21a930909c1129e9efc3104374ca3fe03aba9aba2f10e0ecf2323191e1dc3c5f[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

21a930909c1129e9efc3104374ca3fe03aba9aba2f10e0ecf2323191e1dc3c5f.exe
Size

732KB
MD5

c936cb9ad8030aa2e00d406414241ac0
SHA1

1759557ed8f92c2ba23892fbd02ae70210b3e4bd
SHA256

21a930909c1129e9efc3104374ca3fe03aba9aba2f10e0ecf2323191e1dc3c5f
SHA512

2d5832adef94509e0360f4fde6457b2561781d4fe93540ef94c257b1c17ddbd3988b9ca481d12fe6577f176654daecb55e990822c34e6557c4ece8326a6dee18
SSDEEP

12288:5XQ3ZN2kRCyF2DdQqvvlhdbEcX4BLf3VblMpuR3XNR2/NjSu6Rk7CWY/WQckC:VQ3L2kRCDq6dhdbgBzVliuN2lkIjYZck

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
21a930909c1129e9efc3104374ca3fe03aba9aba2f10e0ecf2323191e1dc3c5f.exe

Files

21a930909c1129e9efc3104374ca3fe03aba9aba2f10e0ecf2323191e1dc3c5f.exe
.exe windows:6 windows x64 arch:x64

290ed5ed5e77a4ad2a79bf3733c18d20

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\mspdbsrv.pdb

Imports

advapi32

GetTokenInformation
OpenThreadToken
EqualSid
OpenProcessToken

kernel32

InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
LeaveCriticalSection
EnterCriticalSection
GetCurrentProcessId
GetLastError
CloseHandle
GetCurrentProcess
GetCommandLineW
GetCurrentThread
CreateEventW
CreateWaitableTimerW
SetPriorityClass
CreateMutexW
WaitForSingleObject
ReleaseMutex
WaitForMultipleObjectsEx
OpenEventW
SetEvent
CancelWaitableTimer
SetWaitableTimer
VirtualQuery
GetModuleFileNameW
RaiseFailFastException
SetErrorMode
OpenProcess
DuplicateHandle
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetModuleHandleW
TerminateProcess
QueryPerformanceCounter

vcruntime140

_CxxThrowException
__std_exception_destroy
__std_exception_copy
memset
__current_exception_context
__current_exception
memcpy
wcschr
memmove
__C_specific_handler

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

strncpy_s
wcsncpy_s
_wcsdup
_wcsicmp
iswspace

api-ms-win-crt-stdio-l1-1-0

fflush
_set_fmode
__acrt_iob_func
__stdio_common_vsnwprintf_s
fclose
__stdio_common_vfwprintf
_wfopen_s
__p__commode

api-ms-win-crt-time-l1-1-0

_wctime64
_time64

api-ms-win-crt-heap-l1-1-0

malloc
free
_set_new_mode
_callnewh

api-ms-win-crt-convert-l1-1-0

wcstoul

api-ms-win-crt-environment-l1-1-0

_wdupenv_s

api-ms-win-crt-runtime-l1-1-0

_crt_atexit
terminate
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___wargv
__p___argc
_initialize_onexit_table
_exit
_register_onexit_function
_seh_filter_exe
_set_app_type
exit
_configure_wide_argv
_initialize_wide_environment
_initterm
_get_initial_wide_environment
_initterm_e

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

mspdbcore

?CloseAllTimeoutPDB@PDB@@SAHXZ
?SetErrorHandlerAPI@PDB@@SAHP6APEAUIPDBError@@PEAU1@@Z@Z
?OpenEx2W@PDB@@SAHPEBGPEBDJPEAJPEAG_KPEAPEAU1@@Z
?RPC@PDB@@SAHXZ
?OpenValidate4@PDB@@SAHPEBGPEBDPEBU_GUID@@KKPEAJPEAG_KPEAPEAU1@@Z
?open@NameMap@@SAHPEAUPDB@@HPEAPEAU1@@Z
?FOpenW@MREngine@@SAHPEAPEAU1@PEBGAEAJPEAG_KHH@Z
?FOpen@MREngine@@SAHPEAPEAU1@PEAUMreToPdb@@HH@Z
?SetPDBCloseTimeout@PDB@@SAH_K@Z
?FOpen@MREngine@@SAHPEAPEAU1@PEAUPDB@@PEAUNameMap@@HH@Z
?ShutDownTimeoutManager@PDB@@SAHXZ
?OpenNgenPdb@PDB@@SAHPEBG0PEAJPEAG_KPEAPEAU1@@Z

rpcrt4

RpcMgmtStopServerListening
RpcServerListen
RpcServerRegisterIf2
RpcServerUseProtseqEpW
RpcServerUnregisterIf
RpcRevertToSelf
RpcImpersonateClient
NdrClientCall2
NdrServerCall2
RpcBindingInqAuthClientW
RpcMgmtInqStats
RpcMgmtStatsVectorFree

Sections

.text
Size: 81KB - Virtual size: 81KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 65KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 568KB - Virtual size: 572KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

290ed5ed5e77a4ad2a79bf3733c18d20

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

vcruntime140

vcruntime140_1

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

mspdbcore

rpcrt4

Sections

.text Size: 81KB - Virtual size: 81KB

.rdata Size: 65KB - Virtual size: 64KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 14KB - Virtual size: 13KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 568KB - Virtual size: 572KB

.text
Size: 81KB - Virtual size: 81KB

.rdata
Size: 65KB - Virtual size: 64KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 14KB - Virtual size: 13KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 568KB - Virtual size: 572KB