1996b5179a0f94027aa578aeae565780N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

1996b5179a0f94027aa578aeae565780N.exe
Size

4.2MB
MD5

1996b5179a0f94027aa578aeae565780
SHA1

654dfc9bf17b42d5da18c2edac23a8daf022b2af
SHA256

a4d168c824fdf8cb35e9c6cd7a7cc99579403f566ba9318a9297a71b12fcaa18
SHA512

b710ddcb0bda5ae8fb90ae54d8529702053f24dcac33056cf8f9fee7b03df4183a5530e3b25a0908f795cc4fd654c63553ed66c934933b13d6b7dfd534bfec72
SSDEEP

98304:pGVfiVHfYzUGCz2WLPhbiTIXuVJ4gSi5jrmk3iFUbv3:oMVHfUVCz2APAUX0egSi5jrBbv3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1996b5179a0f94027aa578aeae565780N.exe

Files

1996b5179a0f94027aa578aeae565780N.exe
.dll windows:6 windows x86 arch:x86

0940afd84da2272633437970ae4ceb6a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

C:\dev_work\bt_datachannel\_dist\Release\bt_datachannel.pdb

Imports

kernel32

WideCharToMultiByte
GetStdHandle
WriteConsoleW
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
CloseHandle
GetLastError
ReleaseMutex
WaitForSingleObject
CreateMutexA
CreateThread
GetExitCodeThread
GetTickCount
ReleaseSRWLockShared
TryAcquireSRWLockShared
InitializeConditionVariable
WakeAllConditionVariable
SleepConditionVariableCS
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
AcquireSRWLockShared
Sleep
TryEnterCriticalSection
InitializeSRWLock
GetSystemTimeAsFileTime
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetEnvironmentVariableW
GetFileType
WriteFile
GetModuleHandleW
GetProcAddress
SwitchToFiber
DeleteFiber
CreateFiber
QueryPerformanceCounter
GetCurrentProcessId
MultiByteToWideChar
ConvertThreadToFiber
FindClose
FindFirstFileW
FindNextFileW
GetSystemTime
SystemTimeToFileTime
HeapSize
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
SetStdHandle
GetFullPathNameW
GetCurrentDirectoryW
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
ReadFile
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
HeapReAlloc
OutputDebugStringW
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
HeapFree
HeapAlloc
FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime
DeleteCriticalSection
GetCurrentThreadId
InitializeCriticalSection
LeaveCriticalSection
ConvertFiberToThread
EnterCriticalSection
PeekNamedPipe
GetFileInformationByHandle
QueryPerformanceFrequency
TryAcquireSRWLockExclusive
WakeConditionVariable
SleepConditionVariableSRW
GetStringTypeW
WaitForSingleObjectEx
SwitchToThread
RaiseException
InitializeCriticalSectionEx
EncodePointer
DecodePointer
GetLocaleInfoEx
LCMapStringEx
CompareStringEx
GetCPInfo
SetEvent
ResetEvent
CreateEventW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlUnwind
InterlockedFlushSList
FreeLibrary
LoadLibraryExW
GetTimeZoneInformation
GetModuleFileNameW
GetModuleHandleExW
ExitThread
FreeLibraryAndExitThread
ExitProcess
CreateFileW
GetDriveTypeW
SetEndOfFile

user32

GetProcessWindowStation
MessageBoxW
GetUserObjectInformationW

ws2_32

WSAIoctl
sendto
recvfrom
listen
getsockname
bind
accept
WSAPoll
socket
setsockopt
send
getsockopt
getpeername
ioctlsocket
connect
closesocket
ntohs
ntohl
htons
htonl
WSAGetLastError
WSACleanup
WSAStartup
getnameinfo
freeaddrinfo
getaddrinfo
WSASetLastError
recv

advapi32

RegisterEventSourceW
ReportEventW
DeregisterEventSource

iphlpapi

GetAdaptersAddresses

bcrypt

BCryptGenRandom

Exports

Exports

BTDC_AddRef
BTDC_AddRemoteCandidate
BTDC_Close
BTDC_CreateDataChannel
BTDC_CreatePeerConnection
BTDC_CreateWebSocket
BTDC_GetCargo
BTDC_GetDataChannelLabel
BTDC_GetDataChannelProtocol
BTDC_GetLocalAddress
BTDC_GetLocalDescription
BTDC_GetLocalDescriptionType
BTDC_GetReceivableSize
BTDC_GetRemoteAddress
BTDC_GetRemoteDescription
BTDC_GetRemoteDescriptionType
BTDC_GetSelectedCandidatePair
BTDC_GetSendableSize
BTDC_GetType
BTDC_Initialize
BTDC_IsClosed
BTDC_IsOpen
BTDC_Receive
BTDC_Release
BTDC_SendData
BTDC_SendText
BTDC_SetCargo
BTDC_SetLocalDescription
BTDC_SetOnCandidate
BTDC_SetOnClosed
BTDC_SetOnConnection
BTDC_SetOnDataChannel
BTDC_SetOnDataMessage
BTDC_SetOnDescription
BTDC_SetOnError
BTDC_SetOnGathering
BTDC_SetOnOpen
BTDC_SetOnReceivable
BTDC_SetOnSendable
BTDC_SetOnSignaling
BTDC_SetOnTextMessage
BTDC_SetRemoteDescription
BTDC_SetSendableThreshold
BTDC_Terminate

Sections

.text
Size: 3.3MB - Virtual size: 3.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 539KB - Virtual size: 539KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 142KB - Virtual size: 152KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 101KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0940afd84da2272633437970ae4ceb6a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

ws2_32

advapi32

iphlpapi

bcrypt

Exports

Exports

Sections

.text Size: 3.3MB - Virtual size: 3.3MB

.rdata Size: 539KB - Virtual size: 539KB

.data Size: 142KB - Virtual size: 152KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 101KB - Virtual size: 100KB

.text
Size: 3.3MB - Virtual size: 3.3MB

.rdata
Size: 539KB - Virtual size: 539KB

.data
Size: 142KB - Virtual size: 152KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 101KB - Virtual size: 100KB