03e62c9c2d99040c49d0b8348a2ef8ca524cb7344134e3c56b0f87714f5ea1ff

Sharing

Copy URL Twitter E-mail

General

Target

03e62c9c2d99040c49d0b8348a2ef8ca524cb7344134e3c56b0f87714f5ea1ff
Size

1.7MB
MD5

e3903dd8d167798ca8ca770986670b02
SHA1

bb18bc7586baed0bf693e963d4c29505d2f9d6f9
SHA256

03e62c9c2d99040c49d0b8348a2ef8ca524cb7344134e3c56b0f87714f5ea1ff
SHA512

d96cad31c4b27ab7f1182b93bbb56564a7dc0922eb5a9449a211107993a848042a1ea6986800071a1624f694650a8343248287ae0f9294d24cd517755ee7fb6c
SSDEEP

24576:epL4Q4y94x7ZWe6b1B5I2M62kM0s1vt2txc/viV41IORNfLcvOdSv8Ucaod1Po6P:OL4Q3S9b6b1UA9MPCOR5cW8j2XotK92

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
03e62c9c2d99040c49d0b8348a2ef8ca524cb7344134e3c56b0f87714f5ea1ff

Files

03e62c9c2d99040c49d0b8348a2ef8ca524cb7344134e3c56b0f87714f5ea1ff
.exe windows:10 windows x64 arch:x64

41d93aed02d7a4dcb703dee9ebeb7f6c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

AgentService.pdb

Imports

advapi32

EventSetInformation
RegisterServiceCtrlHandlerW
SetServiceStatus
EventRegister
EventWriteTransfer
EventWrite
RegGetValueW
RegOpenKeyExW
RegSetValueExW
RegCloseKey
EventUnregister
CreateProcessAsUserW
OpenProcessToken
SetTokenInformation
GetTokenInformation
RegQueryValueExW
ConvertSidToStringSidW
GetSidSubAuthority
GetSidSubAuthorityCount
AdjustTokenPrivileges
LookupPrivilegeValueW
DuplicateTokenEx
StartServiceCtrlDispatcherW
EqualSid
CreateWellKnownSid
GetNamedSecurityInfoW
RegSetKeyValueW
RegDeleteKeyExW
RegDeleteValueW
RegEnumValueW
RegQueryInfoKeyW
RegCreateKeyExW
RegEnumKeyExW
RegDeleteTreeW

kernel32

GetShortPathNameW
QueryFullProcessImageNameW
lstrcmpiW
GetCurrentProcess
GetLastError
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
OutputDebugStringW
LocalLock
FormatMessageW
TlsGetValue
TlsAlloc
TlsSetValue
ResetEvent
WaitForSingleObjectEx
OpenEventA
FormatMessageA
AreFileApisANSI
GetCurrentDirectoryW
DeviceIoControl
CreateDirectoryW
CreateIoCompletionPort
FreeLibrary
GetProcAddress
LocalAlloc
GetProcessMitigationPolicy
GetModuleFileNameW
GetModuleHandleExW
SetLastError
lstrlenA
SystemTimeToFileTime
FindClose
FindNextFileW
FindFirstFileW
GetFileTime
GetFileSize
DeleteFileW
SetEvent
SetFileAttributesW
GetComputerNameExW
GetFileAttributesW
CreateFileW
ExpandEnvironmentStringsW
WriteFile
CreateEventA
GetProcessHeap
HeapAlloc
HeapFree
ReadFile
GetLocalTime
TerminateProcess
UnhandledExceptionFilter
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
GetModuleHandleW
SetUnhandledExceptionFilter
DecodePointer
EncodePointer
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetLocaleInfoW
InitializeCriticalSectionEx
WideCharToMultiByte
GetStringTypeW
MultiByteToWideChar
CreateThread
GetSystemInfo
GetQueuedCompletionStatus
IsWow64Process
GetSystemWindowsDirectoryW
GetCurrentProcessId
CloseHandle
Sleep
ProcessIdToSessionId
OpenProcess
WaitForSingleObject
LocalUnlock
LocalFree

msvcrt

__set_app_type
__getmainargs
_amsg_exit
_XcptFilter
isdigit
isalnum
memcmp
___lc_collate_cp_func
memchr
tolower
isspace
_Strftime
_Gettnames
__mb_cur_max
_Wcsftime
_W_Gettnames
_W_Getmonths
_W_Getdays
_Getmonths
_Getdays
memcpy_s
ldexp
realloc
abort
_free_locale
_get_current_locale
__crtLCMapStringA
__crtLCMapStringW
__crtCompareStringA
__crtCompareStringW
??8type_info@@QEBAHAEBV0@@Z
_wcsdup
__uncaught_exception
islower
memset
_ismbblead
___mb_cur_max_func
calloc
___lc_codepage_func
___lc_handle_func
exit
__pctype_func
setlocale
_unlock
_lock
_errno
memcpy
_CxxThrowException
??0exception@@QEAA@AEBQEBDH@Z
_callnewh
malloc
sprintf_s
localeconv
?name@type_info@@QEBAPEBDXZ
??0exception@@QEAA@XZ
strcspn
free
??0exception@@QEAA@AEBV0@@Z
fclose
fwrite
fputc
fflush
fgetc
fgetpos
setvbuf
ungetc
fsetpos
_fseeki64
_wcsicmp
_wtoi
strchr
ldiv
time
_wcsnicmp
_stricmp
strerror
fseek
_wfsopen
mbstowcs_s
__CxxFrameHandler3
??_V@YAXPEAX@Z
memmove
_purecall
_exit
_cexit
__setusermatherr
_initterm
__C_specific_handler
_fmode
_commode
?terminate@@YAXXZ
__dllonexit
_onexit
??1type_info@@UEAA@XZ
??3@YAXPEAX@Z
isupper
??0exception@@QEAA@AEBQEBD@Z
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
??0bad_cast@@QEAA@AEBV0@@Z
??0bad_cast@@QEAA@PEBD@Z
??1bad_cast@@UEAA@XZ
swprintf_s
wcscmp

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

ole32

CoInitializeEx
CoTaskMemFree
CLSIDFromProgID
OleRun
CoUninitialize
CoCreateInstance
CLSIDFromString

oleaut32

SysStringLen
SysFreeString
SysAllocString
SysAllocStringByteLen
VariantClear

wintrust

WinVerifyTrust

fltlib

FilterGetMessage
FilterReplyMessage
FilterConnectCommunicationPort

shell32

SHGetKnownFolderPath

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

activeds

ord3

Sections

.text
Size: 767KB - Virtual size: 766KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 328KB - Virtual size: 328KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 35KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 572KB - Virtual size: 576KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

41d93aed02d7a4dcb703dee9ebeb7f6c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

msvcrt

ntdll

ole32

oleaut32

wintrust

fltlib

shell32

version

activeds

Sections

.text Size: 767KB - Virtual size: 766KB

.rdata Size: 328KB - Virtual size: 328KB

.data Size: 28KB - Virtual size: 35KB

.pdata Size: 30KB - Virtual size: 30KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 572KB - Virtual size: 576KB

.text
Size: 767KB - Virtual size: 766KB

.rdata
Size: 328KB - Virtual size: 328KB

.data
Size: 28KB - Virtual size: 35KB

.pdata
Size: 30KB - Virtual size: 30KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 572KB - Virtual size: 576KB