17f6c18667cbe0f77466f115830c46ba353a1fdd1c2b59bd3a1c9f261103f204

Sharing

Copy URL Twitter E-mail

General

Target

17f6c18667cbe0f77466f115830c46ba353a1fdd1c2b59bd3a1c9f261103f204
Size

8.2MB
MD5

71194e8cf867cb992f7ffd6cfd95d66d
SHA1

306852703f9c0cb2ddab467dc07e3e11248b40d1
SHA256

17f6c18667cbe0f77466f115830c46ba353a1fdd1c2b59bd3a1c9f261103f204
SHA512

2034bd1f72286e8b9f82327a5d7510de15ed43041d86fd1006ea0710f15cb2562efbc566e0610202f1b408f5628f92ca3753e60f590fc76c8971ed21076e3129
SSDEEP

196608:CfQzF26iZrVG5Jf8W8zTN6z4eTHbQ3r5ovw6:eQzFDEkf8LzF4bi9g

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
17f6c18667cbe0f77466f115830c46ba353a1fdd1c2b59bd3a1c9f261103f204

Files

17f6c18667cbe0f77466f115830c46ba353a1fdd1c2b59bd3a1c9f261103f204
.exe windows:6 windows x86 arch:x86

cba6c57e12ae94ace270fe6678a80a9f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\jenkins\workspace\CommonTools\RazerInstaller_Master\SafeExtractor\Release\SafeExtractor.pdb

Imports

kernel32

GetWindowsDirectoryW
FindResourceW
GetLastError
LoadResource
LockResource
SizeofResource
lstrcpynW
CreateProcessW
CloseHandle
HeapSize
CreateFileW
WriteConsoleW
WideCharToMultiByte
MultiByteToWideChar
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetModuleHandleW
GetProcAddress
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
SetEvent
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
InitializeSListHead
RaiseException
RtlUnwind
FreeLibrary
LoadLibraryExW
HeapAlloc
HeapReAlloc
HeapFree
ExitProcess
GetModuleHandleExW
GetModuleFileNameW
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
GetACP
GetFileType
FlushFileBuffers
GetConsoleCP
GetConsoleMode
ReadFile
SetFilePointerEx
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetProcessHeap
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
ReadConsoleW
SetEndOfFile

shell32

SHCreateDirectoryExW

Sections

.text
Size: 144KB - Virtual size: 144KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 1024B - Virtual size: 648B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 8.0MB - Virtual size: 8.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cba6c57e12ae94ace270fe6678a80a9f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

shell32

Sections

.text Size: 144KB - Virtual size: 144KB

.rdata Size: 62KB - Virtual size: 62KB

.data Size: 4KB - Virtual size: 8KB

.gfids Size: 1024B - Virtual size: 648B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 8.0MB - Virtual size: 8.0MB

.reloc Size: 9KB - Virtual size: 9KB

.text
Size: 144KB - Virtual size: 144KB

.rdata
Size: 62KB - Virtual size: 62KB

.data
Size: 4KB - Virtual size: 8KB

.gfids
Size: 1024B - Virtual size: 648B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 8.0MB - Virtual size: 8.0MB

.reloc
Size: 9KB - Virtual size: 9KB