45f4378110e343613c19f8b5e0cddf10[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

45f4378110e343613c19f8b5e0cddf10.exe
Size

81KB
MD5

45f4378110e343613c19f8b5e0cddf10
SHA1

74a4c95d9c3619302dfc5b21bc0d40f749c37f54
SHA256

8b85b7f23c54f388a12f78b7190f2bcc6aac242cc1610e319818549d49c39853
SHA512

1ee5e7c5b9d6614207422d63c19915a0474006bbbb3d8ac8046cf4c95a666487fbfbc52f7ce8e200d5bc02d8cf7e9fc8d303a2bb296cde0056a49ccdacf3eeac
SSDEEP

1536:MxRShQnixg3RolXmf71kjy3JIO64l7Xuuy+fbb0MhQA:MHShQnixg3RolXmzCy3JIO64l7euVfbt

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
45f4378110e343613c19f8b5e0cddf10.exe

Files

45f4378110e343613c19f8b5e0cddf10.exe
.dll windows:6 windows x64 arch:x64

012bca0efbe90a581f55de6318cb6327

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\jenkins\worksp~1\j171-w~1\coinst\ftcserco\objfre_wnet_amd64\amd64\ftcserco.pdb

Imports

setupapi

SetupDiOpenDeviceInfoW
SetupDiGetActualSectionToInstallW
SetupDiGetSelectedDriverW
CM_Get_Parent
CM_Get_Sibling
CM_Get_Child
SetupInstallServicesFromInfSectionW
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyW
SetupCloseInfFile
SetupDiCreateDeviceInfoList
SetupDiGetDriverInfoDetailW
SetupInstallFromInfSectionW
SetupOpenInfFileW
SetupDiCreateDevRegKeyW
CM_Get_Device_IDW

kernel32

LoadLibraryExW
VirtualProtect
RtlUnwindEx
VirtualQuery
GetSystemInfo
SetThreadStackGuarantee
OutputDebugStringW
lstrlenW
GetLastError
LocalAlloc
LocalFree
WideCharToMultiByte
MultiByteToWideChar
FlsSetValue
GetCommandLineA
GetVersionExW
HeapFree
HeapAlloc
GetProcAddress
GetModuleHandleW
ExitProcess
EncodePointer
DecodePointer
FlsFree
SetLastError
FlsGetValue
GetCurrentThreadId
FlsAlloc
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoW
DeleteCriticalSection
GetModuleFileNameA
FreeEnvironmentStringsW
GetEnvironmentStringsW
HeapSetInformation
HeapCreate
HeapDestroy
QueryPerformanceCounter
GetTickCount
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCPInfo
GetACP
GetOEMCP
OutputDebugStringA
WriteFile
LCMapStringW
LeaveCriticalSection
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
Sleep
GetStringTypeW
VirtualAlloc

advapi32

RegOpenKeyW
RegCloseKey
RegSetValueExW
RegQueryValueExW

user32

wsprintfW

msports

ComDBClaimPort
ComDBGetCurrentPortUsage
ComDBOpen
ComDBClose

Exports

Exports

FTCSERCoInstaller

Sections

.text
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 724B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

012bca0efbe90a581f55de6318cb6327

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

setupapi

kernel32

advapi32

user32

msports

Exports

Exports

Sections

.text Size: 49KB - Virtual size: 48KB

.data Size: 5KB - Virtual size: 9KB

.pdata Size: 1KB - Virtual size: 1KB

.rsrc Size: 1024B - Virtual size: 856B

.reloc Size: 1024B - Virtual size: 724B

.text
Size: 49KB - Virtual size: 48KB

.data
Size: 5KB - Virtual size: 9KB

.pdata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 1024B - Virtual size: 856B

.reloc
Size: 1024B - Virtual size: 724B