b9831e50a0ac1a8fe4b706a1575ee64683dc738e14d25476eee32446f38b5fc1

Sharing

Copy URL

Twitter E-mail

General

Target

b9831e50a0ac1a8fe4b706a1575ee64683dc738e14d25476eee32446f38b5fc1
Size

37KB
MD5

77a82627ba74152c54a049c5f784ca2a
SHA1

1d456208111a123128a7eb20f70ab32d47d63b8e
SHA256

b9831e50a0ac1a8fe4b706a1575ee64683dc738e14d25476eee32446f38b5fc1
SHA512

9676b98d28923b46640a90b8b471b66082fc60fffb29e5896256dae13790f357d1b0c56063f2c85df12e776a59cac00632f34917441fe97fd8d960e5d186d6e3
SSDEEP

768:fL+GKaJ4VtiZL1RwOlu6SotXKUGqGxFjVyCHE/:aGKywt6vAJVyj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b9831e50a0ac1a8fe4b706a1575ee64683dc738e14d25476eee32446f38b5fc1

Files

b9831e50a0ac1a8fe4b706a1575ee64683dc738e14d25476eee32446f38b5fc1
.exe windows:6 windows x86 arch:x86

ff3ff68657eadf09f34a102c6be900be

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

F:\Jenkins\WorkSpace\workspace\lib_reiboot_win\trunk\link\x86\irestore\Release\irestore.pdb

Imports

shlwapi

PathFileExistsW
PathCombineA

ws2_32

recv
select

reiboot

?logger_init@TSLogger@reiboot@@SAHHPB_W@Z
?ws2s@TSStringHelper@base@reiboot@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@ABV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@5@I@Z
?logger_write@TSLogger@reiboot@@SAHHPB_WZZ
?GetFactory@reiboot@@YAPAVTSFactory@1@XZ
?logger_quit@TSLogger@reiboot@@SAXXZ

kernel32

InitializeCriticalSection
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetModuleHandleW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
CreateEventW
CloseHandle
lstrcmpiW
SetEvent
CreateFileW
SetNamedPipeHandleState
GetLastError
WaitNamedPipeW
WaitForSingleObject
CreateThread
Sleep
HeapAlloc
GetProcessHeap
WriteFile
UnhandledExceptionFilter
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameA
GetFileSizeEx
GetLocalTime
MoveFileW
SetFilePointer
IsProcessorFeaturePresent

ole32

CoUninitialize
CoInitialize

msvcp140

?_Xlength_error@std@@YAXPBD@Z

vcruntime140

__std_terminate
__CxxFrameHandler3
__std_exception_copy
__std_exception_destroy
_CxxThrowException
memset
_except_handler4_common
memcpy
_purecall
memmove

api-ms-win-crt-runtime-l1-1-0

_exit
_invalid_parameter_noinfo_noreturn
__p___argc
__p___wargv
_cexit
exit
_register_thread_local_exe_atexit_callback
_get_initial_wide_environment
_initialize_wide_environment
_initterm_e
_c_exit
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_controlfp_s
terminate
_seh_filter_exe
_configure_wide_argv
_initterm
_set_app_type

api-ms-win-crt-convert-l1-1-0

_ui64tow_s

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__stdio_common_vswprintf_s
__stdio_common_vsprintf_s
__p__commode
__stdio_common_vsnwprintf_s
__stdio_common_vsprintf

api-ms-win-crt-filesystem-l1-1-0

_splitpath_s

api-ms-win-crt-heap-l1-1-0

_set_new_mode
_callnewh
free
malloc

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ff3ff68657eadf09f34a102c6be900be

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shlwapi

ws2_32

reiboot

kernel32

ole32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 17KB - Virtual size: 17KB

.rdata Size: 12KB - Virtual size: 12KB

.data Size: 3KB - Virtual size: 3KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 17KB - Virtual size: 17KB

.rdata
Size: 12KB - Virtual size: 12KB

.data
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1KB - Virtual size: 1KB