1c0a4193bf77b9a8dbd00f6078392899b6defa434f20c008e4ea9e20b301c334[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

1c0a4193bf77b9a8dbd00f6078392899b6defa434f20c008e4ea9e20b301c334.exe
Size

1.1MB
MD5

8569ef968c0c4045782e1ef4ecc96fec
SHA1

6f59472c780116468aa2953f8286c89c3188457e
SHA256

1c0a4193bf77b9a8dbd00f6078392899b6defa434f20c008e4ea9e20b301c334
SHA512

4c9be25acce42fd404ad213cacc823d927e7c3249613771c1644a9054ff49e3edc0f4695240d067af49baf049546a2014fbe7966a37950c6d68d9f5c740e8af9
SSDEEP

24576:pOlBrvlF3FneFqBtzaYP5M338gN2/viKO0jytcWRczjVTe+fUpy:pKnBtz7P5M8gcK10jyt9RoJFUpy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1c0a4193bf77b9a8dbd00f6078392899b6defa434f20c008e4ea9e20b301c334.exe

Files

1c0a4193bf77b9a8dbd00f6078392899b6defa434f20c008e4ea9e20b301c334.exe
.exe windows:6 windows x86 arch:x86

894b77336b8d78f9851559454b95443d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

Imports

ntdll

NtWriteFile
RtlUnwind
NtQueryInformationProcess
RtlNtStatusToDosError
RtlCaptureContext
RtlGetVersion
NtQuerySystemInformation

kernel32

GetProcessIoCounters
IsProcessorFeaturePresent
WriteProcessMemory
VirtualProtectEx
HeapAlloc
ReadProcessMemory
SetUnhandledExceptionFilter
TlsGetValue
TlsSetValue
LocalFree
GetSystemTimes
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
GetCurrentProcess
GetProcAddress
LoadLibraryA
OpenProcess
GetComputerNameExW
GetLastError
WaitForSingleObject
GetCurrentThreadId
GetProcessTimes
LoadLibraryExA
FreeLibrary
K32GetPerformanceInfo
GlobalMemoryStatusEx
VirtualQueryEx
FormatMessageW
SleepConditionVariableSRW
TryAcquireSRWLockExclusive
HeapFree
GetProcessHeap
LoadLibraryExW
RaiseException
GetSystemInfo
ReleaseMutex
FindClose
ReleaseSRWLockShared
AddVectoredExceptionHandler
SetThreadStackGuarantee
SwitchToThread
Sleep
QueryPerformanceCounter
GetCurrentThread
SetLastError
GetCurrentDirectoryW
GetEnvironmentVariableW
VirtualProtect
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
VirtualAlloc
EncodePointer
CreateFileW
DeleteCriticalSection
GetStdHandle
GetCurrentProcessId
TerminateProcess
WakeAllConditionVariable
WakeConditionVariable
HeapReAlloc
AcquireSRWLockShared
WaitForSingleObjectEx
CreateMutexA
GetModuleHandleA
GetFileInformationByHandle
GetFileInformationByHandleEx
FindFirstFileW
GetConsoleMode
InitializeCriticalSectionAndSpinCount
GetModuleHandleW
ExitProcess
GetFullPathNameW
MultiByteToWideChar
WriteConsoleW
CreateThread
InitOnceBeginInitialize
TlsAlloc
InitOnceComplete
TlsFree
GetSystemTimeAsFileTime
CloseHandle

advapi32

GetLengthSid
RegQueryValueExW
GetTokenInformation
RegCloseKey
RegOpenKeyExW
SystemFunction036
CopySid
IsValidSid
OpenProcessToken

pdh

PdhCollectQueryData
PdhAddEnglishCounterW
PdhGetFormattedCounterValue
PdhRemoveCounter
PdhCloseQuery
PdhOpenQueryA

powrprof

CallNtPowerInformation

oleaut32

SysFreeString
GetErrorInfo
SysStringLen

psapi

GetProcessMemoryInfo
GetModuleFileNameExW

shell32

CommandLineToArgvW

bcrypt

BCryptGenRandom

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode
calloc
malloc

api-ms-win-crt-string-l1-1-0

strcpy_s
wcslen
wcsncmp

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback
_cexit
exit
_initterm_e
_initialize_onexit_table
__p___argv
_crt_atexit
_controlfp_s
abort
_initterm
__p___argc
_get_initial_narrow_environment
_c_exit
_exit
_register_onexit_function
_initialize_narrow_environment
_configure_narrow_argv
terminate
_set_app_type
_seh_filter_exe

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 208KB - Virtual size: 207KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 930KB - Virtual size: 930KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

894b77336b8d78f9851559454b95443d

Headers

DLL Characteristics

File Characteristics

Imports

ntdll

kernel32

advapi32

pdh

powrprof

oleaut32

psapi

shell32

bcrypt

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 208KB - Virtual size: 207KB

.rdata Size: 930KB - Virtual size: 930KB

.data Size: 512B - Virtual size: 1KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 208KB - Virtual size: 207KB

.rdata
Size: 930KB - Virtual size: 930KB

.data
Size: 512B - Virtual size: 1KB

.reloc
Size: 8KB - Virtual size: 7KB