c40d0ac2d1b593c673bf75a3511d3e55e8e3f51f8fb42b79bdca1f47d82c5bb4

Sharing

Copy URL Twitter E-mail

General

Target

c40d0ac2d1b593c673bf75a3511d3e55e8e3f51f8fb42b79bdca1f47d82c5bb4
Size

1.4MB
MD5

7df1032833eb2952148fe2aaefa752bd
SHA1

f17575b3311b07e1aca581f94d4b2f950fb026f1
SHA256

c40d0ac2d1b593c673bf75a3511d3e55e8e3f51f8fb42b79bdca1f47d82c5bb4
SHA512

25576b23ded9eded97f193782469c43e327cd1f0cd11baffb29c4d37a17b4a1e839d3459d31a8422d75d916d017df3d4a3a9c6781cf5e2736752d1a8ae2fbb0a
SSDEEP

24576:zM5gCsob142dCxxG1kgrMhWvOWJ6pB4qcwfUEWWgS8kXxKbzuoJqrars5SERlGqM:zMmCnu2dC7G1kgr3vOWJ6pPcw/WdDkBI

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c40d0ac2d1b593c673bf75a3511d3e55e8e3f51f8fb42b79bdca1f47d82c5bb4

Files

c40d0ac2d1b593c673bf75a3511d3e55e8e3f51f8fb42b79bdca1f47d82c5bb4
.dll windows:5 windows x64 arch:x64

1b1cfaeaf7326ffa6c77e000dabffc53

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

F:\WorkshopAgent\DevelopProj2\SDModule\Branches\Inner\V4PreRelease\Bin\Release\SDAgent64.pdb

Imports

kernel32

GetExitCodeProcess
MulDiv
MultiByteToWideChar
MoveFileA
GetUserDefaultLangID
FreeLibrary
GetVersion
GetSystemDefaultLangID
ResetEvent
WaitForSingleObject
WideCharToMultiByte
GetProfileStringA
GetPrivateProfileStringA
LoadLibraryW
SetUnhandledExceptionFilter
SetErrorMode
SetProcessShutdownParameters
CompareFileTime
SetCurrentDirectoryW
GetCurrentDirectoryW
CreateMutexW
OpenMutexW
GetFileSize
SetEvent
OpenEventA
CreateEventA
WaitForMultipleObjects
ReleaseSemaphore
CreateSemaphoreA
GetComputerNameA
GetComputerNameW
GetProcessTimes
GetFileAttributesW
CreateDirectoryW
CreateDirectoryA
GetFileAttributesExA
GetFileAttributesExW
GetVolumeInformationW
ReadFile
CopyFileA
SetFileAttributesW
lstrcmpW
RemoveDirectoryW
DeleteFileW
MoveFileExW
SetFileAttributesA
lstrcmpA
RemoveDirectoryA
CreateFileW
FileTimeToSystemTime
CopyFileW
GetDiskFreeSpaceExW
GetFileTime
SetFileTime
GetProcessHeap
HeapAlloc
QueryDosDeviceW
GetDriveTypeA
DefineDosDeviceA
GetDiskFreeSpaceExA
SetVolumeLabelA
GetVolumeInformationA
VirtualProtect
IsBadReadPtr
SetEnvironmentVariableA
CompareStringW
WriteConsoleW
SetStdHandle
SetConsoleCtrlHandler
HeapReAlloc
IsValidLocale
HeapFree
VirtualQuery
CreateProcessW
WriteFile
FlushFileBuffers
DeleteFileA
MoveFileExA
GetSystemInfo
FindFirstFileW
FindNextFileW
FindFirstFileA
FindNextFileA
FindClose
CreateThread
GetModuleHandleW
GetFileInformationByHandle
GetCurrentThreadId
GetFileAttributesA
GetWindowsDirectoryA
QueryDosDeviceA
GetDriveTypeW
GetModuleFileNameA
GetCommandLineA
GetTickCount
CreateFileA
GetSystemDirectoryA
Sleep
DeviceIoControl
OpenMutexA
OpenProcess
LocalFree
GetCurrentProcess
DuplicateHandle
CloseHandle
GetModuleHandleA
LoadLibraryA
GetProcAddress
GetLastError
GetCurrentProcessId
GetLogicalDrives
EnumSystemLocalesA
GetLocaleInfoA
GetUserDefaultLCID
GetConsoleMode
GetConsoleCP
FatalAppExitA
GetTimeZoneInformation
GetLocaleInfoW
GetStringTypeW
QueryPerformanceCounter
HeapDestroy
HeapCreate
HeapSetInformation
GetEnvironmentStringsW
FreeEnvironmentStringsW
GetStartupInfoW
LoadResource
FindResourceExA
lstrlenA
lstrlenW
GetVersionExA
FormatMessageA
GetACP
FormatMessageW
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
SleepEx
CreateMutexA
ReleaseMutex
PulseEvent
SuspendThread
TerminateThread
ResumeThread
SetThreadPriority
GetExitCodeThread
FileTimeToLocalFileTime
SetLastError
MoveFileW
CreateProcessA
GetModuleFileNameW
TerminateProcess
SetPriorityClass
GetPriorityClass
GetThreadPriority
VirtualQueryEx
GetCurrentDirectoryA
GetSystemDirectoryW
GetTempPathA
GetTempPathW
GetEnvironmentVariableA
GetEnvironmentVariableW
ExpandEnvironmentStringsA
ExpandEnvironmentStringsW
UnmapViewOfFile
MapViewOfFile
CreateFileMappingA
OpenFileMappingA
SetFilePointer
LocalAlloc
OutputDebugStringW
FreeConsole
WriteConsoleA
GetStdHandle
AllocConsole
GetLocalTime
RtlLookupFunctionEntry
RtlUnwindEx
GetSystemTimeAsFileTime
EncodePointer
DecodePointer
RaiseException
RtlPcToFileHeader
FlsSetValue
GetDateFormatA
GetTimeFormatA
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
GetCPInfo
GetOEMCP
IsValidCodePage
FlsGetValue
FlsFree
GetCurrentThread
FlsAlloc
LCMapStringW
HeapSize
ExitProcess
SetHandleCount
InitializeCriticalSectionAndSpinCount
GetFileType
SetEndOfFile

