3a5218ebff433bf2c5e20dc33fd1cd92b0866f2488795c4d418a60a009dd7948

Sharing

Copy URL Twitter E-mail

General

Target

3a5218ebff433bf2c5e20dc33fd1cd92b0866f2488795c4d418a60a009dd7948
Size

4.2MB
MD5

78897b9f3956174ff494ee6b528cd3ff
SHA1

30a8b23abcdf1884294f50ffc8289e9b097ec930
SHA256

3a5218ebff433bf2c5e20dc33fd1cd92b0866f2488795c4d418a60a009dd7948
SHA512

90739c2feb8e0ececef60b9eb43cdff65160c347ac98bd103fbdc574b3fed26b4ff224142a801073efa0796f7a10ecd2f67b21abc5c925fc7f88c93433d37238
SSDEEP

98304:auSyHEl4SkhfdR141tv1wMyLMi+x5mw5dP:aTykiSkdH141tv1L

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3a5218ebff433bf2c5e20dc33fd1cd92b0866f2488795c4d418a60a009dd7948

Files

3a5218ebff433bf2c5e20dc33fd1cd92b0866f2488795c4d418a60a009dd7948
.exe windows:6 windows x86 arch:x86

9f88946ea17091bb62e9b2aa157b1454

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_BIND
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

E:\workspace\HostCommon_release_v10.7.0-UPD13\source\ENS\900599\BuildResults\Release32\mfeepmpk_utility.pdb

Imports

kernel32

Wow64DisableWow64FsRedirection
LoadLibraryExW
GetProcessTimes
FormatMessageA
GetCurrentProcessId
GetProcAddress
GetCurrentDirectoryW
CloseHandle
FileTimeToSystemTime
OutputDebugStringW
GetLastError
OpenProcess
GetModuleHandleA
LocalAlloc
GetModuleFileNameW
SetLastError
FreeLibrary
GetModuleHandleW
LoadLibraryW
DeleteFileW
Sleep
UnmapViewOfFile
HeapSize
ReadConsoleW
WriteConsoleW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
ReadFile
SizeofResource
GetCurrentProcess
OutputDebugStringA
GetTempPathW
CreateFileW
MultiByteToWideChar
LockResource
GlobalAlloc
GlobalFree
LoadResource
FindResourceW
GetWindowsDirectoryW
MoveFileExW
WideCharToMultiByte
CreateFileMappingW
MapViewOfFile
MoveFileW
IsWow64Process
DeviceIoControl
GetCurrentThreadId
GetModuleHandleExW
LocalFree
WriteProcessMemory
VirtualFree
VirtualAlloc
WaitForSingleObject
CreateToolhelp32Snapshot
Process32NextW
Process32FirstW
Module32FirstW
VirtualAllocEx
CreateRemoteThread
Module32NextW
VirtualFreeEx
RaiseException
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
EncodePointer
DecodePointer
InitializeCriticalSectionAndSpinCount
CreateEventW
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
CompareStringW
LCMapStringW
GetLocaleInfoW
GetCPInfo
SetEvent
ResetEvent
WaitForSingleObjectEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
QueryPerformanceCounter
InitializeSListHead
RtlUnwind
HeapAlloc
HeapReAlloc
HeapFree
ExitProcess
GetStdHandle
WriteFile
GetCommandLineA
GetCommandLineW
GetACP
GetFileType
FlushFileBuffers
GetConsoleCP
GetConsoleMode
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
SetFilePointerEx
GetProcessHeap
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetEnvironmentStringsW
SetEndOfFile

advapi32

RegQueryValueExW
CloseServiceHandle
OpenSCManagerW
OpenServiceW
QueryServiceStatusEx
TraceEvent
CryptAcquireContextW
EqualSid
AllocateAndInitializeSid
CryptCreateHash
CryptHashData
CryptDestroyHash
OpenProcessToken
FreeSid
CheckTokenMembership
CryptGetHashParam
CryptReleaseContext
GetTokenInformation
RegCloseKey
RegSetValueExW
RegOpenKeyExW
RegGetValueW

wintrust

WinVerifyTrust

psapi

GetModuleFileNameExA

rpcrt4

UuidCreate

Sections

.text
Size: 210KB - Virtual size: 210KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 79KB - Virtual size: 78KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 172KB - Virtual size: 178KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.didat
Size: 512B - Virtual size: 40B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 9B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3.8MB - Virtual size: 3.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9f88946ea17091bb62e9b2aa157b1454

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

wintrust

psapi

rpcrt4

Sections

.text Size: 210KB - Virtual size: 210KB

.rdata Size: 79KB - Virtual size: 78KB

.data Size: 172KB - Virtual size: 178KB

.didat Size: 512B - Virtual size: 40B

.tls Size: 512B - Virtual size: 9B

.rsrc Size: 3.8MB - Virtual size: 3.8MB

.reloc Size: 12KB - Virtual size: 11KB

.text
Size: 210KB - Virtual size: 210KB

.rdata
Size: 79KB - Virtual size: 78KB

.data
Size: 172KB - Virtual size: 178KB

.didat
Size: 512B - Virtual size: 40B

.tls
Size: 512B - Virtual size: 9B

.rsrc
Size: 3.8MB - Virtual size: 3.8MB

.reloc
Size: 12KB - Virtual size: 11KB