7d13de7e77424d3bbbc6840cbb2392d40c2ee764132652d62390da0564942e8f

Sharing

Copy URL Twitter E-mail

General

Target

7d13de7e77424d3bbbc6840cbb2392d40c2ee764132652d62390da0564942e8f
Size

1.5MB
MD5

7e56eb0a6f0935d9e226fb8586d00bb8
SHA1

7e92fbc76d4094c7d6b6f9b42a3ca1c65bdab098
SHA256

7d13de7e77424d3bbbc6840cbb2392d40c2ee764132652d62390da0564942e8f
SHA512

f7386c9c82445f2de1949645d21e4d3c39f8540793fb3f92c5a5e1a961d2e6030739980bc444ba83e58399f7bd9012842484de9beef0a04653b391d80192a4d7
SSDEEP

12288:u8TNjYGgpK/vnRsmH5Ckt73qfKrrzD89f24pWYbCXGah2JoHq1MGJlyw9hditWsS:RTNjx+mZCkt76f/24pN+XNqNG6hditW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7d13de7e77424d3bbbc6840cbb2392d40c2ee764132652d62390da0564942e8f

Files

7d13de7e77424d3bbbc6840cbb2392d40c2ee764132652d62390da0564942e8f
.exe windows:10 windows x64 arch:x64

288c77221ee9a27f869b542320d273ef

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

CertMgr.pdb

Imports

msvcrt

_exit
_cexit
__setusermatherr
_initterm
_XcptFilter
__C_specific_handler
_fmode
_commode
?terminate@@YAXXZ
__set_app_type
wprintf
strtok
_vsnwprintf
realloc
printf
_wasctime
free
scanf
_wtol
towupper
memset
__wgetmainargs
exit
_amsg_exit
_wcsicmp
vwprintf
malloc
memcmp
memcpy
strcmp

user32

LoadStringW
LoadStringA

crypt32

CertGetCRLFromStore
CertDuplicateCTLContext
CryptFreeOIDFunctionAddress
CertGetCertificateContextProperty
CertGetCRLContextProperty
CryptStringToBinaryW
CertAddEncodedCTLToStore
CertOpenStore
CryptInstallOIDFunctionAddress
CertGetCTLContextProperty
CertFindCertificateInStore
CertSetCertificateContextProperty
CertEnumCTLsInStore
CertRDNValueToStrW
CryptEncodeObject
CryptMsgGetParam
CertCloseStore
CryptSIPLoad
CertEnumCertificateContextProperties
CertDeleteCRLFromStore
CertDeleteCertificateFromStore
CertDuplicateCRLContext
CryptHashPublicKeyInfo
CryptDecodeObject
CertFreeCTLContext
CertAddEncodedCertificateToStore
CertGetPublicKeyLength
CryptSIPRetrieveSubjectGuid
CryptMsgClose
CryptMsgUpdate
CryptGetOIDFunctionAddress
CryptInitOIDFunctionSet
CertRDNValueToStrA
CertFreeCRLContext
CertDeleteCTLFromStore
CertFreeCertificateContext
CryptStringToBinaryA
CryptFindOIDInfo
CertAddCRLContextToStore
CertAddCertificateContextToStore
CryptMsgGetAndVerifySigner
CryptMsgOpenToDecode
CertSaveStore
CertFindCTLInStore
CertEnumCertificatesInStore
CertAddEncodedCRLToStore
CertAddCTLContextToStore
CertDuplicateCertificateContext

cryptui

CryptUIDlgCertMgr

advapi32

CryptAcquireContextA
CryptReleaseContext

kernel32

CreateFileMappingA
CreateFileW
WriteFile
GetSystemTime
SystemTimeToFileTime
MultiByteToWideChar
CompareFileTime
GetFileSize
HeapSetInformation
CloseHandle
FileTimeToSystemTime
GetLastError
GetModuleHandleA
UnmapViewOfFile
SetLastError
WideCharToMultiByte
FileTimeToLocalFileTime
RtlLookupFunctionEntry
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
Sleep
SetUnhandledExceptionFilter
GetModuleHandleW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
RtlCaptureContext
MapViewOfFile
RtlVirtualUnwind

Sections

.text
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

288c77221ee9a27f869b542320d273ef

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

user32

crypt32

cryptui

advapi32

kernel32

Sections

.text Size: 38KB - Virtual size: 37KB

.rdata Size: 8KB - Virtual size: 7KB

.data Size: 512B - Virtual size: 10KB

.pdata Size: 1KB - Virtual size: 1KB

.rsrc Size: 23KB - Virtual size: 22KB

.reloc Size: 1.4MB - Virtual size: 1.4MB

.text
Size: 38KB - Virtual size: 37KB

.rdata
Size: 8KB - Virtual size: 7KB

.data
Size: 512B - Virtual size: 10KB

.pdata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 23KB - Virtual size: 22KB

.reloc
Size: 1.4MB - Virtual size: 1.4MB