6b0e8ecf36ff4f646fbdce84976b9964e111eebf8588188d85ff640962d1b5d2

Sharing

Copy URL Twitter E-mail

General

Target

6b0e8ecf36ff4f646fbdce84976b9964e111eebf8588188d85ff640962d1b5d2
Size

18KB
MD5

8927e161c6cc8b5b3463ec251c7a2dc6
SHA1

c1dd747faed1760e7c420e95daa4f958b0683647
SHA256

6b0e8ecf36ff4f646fbdce84976b9964e111eebf8588188d85ff640962d1b5d2
SHA512

c98b304bc611ab6989b9e36e4d71b4686af56be36648852b4eba104072e461e77b2bc0eefc0908b1fb4116e06f4387d1fcf8d69c6fee9cc554d4c46ae7376596
SSDEEP

192:Ck19HuDpBlkwLKyAsNea2uMdJhQE2n7Uj7DnQRjOyLp70MAtY9upRDVNesSsCvnN:pVu93F2uuJ8UTngjjLdf9uPjelWSCE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6b0e8ecf36ff4f646fbdce84976b9964e111eebf8588188d85ff640962d1b5d2

Files

6b0e8ecf36ff4f646fbdce84976b9964e111eebf8588188d85ff640962d1b5d2
.dll windows:6 windows x86 arch:x86

693c6cf1d69b59f7e4d853af250d5a81

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

F:\TeamCity\BuildAgent2\work\a912b97def7a06df\bin\Windows\Win32\Release\star_rmap_initiator.pdb

Imports

userenv

GetUserProfileDirectoryA

star-api

ord33
ord43
ord101
ord96
ord122
ord37
ord164
ord82
ord115
ord78
ord165
ord44
ord39
ord48
ord119
ord36

rmap_packet_library

ord1
ord45
ord19
ord41
ord7
ord34
ord36
ord28
ord2
ord39
ord26

kernel32

IsDebuggerPresent
InitializeSListHead
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
LeaveCriticalSection
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
EnterCriticalSection
WaitForSingleObject
Sleep
SetEvent
ResetEvent
IsProcessorFeaturePresent
InitializeCriticalSection
DeleteCriticalSection
GetSystemTimeAsFileTime
GetCurrentProcess
GetFileAttributesA
CreateEventA
CloseHandle

advapi32

OpenProcessToken

vcruntime140

memset
_except_handler4_common
__std_type_info_destroy_list
memcpy

api-ms-win-crt-heap-l1-1-0

free
calloc

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_configure_narrow_argv
_seh_filter_dll
_execute_onexit_table
_initterm
_cexit
_initterm_e
_initialize_narrow_environment
_beginthreadex

api-ms-win-crt-stdio-l1-1-0

fopen_s
fflush
fclose
__stdio_common_vsprintf_s
__stdio_common_vfprintf

api-ms-win-crt-time-l1-1-0

_localtime64_s
strftime

api-ms-win-crt-filesystem-l1-1-0

_stat64i32
_unlink
rename

api-ms-win-crt-string-l1-1-0

strcpy_s

Exports

Exports

STAR_RMAP_INITIATOR_read
STAR_RMAP_INITIATOR_readModifyWrite
STAR_RMAP_INITIATOR_write

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 844B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

693c6cf1d69b59f7e4d853af250d5a81

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

userenv

star-api

rmap_packet_library

kernel32

advapi32

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

Exports

Exports

Sections

.text Size: 9KB - Virtual size: 8KB

.rdata Size: 5KB - Virtual size: 4KB

.data Size: 512B - Virtual size: 984B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 844B

.text
Size: 9KB - Virtual size: 8KB

.rdata
Size: 5KB - Virtual size: 4KB

.data
Size: 512B - Virtual size: 984B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 844B