3b7e6d53722afdad0494ec3994e214bf71fd72027bae4bd6406becdcd631abe8

Sharing

Copy URL Twitter E-mail

General

Target

3b7e6d53722afdad0494ec3994e214bf71fd72027bae4bd6406becdcd631abe8
Size

2.1MB
MD5

902b621d2b78b54f9efe0d9e589cc4cc
SHA1

1ce7616e6c1249b42164a9eafd10339dcc63e542
SHA256

3b7e6d53722afdad0494ec3994e214bf71fd72027bae4bd6406becdcd631abe8
SHA512

7ad2c6ce708c9c22469c4584a6e84a5e9dd64fad9220bde1027a1910ada8c406853fd6ef7d3a0c6629c9e4603794c773c4e58722300581a4f841477a39160a9e
SSDEEP

49152:FlLXg3i4lQMaYkNU4CUPd/ax2K4Q+Zns5dcbniCbo:zRUq/s2P38cbnnb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3b7e6d53722afdad0494ec3994e214bf71fd72027bae4bd6406becdcd631abe8

Files

3b7e6d53722afdad0494ec3994e214bf71fd72027bae4bd6406becdcd631abe8
.exe windows:10 windows x64 arch:x64

3deb05830df3bb942c3f3d979a0c30b2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

AppVCleaner.pdb

Imports

advapi32

EventUnregister
EventRegister
EventActivityIdControl
RevertToSelf
CryptReleaseContext
CryptGetHashParam
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptAcquireContextW
RegQueryValueExW
RegEnumValueW
RegDeleteValueW
RegSetValueExW
RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteKeyExW
OpenThreadToken
CreateProcessAsUserW
RegOpenKeyExW
SetThreadToken
EventWriteTransfer
RegCloseKey
DuplicateToken
OpenProcessToken
GetTokenInformation
ConvertSidToStringSidW
RegCreateKeyExW
RegOpenCurrentUser
ImpersonateLoggedOnUser

kernel32

CloseThreadpoolWork
CreateFileW
RemoveDirectoryW
DeviceIoControl
CreateThreadpoolCleanupGroup
SetThreadpoolThreadMaximum
CloseThreadpoolCleanupGroupMembers
CloseThreadpoolCleanupGroup
SetThreadpoolThreadMinimum
CreateThreadpool
CloseThreadpool
DuplicateHandle
GetExitCodeProcess
CreateProcessW
GetCurrentThread
WaitForSingleObject
FreeLibrary
GetModuleHandleExW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetProcAddress
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
CloseHandle
CompareStringEx
LCMapStringEx
DecodePointer
EncodePointer
InitializeCriticalSectionEx
GetStringTypeW
LocalFree
WideCharToMultiByte
GetLastError
MultiByteToWideChar
GetEnvironmentVariableW
LeaveCriticalSection
SubmitThreadpoolWork
RaiseException
DeleteCriticalSection
InitializeCriticalSection
FormatMessageW
GetModuleFileNameW
GetNativeSystemInfo
FindFirstFileW
FindNextFileW
GetFinalPathNameByHandleW
FindClose
GetFileAttributesW
DeleteFileW
MoveFileExW
SetLastError
ExpandEnvironmentStringsW
GetSystemDirectoryW
LoadLibraryA
LoadLibraryW
Wow64DisableWow64FsRedirection
Wow64RevertWow64FsRedirection
SearchPathW
GetLongPathNameW
GetShortPathNameW
GetTempPathW
GetCurrentDirectoryW
GetComputerNameExW
MoveFileW
GetModuleFileNameA
OutputDebugStringW
GetDriveTypeW
CopyFileW
Sleep
HeapFree
CreateThreadpoolWork
HeapAlloc
GetVersionExW
EnterCriticalSection
GetTempFileNameW
SetFileAttributesW
HeapDestroy
HeapReAlloc
HeapSize
DebugBreak
LoadResource
FindResourceExW
HeapSetInformation
LockResource
SizeofResource
GetProcessHeap
GetModuleHandleW
CopyFileExW

