c1663135d2a59e94a8af529e3596789b17d914cd3334e16644fca751a844c062

Sharing

Copy URL Twitter E-mail

General

Target

c1663135d2a59e94a8af529e3596789b17d914cd3334e16644fca751a844c062
Size

640KB
MD5

e58d9b96ab8ab50c049fc62a7f105c44
SHA1

86f5a6b74cbe19cb5ca818b1aceb4aefcb09b250
SHA256

c1663135d2a59e94a8af529e3596789b17d914cd3334e16644fca751a844c062
SHA512

659f0f8481c4f27f3ac91b5f491014fad7189c941aedcfc06df10e56ac4ff96340df5134f12fa787a52615b3e987bb3c9cc4817290cc118f158264d70b424782
SSDEEP

12288:QDGt/sB1KcYmqgZvAMlUoUjG+YKtMfnkOeZb5JYiNAgAPh:3t/sBlDqgZQd6XKtiMJYiPU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c1663135d2a59e94a8af529e3596789b17d914cd3334e16644fca751a844c062

Files

c1663135d2a59e94a8af529e3596789b17d914cd3334e16644fca751a844c062
.exe windows:10 windows x64 arch:x64

288c77221ee9a27f869b542320d273ef

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

CertMgr.pdb

Imports

msvcrt

_exit
_cexit
__setusermatherr
_initterm
_XcptFilter
__C_specific_handler
_fmode
_commode
?terminate@@YAXXZ
__set_app_type
wprintf
strtok
_vsnwprintf
realloc
printf
_wasctime
free
scanf
_wtol
towupper
memset
__wgetmainargs
exit
_amsg_exit
_wcsicmp
vwprintf
malloc
memcmp
memcpy
strcmp

user32

LoadStringW
LoadStringA

crypt32

CertGetCRLFromStore
CertDuplicateCTLContext
CryptFreeOIDFunctionAddress
CertGetCertificateContextProperty
CertGetCRLContextProperty
CryptStringToBinaryW
CertAddEncodedCTLToStore
CertOpenStore
CryptInstallOIDFunctionAddress
CertGetCTLContextProperty
CertFindCertificateInStore
CertSetCertificateContextProperty
CertEnumCTLsInStore
CertRDNValueToStrW
CryptEncodeObject
CryptMsgGetParam
CertCloseStore
CryptSIPLoad
CertEnumCertificateContextProperties
CertDeleteCRLFromStore
CertDeleteCertificateFromStore
CertDuplicateCRLContext
CryptHashPublicKeyInfo
CryptDecodeObject
CertFreeCTLContext
CertAddEncodedCertificateToStore
CertGetPublicKeyLength
CryptSIPRetrieveSubjectGuid
CryptMsgClose
CryptMsgUpdate
CryptGetOIDFunctionAddress
CryptInitOIDFunctionSet
CertRDNValueToStrA
CertFreeCRLContext
CertDeleteCTLFromStore
CertFreeCertificateContext
CryptStringToBinaryA
CryptFindOIDInfo
CertAddCRLContextToStore
CertAddCertificateContextToStore
CryptMsgGetAndVerifySigner
CryptMsgOpenToDecode
CertSaveStore
CertFindCTLInStore
CertEnumCertificatesInStore
CertAddEncodedCRLToStore
CertAddCTLContextToStore
CertDuplicateCertificateContext

cryptui

CryptUIDlgCertMgr

advapi32

CryptAcquireContextA
CryptReleaseContext

kernel32

CreateFileMappingA
CreateFileW
WriteFile
GetSystemTime
SystemTimeToFileTime
MultiByteToWideChar
CompareFileTime
GetFileSize
HeapSetInformation
CloseHandle
FileTimeToSystemTime
GetLastError
GetModuleHandleA
UnmapViewOfFile
SetLastError
WideCharToMultiByte
FileTimeToLocalFileTime
RtlLookupFunctionEntry
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
Sleep
SetUnhandledExceptionFilter
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
RtlCaptureContext
MapViewOfFile
RtlVirtualUnwind

Sections

.text
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 568KB - Virtual size: 572KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

288c77221ee9a27f869b542320d273ef

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

user32

crypt32

cryptui

advapi32

kernel32

Sections

.text Size: 38KB - Virtual size: 37KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 512B - Virtual size: 10KB

.pdata Size: 1KB - Virtual size: 1KB

.rsrc Size: 23KB - Virtual size: 22KB

.reloc Size: 568KB - Virtual size: 572KB

.text
Size: 38KB - Virtual size: 37KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 512B - Virtual size: 10KB

.pdata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 23KB - Virtual size: 22KB

.reloc
Size: 568KB - Virtual size: 572KB