user32

SetThreadDesktop
GetThreadDesktop
OpenDesktopA
FindWindowExA
GetWindowThreadProcessId
FindWindowA
CloseDesktop
MsgWaitForMultipleObjects
PostThreadMessageA
PeekMessageA
GetMessageA
TranslateMessage
DispatchMessageA
GetDesktopWindow
EnumChildWindows
EnumWindows
GetWindowLongA
EnumDesktopWindows
GetClassNameW
IsWindowVisible
CreateWindowExA
wsprintfA
GetSystemMetrics
SystemParametersInfoA
EnumWindowStationsA
EnumDesktopsA
GetUserObjectInformationW
GetClientRect
SendMessageA
GetForegroundWindow
AttachThreadInput
ShowWindow
GetWindowLongPtrA
SetWindowPos
SetForegroundWindow
GetWindowTextW
GetWindowTextA
GetParent
SendMessageTimeoutA
MessageBoxW
MessageBoxA
OpenWindowStationA
SetProcessWindowStation
CloseWindowStation
GetProcessWindowStation
GetUserObjectInformationA
OpenInputDesktop

gdi32

CreateDCW
GetStockObject
GetObjectW
GetDeviceCaps
CreateFontIndirectW
DeleteDC
DeleteObject
GetBitmapBits
BitBlt
SelectObject
CreateCompatibleBitmap
CreateCompatibleDC

advapi32

GetSecurityDescriptorDacl
InitializeSecurityDescriptor
GetAclInformation
GetLengthSid
InitializeAcl
GetAce
AddAce
AddAccessAllowedAce
SetSecurityDescriptorDacl
LookupAccountNameW
GetUserNameA
GetFileSecurityW
SetFileSecurityW
GetFileSecurityA
SetFileSecurityA
RegSetValueExA
RegOpenKeyA
LookupAccountSidA
LookupPrivilegeValueA
AdjustTokenPrivileges
RegCreateKeyA
RegQueryValueExA
RegCloseKey
OpenSCManagerA
OpenServiceA
QueryServiceConfigA
ChangeServiceConfigA
CloseServiceHandle
OpenProcessToken
DuplicateTokenEx
GetTokenInformation
AllocateAndInitializeSid
EqualSid
FreeSid
RegConnectRegistryA
RegOpenKeyExA
RegCreateKeyExA
RegQueryValueExW
RegDeleteKeyA
RegEnumKeyA
RegQueryInfoKeyA
RegDeleteValueA
RegSetValueExW
RegEnumValueA
RegSetKeySecurity
LookupAccountSidW
RegCreateKeyW
RegCreateKeyExW
QueryServiceStatus
RegOpenKeyW
DeregisterEventSource
ReportEventW
RegisterEventSourceW

shell32

SHChangeNotify
SHGetPathFromIDListW

ole32

CoTaskMemFree
CoInitialize
CoCreateInstance
CoUninitialize

oleaut32

SystemTimeToVariantTime
DosDateTimeToVariantTime

mpr

WNetGetConnectionW

version

GetFileVersionInfoSizeA
GetFileVersionInfoA
VerQueryValueA

Exports

Exports

Control
Start
Stop
Valid

Sections

.text
Size: 893KB - Virtual size: 892KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 319KB - Virtual size: 319KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 83KB - Virtual size: 151KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 67KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1b1cfaeaf7326ffa6c77e000dabffc53

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

mpr

version

Exports

Exports

Sections

.text Size: 893KB - Virtual size: 892KB

.rdata Size: 319KB - Virtual size: 319KB

.data Size: 83KB - Virtual size: 151KB

.pdata Size: 67KB - Virtual size: 66KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 17KB - Virtual size: 17KB

.text
Size: 893KB - Virtual size: 892KB

.rdata
Size: 319KB - Virtual size: 319KB

.data
Size: 83KB - Virtual size: 151KB

.pdata
Size: 67KB - Virtual size: 66KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 17KB - Virtual size: 17KB