5d061a73a506243776e396731665115c12d9903966265ada825e2c6931816848

Sharing

Copy URL Twitter E-mail

General

Target

5d061a73a506243776e396731665115c12d9903966265ada825e2c6931816848
Size

1.6MB
MD5

4393cc1b964b47e5020256cb6687a068
SHA1

69651ef5fccc9bc92fc5d2b74e69c963f1089c5a
SHA256

5d061a73a506243776e396731665115c12d9903966265ada825e2c6931816848
SHA512

47a04da979a2d7c7c6bbca3149f5f0104bcc21cfb6c2710911a91126e1619dc2e8bfa82ba111a1b0525458dba9af5c5a31a0ca2ed9d185d26a9c04347dc336e7
SSDEEP

12288:nk1JTCkzImwyTD7qBgewMWe4V1KTkCjeHuF7gwYY3iQb9gQPS2ThNaVqnJkhaU6:nkJwXBg/RCjeHuF/Z3P5bqVJa

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5d061a73a506243776e396731665115c12d9903966265ada825e2c6931816848

Files

5d061a73a506243776e396731665115c12d9903966265ada825e2c6931816848
.exe windows:6 windows x86 arch:x86

70c9a8b023c9d5a0505c7f5d04823afe

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\sourcetree\Cortex PC 10 Toolkits\razer.uninstallpowerplans\UninstallPowerPlans\Release\UninstallPowerPlans.pdb

Imports

msvcp140

?_Xout_of_range@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Xlength_error@std@@YAXPBD@Z

powrprof

PowerDeleteScheme
PowerReadFriendlyName
PowerEnumerate

vcruntime140

__std_exception_destroy
memmove
memset
_except_handler4_common
__std_exception_copy
_CxxThrowException
__CxxFrameHandler3
memcpy

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
terminate
__p___argc
_c_exit
exit
__p___argv
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_register_thread_local_exe_atexit_callback
_set_app_type
_seh_filter_exe
_initterm
_exit
_invalid_parameter_noinfo_noreturn
_controlfp_s
_initterm_e

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf
__acrt_iob_func
_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale
setlocale

api-ms-win-crt-convert-l1-1-0

mbstowcs_s

api-ms-win-crt-heap-l1-1-0

_callnewh
free
malloc
_set_new_mode

api-ms-win-crt-math-l1-1-0

__setusermatherr

kernel32

UnhandledExceptionFilter
GetModuleHandleW
IsDebuggerPresent
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 80B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 403KB - Virtual size: 402KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.2MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

70c9a8b023c9d5a0505c7f5d04823afe

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcp140

powrprof

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

kernel32

Sections

.text Size: 9KB - Virtual size: 9KB

.rdata Size: 4KB - Virtual size: 4KB

.data Size: 512B - Virtual size: 1KB

.gfids Size: 512B - Virtual size: 80B

.rsrc Size: 403KB - Virtual size: 402KB

.reloc Size: 1.2MB - Virtual size: 1.8MB

.text
Size: 9KB - Virtual size: 9KB

.rdata
Size: 4KB - Virtual size: 4KB

.data
Size: 512B - Virtual size: 1KB

.gfids
Size: 512B - Virtual size: 80B

.rsrc
Size: 403KB - Virtual size: 402KB

.reloc
Size: 1.2MB - Virtual size: 1.8MB