ce6d8f8a5ed016dae8f88c74a7a082a5bcf39a668d1a2c308b773163c9ef6e8d

Sharing

Copy URL Twitter E-mail

General

Target

ce6d8f8a5ed016dae8f88c74a7a082a5bcf39a668d1a2c308b773163c9ef6e8d
Size

8.4MB
MD5

c34ec63af9acc13043f7b141e2867115
SHA1

48f439267d7eac2906844794458ad32ad5166071
SHA256

ce6d8f8a5ed016dae8f88c74a7a082a5bcf39a668d1a2c308b773163c9ef6e8d
SHA512

201fb8eb63be6bb86015c9b361fdf0c3d66b6b5dc5b5a52257bfdd1a63b45712bfa4ab172b1cb414dccea691967990fac64b2b67b8b62608d498130ebe704b40
SSDEEP

196608:7zM79YeaLqN9Kb5tAqQwPqBc1GZAeK4cYwXR9Tkgyh8wdc0gItd:Prea+KbAqQ+4VA/4cYwXR9obX3g

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ce6d8f8a5ed016dae8f88c74a7a082a5bcf39a668d1a2c308b773163c9ef6e8d

Files

ce6d8f8a5ed016dae8f88c74a7a082a5bcf39a668d1a2c308b773163c9ef6e8d
.exe windows:6 windows x64 arch:x64

4ce2ce290fcce11ecb9f0f43a1b9b43b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

RegCloseKey
RegQueryValueExA
OpenSCManagerW
EnumServicesStatusExW
OpenServiceW
QueryServiceConfigW
CloseServiceHandle

gdi32

BitBlt

kernel32

GetVersionExA
GetVersionExW
GetCurrentProcess
LocalAlloc
GetCurrentProcess
GetCurrentThread
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
GetLastError
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress

msvcrt

___lc_codepage_func

user32

ActivateKeyboardLayout
CharUpperBuffW

wtsapi32

WTSSendMessageW

Exports

Exports

_cgo_dummy_export
authorizerTrampoline
callbackTrampoline
commitHookTrampoline
compareTrampoline
doneTrampoline
goELEMENT_COMPARATOR
goElementEventProc
goKeyValueCallback
goLPCBYTE_RECEIVER
goLPCSTR_RECEIVER
goLPCWSTR_RECEIVER
goNATIVE_FUNCTOR_INVOKE
goNATIVE_FUNCTOR_RELEASE
goSciterElementCallback
goSciterHostCallback
go_send
hook_create_screen_info
hook_get_auto_repeat_delay
hook_get_auto_repeat_rate
hook_get_multi_click_time
hook_get_pointer_acceleration_multiplier
hook_get_pointer_acceleration_threshold
hook_get_pointer_sensitivity
hook_post_event
hook_run
hook_set_dispatch_proc
hook_set_logger
hook_stop
preUpdateHookTrampoline
rollbackHookTrampoline
stepTrampoline
updateHookTrampoline

Sections

.text
Size: - Virtual size: 7.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: - Virtual size: 6.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 459KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.vmp0
Size: - Virtual size: 3.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.vmp1
Size: 8.4MB - Virtual size: 8.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 36B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4ce2ce290fcce11ecb9f0f43a1b9b43b

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

gdi32

kernel32

msvcrt

user32

wtsapi32

Exports

Exports

Sections

.text Size: - Virtual size: 7.9MB

.data Size: - Virtual size: 1.1MB

.rdata Size: - Virtual size: 6.8MB

.pdata Size: - Virtual size: 36KB

.xdata Size: - Virtual size: 36KB

.bss Size: - Virtual size: 459KB

.edata Size: - Virtual size: 1KB

.idata Size: - Virtual size: 9KB

.CRT Size: - Virtual size: 104B

.tls Size: 512B - Virtual size: 16B

.vmp0 Size: - Virtual size: 3.3MB

.vmp1 Size: 8.4MB - Virtual size: 8.4MB

.reloc Size: 512B - Virtual size: 36B

.rsrc Size: 19KB - Virtual size: 18KB

.text
Size: - Virtual size: 7.9MB

.data
Size: - Virtual size: 1.1MB

.rdata
Size: - Virtual size: 6.8MB

.pdata
Size: - Virtual size: 36KB

.xdata
Size: - Virtual size: 36KB

.bss
Size: - Virtual size: 459KB

.edata
Size: - Virtual size: 1KB

.idata
Size: - Virtual size: 9KB

.CRT
Size: - Virtual size: 104B

.tls
Size: 512B - Virtual size: 16B

.vmp0
Size: - Virtual size: 3.3MB

.vmp1
Size: 8.4MB - Virtual size: 8.4MB

.reloc
Size: 512B - Virtual size: 36B

.rsrc
Size: 19KB - Virtual size: 18KB