1b9d7a1db682853f6324314ea3abe946641bf211b3d03cdde119c0fdd82372b6

Sharing

Copy URL Twitter E-mail

General

Target

1b9d7a1db682853f6324314ea3abe946641bf211b3d03cdde119c0fdd82372b6
Size

517KB
MD5

02bb63e3838307c0a3f20c84089b2055
SHA1

93a27cf641c082b09a057a63d525a1de163a9494
SHA256

1b9d7a1db682853f6324314ea3abe946641bf211b3d03cdde119c0fdd82372b6
SHA512

8a2a5a287df13f4090d572c1206d25a01d7058c73834b307b36909af055262ddac387f810e9fb983e7b6ccf1804a9668719ed9a54528b8f7e73acf62b4caaeae
SSDEEP

12288:AVW46z+wfECbsuWRQf/0gfbYwWHkSxTRW+NPn70r+:AVW46z+wfECbu+zfbYJxVrNwr+

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1b9d7a1db682853f6324314ea3abe946641bf211b3d03cdde119c0fdd82372b6

Files

1b9d7a1db682853f6324314ea3abe946641bf211b3d03cdde119c0fdd82372b6
.exe windows:6 windows x86 arch:x86

b0f2f9bb3d3701934ffc4c4f3d9b444c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\Clive\source\repos\x86_driver\Release\x86.pdb

Imports

shlwapi

PathFileExistsA

advapi32

RegSetValueExW
OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueA
RegSetValueExA
RegFlushKey
RegCreateKeyExW

user32

SendMessageA
SetWindowPos
GetSystemMetrics
wsprintfA
PostThreadMessageA
GetWindowRect
MessageBoxA
GetParent
FindWindowA
FindWindowExA
UnhookWindowsHookEx
SetWindowsHookExA
GetWindow
GetWindowThreadProcessId
GetTopWindow
EnumWindows

ntdll

RtlDosPathNameToNtPathName_U
RtlInitUnicodeString
RtlUnwind
NtLoadDriver
NtQuerySystemInformation

kernel32

LeaveCriticalSection
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetTimeZoneInformation
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleCP
FlushFileBuffers
GetCurrentDirectoryW
DeleteFileW
GetFileType
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
GetCurrentDirectoryA
CreateFileA
CreateFileW
GetFileSize
ReadFile
WriteFile
DecodePointer
CloseHandle
RaiseException
GetLastError
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionEx
DeleteCriticalSection
Sleep
GetCurrentProcess
GetCurrentProcessId
TerminateProcess
CreateProcessA
OpenProcess
GetModuleHandleA
GetProcAddress
LoadResource
LockResource
SizeofResource
LoadLibraryA
LoadLibraryW
lstrcmpiA
lstrcpyA
lstrcatA
lstrlenA
GetLogicalDriveStringsA
FindResourceA
GetPrivateProfileStringA
WritePrivateProfileStringA
QueryDosDeviceA
IsBadReadPtr
MultiByteToWideChar
WideCharToMultiByte
CreateToolhelp32Snapshot
Process32First
Process32Next
K32GetProcessImageFileNameA
EnterCriticalSection
WriteConsoleW
EncodePointer
LCMapStringEx
GetLocaleInfoEx
GetStringTypeW
CompareStringEx
GetCPInfo
IsDebuggerPresent
OutputDebugStringW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
GetCommandLineW
GetCommandLineA
GetStdHandle
GetModuleFileNameW
GetFullPathNameW
GetDriveTypeW
GetModuleHandleExW
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
GetModuleHandleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess

shell32

ShellExecuteA

wininet

HttpQueryInfoA
InternetReadFile
InternetOpenUrlA
InternetCloseHandle
InternetOpenA

urlmon

URLDownloadToFileA

Sections

.text
Size: 265KB - Virtual size: 265KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 71KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 107KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 160KB - Virtual size: 160KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b0f2f9bb3d3701934ffc4c4f3d9b444c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shlwapi

advapi32

user32

ntdll

kernel32

shell32

wininet

urlmon

Sections

.text Size: 265KB - Virtual size: 265KB

.rdata Size: 71KB - Virtual size: 70KB

.data Size: 6KB - Virtual size: 107KB

.rsrc Size: 160KB - Virtual size: 160KB

.reloc Size: 13KB - Virtual size: 12KB

.text
Size: 265KB - Virtual size: 265KB

.rdata
Size: 71KB - Virtual size: 70KB

.data
Size: 6KB - Virtual size: 107KB

.rsrc
Size: 160KB - Virtual size: 160KB

.reloc
Size: 13KB - Virtual size: 12KB