInformation
EncodePointer
DecodePointer
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
GetCPInfo
InterlockedIncrement
InterlockedDecrement
GetACP
GetOEMCP
IsValidCodePage
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
SetLastError
GetCurrentThreadId
IsProcessorFeaturePresent
HeapCreate
ExitProcess
WriteFile
GetStdHandle
SetHandleCount
GetFileType
GetStartupInfoW
Sleep
FreeEnvironmentStringsW
GetEnvironmentStringsW
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
WideCharToMultiByte
LCMapStringW
MultiByteToWideChar
GetStringTypeW
SetFilePointer
GetConsoleCP
GetConsoleMode
RtlUnwind
CreateFileW

advapi32

OpenProcessToken
AdjustTokenPrivileges
GetLengthSid
InitializeSid
GetSidLengthRequired
IsValidSid
RevertToSelf
DuplicateTokenEx
LookupPrivilegeValueW
SetTokenInformation
CreateProcessAsUserW
EqualSid
CopySid
GetTokenInformation
SetThreadToken
GetSidSubAuthority

userenv

UnloadUserProfile

psapi

EnumProcesses

Sections

.text
Size: 66KB - Virtual size: 66KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0eb1fc38e09f7f2a331b6a001c759c21

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

userenv

psapi

Sections

.text Size: 66KB - Virtual size: 66KB

.rdata Size: 15KB - Virtual size: 15KB

.data Size: 4KB - Virtual size: 12KB

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 66KB - Virtual size: 66KB

.rdata
Size: 15KB - Virtual size: 15KB

.data
Size: 4KB - Virtual size: 12KB

.reloc
Size: 6KB - Virtual size: 6KB