user32

LoadStringW
UnregisterClassA

api-ms-win-crt-string-l1-1-0

wcsnlen
strcspn
memset
wcsncmp

api-ms-win-crt-locale-l1-1-0

_lock_locales
_unlock_locales

api-ms-win-crt-runtime-l1-1-0

_c_exit
_register_thread_local_exe_atexit_callback
_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__lock_file
_o__malloc_base
_o__purecall
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
_o__stricmp
_o__ultow_s
_o__unlock_file
_o__wcsdup
_o__wcsicmp
_o__wcslwr_s
_o__wcsnicmp
_o__wcsupr_s
_o__wmakepath_s
_o__wsplitpath_s
_o__wtoi
_o_abort
_o_calloc
_o_ceilf
_o_exit
_o_fclose
_o_fflush
_o_fgetc
_o_fgetpos
_o_fgetwc
_o_fputwc
_o_free
_o_frexp
_o_fsetpos
_o_fwrite
_o_isspace
_o_iswalpha
_o_iswctype
_o_iswdigit
_o_iswspace
_o_ldexp
_o_localeconv
_o_malloc
_o_pow
_o_powf
_o_rand
_o_realloc
_o_setlocale
_o_setvbuf
_o_srand
_o_strtod
_o_strtof
_o_terminate
_o_tolower
_o_towupper
_o_ungetc
_o_ungetwc
_o_wcscpy_s
__C_specific_handler
__uncaught_exception
__current_exception
__current_exception_context
_CxxThrowException
_o__invalid_parameter_noinfo_noreturn
_o__invalid_parameter_noinfo
_o__initialize_wide_environment
_o__initialize_onexit_table
_o__get_initial_wide_environment
_o__fseeki64
_o__free_base
_o__exit
_o__errno
_o__crt_atexit
_o__configure_wide_argv
_o__configthreadlocale
_o__cexit
_o__calloc_base
_o__callnewh
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsnprintf_s
_o___std_exception_destroy
_o___std_exception_copy
_o___pctype_func
_o___p__commode
_o___p___wargv
_o___p___argc
_o___acrt_iob_func
_o____mb_cur_max_func
_o____lc_locale_name_func
_o____lc_collate_cp_func
_o____lc_codepage_func
strrchr
__CxxFrameHandler3
__RTDynamicCast
memchr
memcmp
memcpy
strchr
wcschr
__std_type_info_compare
memmove

appvmanifest

ord3

appvpolicy

ord3

msi

ord96
ord118
ord8
ord217
ord159
ord160
ord173
ord49
ord32

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
NtQueryKey
RtlVirtualUnwind

ole32

CoInitializeEx
CLSIDFromString
CoTaskMemFree
StringFromGUID2
CoCreateInstance
CoCreateGuid
CoTaskMemAlloc
CoUninitialize

oleaut32

VariantCopy
VariantChangeType
SysFreeString
VariantClear
SysAllocString
VariantInit

rpcrt4

RpcBindingFree
RpcMgmtIsServerListening
RpcBindingSetAuthInfoExW
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcMgmtSetCancelTimeout
RpcCancelThread
RpcStringFreeW
UuidCreate
NdrClientCall2

shell32

SHGetKnownFolderPath
ord165

shlwapi

PathFileExistsW
PathIsUNCW
PathCanonicalizeW
PathFindExtensionW
SHCreateStreamOnFileEx

userenv

CreateEnvironmentBlock
UnloadUserProfile
ExpandEnvironmentStringsForUserW
DestroyEnvironmentBlock

api-ms-win-crt-time-l1-1-0

_time64

Sections

.text
Size: 944KB - Virtual size: 940KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 516KB - Virtual size: 515KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 52KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 40KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 12KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 580KB - Virtual size: 584KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

3deb05830df3bb942c3f3d979a0c30b2

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

user32

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

appvmanifest

appvpolicy

msi

ntdll

ole32

oleaut32

rpcrt4

shell32

shlwapi

userenv

api-ms-win-crt-time-l1-1-0

Sections

.text Size: 944KB - Virtual size: 940KB

.rdata Size: 516KB - Virtual size: 515KB

.data Size: 52KB - Virtual size: 56KB

.pdata Size: 40KB - Virtual size: 38KB

.rsrc Size: 12KB - Virtual size: 8KB

.reloc Size: 580KB - Virtual size: 584KB

.text
Size: 944KB - Virtual size: 940KB

.rdata
Size: 516KB - Virtual size: 515KB

.data
Size: 52KB - Virtual size: 56KB

.pdata
Size: 40KB - Virtual size: 38KB

.rsrc
Size: 12KB - Virtual size: 8KB

.reloc
Size: 580KB - Virtual size: 584KB