05a58ea5a87161763bcf3d2142b0107725582199db5960afd37bad87142cdea7

Sharing

Copy URL Twitter E-mail

General

Target

05a58ea5a87161763bcf3d2142b0107725582199db5960afd37bad87142cdea7
Size

31KB
MD5

56a351870751dbd7a070d0a05e8d6eaa
SHA1

42e92836d4322954607c3c7caf8ffb4cd635e336
SHA256

05a58ea5a87161763bcf3d2142b0107725582199db5960afd37bad87142cdea7
SHA512

d7fdf0042570170b9c43da916998a1a3af4efd5280432a9a1b4897b55f08aa6c473bba65f485231ef2c6a02d370f77293f128395db0bfee60cd1eb14f722713a
SSDEEP

384:QJdEVARhW0lLrvcRZT4xTCm+4RpbpGTRmncRq2AnmvFQ+sE50iaaQm1AQ6idOsT:QJhhW0lLrkDMv+4BcXAmvn502QEAQZd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
05a58ea5a87161763bcf3d2142b0107725582199db5960afd37bad87142cdea7

Files

05a58ea5a87161763bcf3d2142b0107725582199db5960afd37bad87142cdea7
.exe windows:6 windows x86 arch:x86

52f8efc312ab3cb6df1e5afc8efeadaf

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\ktv-client\build\Release\ktv_agent_monitor_new.pdb

Imports

logger

logger_start
logger_write_string
logger_write

kernel32

MapViewOfFile
UnmapViewOfFile
GetTickCount
CreateFileMappingA
CreateMutexA
InterlockedCompareExchange
Sleep
CreateEventA
CreateProcessA
CloseHandle
GetModuleFileNameA
GetCurrentProcess
OpenProcess
K32GetModuleFileNameExA
FindFirstFileA
FindClose
GetLocalTime
Process32FirstW
Process32NextW
FindNextFileA
CreateToolhelp32Snapshot
CopyFileA
GetLastError
TerminateProcess
WaitForSingleObject
SetLastError
GetSystemTimeAsFileTime
GetTickCount64
IsProcessorFeaturePresent
EncodePointer
WaitForMultipleObjects
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentThreadId
DecodePointer

advapi32

AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken

iphlpapi

GetAdaptersInfo

msvcr110

_vsnprintf_s
fopen_s
fread
_purecall
??3@YAXPAX@Z
memset
fclose
??2@YAPAXI@Z
strncpy_s
sscanf_s
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBD@Z
??0exception@std@@QAE@ABV01@@Z
_access
_lock
_unlock
_calloc_crt
__dllonexit
_onexit
??1type_info@@UAE@XZ
__CxxFrameHandler3
_XcptFilter
memmove
_amsg_exit
__getmainargs
__set_app_type
exit
_exit
_cexit
_ismbblead
_configthreadlocale
__setusermatherr
_initterm_e
_initterm
_acmdln
_fmode
_commode
_crt_debugger_hook
__crtUnhandledException
__crtTerminateProcess
_except_handler4_common
?terminate@@YAXXZ
__crtSetUnhandledExceptionFilter
_invoke_watson
_controlfp_s
feof
_stricmp
abort
strstr
malloc
__crtGetShowWindowMode
free
strncmp
_strnicmp
_CxxThrowException
memcpy
ferror

msvcp110

?_Xlength_error@std@@YAXPBD@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Syserror_map@std@@YAPBDH@Z
?_Winerror_map@std@@YAPBDH@Z

shlwapi

PathFileExistsA
PathCanonicalizeA

Sections

.text
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

52f8efc312ab3cb6df1e5afc8efeadaf

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

logger

kernel32

advapi32

iphlpapi

msvcr110

msvcp110

shlwapi

Sections

.text Size: 18KB - Virtual size: 17KB

.rdata Size: 7KB - Virtual size: 7KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 18KB - Virtual size: 17KB

.rdata
Size: 7KB - Virtual size: 7KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 2KB