2622edff9934c7b8e0a46a1442213de0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

2622edff9934c7b8e0a46a1442213de0N.exe
Size

11KB
MD5

2622edff9934c7b8e0a46a1442213de0
SHA1

f4ae050765e5e9cd0d8012133dd17febf0dc9a37
SHA256

38cb4bf61445a810b3ef000cd472b8588d4cb3b5d3fab50e37df506aeee06f26
SHA512

d21b5202f2b5bf1a3c4405fef152eada7eaeb9361d4a8eb7a455b1098c6d8174e72792a1ad3d16c1768a8f406d720df647056cbf09b61824ac15bdbb840e1368
SSDEEP

96:l7HZHzHlJaOfIn+4GoCbgc0C3mNw822TQCXxWitFdOWDR2HDaJEpaYZtEWP4ozWY:DHLlI2IMxgDksXdL92qEpNZGWP4ozW

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2622edff9934c7b8e0a46a1442213de0N.exe

Files

2622edff9934c7b8e0a46a1442213de0N.exe
.dll windows:10 windows x86 arch:x86

6d523017fb54f57fbe5bba8cfe5ebcf7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

WSClient.pdb

Imports

msvcrt

_except_handler4_common
_XcptFilter
_initterm
malloc
free
_amsg_exit

api-ms-win-appmodel-unlock-l1-1-0

IsDeveloperModeEnabled

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
GetCurrentProcess

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Exports

Exports

AcquireDeveloperLicense
CheckDeveloperLicense
GetApplicationURL
RefreshBannedAppsList
RemoveDeveloperLicense
WSCallServer
WSCheckForConsumable
WSEvaluatePackage
WSGetEvaluatePackageAttempted
WSLicenseCleanUpState
WSLicenseClose
WSLicenseFilterValidAppCategoryIds
WSLicenseGetAllUserTokens
WSLicenseGetAllValidAppCategoryIds
WSLicenseGetDevInstalledApps
WSLicenseGetExtendedUserInfo
WSLicenseGetFeatureLicenseResults
WSLicenseGetLicensesForProducts
WSLicenseGetOAuthServiceTicket
WSLicenseGetProductLicenseResults
WSLicenseInstallLicense
WSLicenseOpen
WSLicenseRefreshLicense
WSLicenseRetrieveMachineID
WSLicenseRevokeLicenses
WSLicenseUninstallLicense
WSNotifyOOBECompletion
WSNotifyPackageInstalled
WSTriggerOOBEFileValidation
WSpTLRW

Sections

.text
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 364B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6d523017fb54f57fbe5bba8cfe5ebcf7

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-appmodel-unlock-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Exports

Exports

Sections

.text Size: 6KB - Virtual size: 5KB

.data Size: 512B - Virtual size: 960B

.idata Size: 1KB - Virtual size: 1KB

.didat Size: 512B - Virtual size: 8B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 364B

.text
Size: 6KB - Virtual size: 5KB

.data
Size: 512B - Virtual size: 960B

.idata
Size: 1KB - Virtual size: 1KB

.didat
Size: 512B - Virtual size: 8B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 364B