49e20b1758f8bbe5390e4ca675e734f0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

49e20b1758f8bbe5390e4ca675e734f0N.exe
Size

586KB
MD5

49e20b1758f8bbe5390e4ca675e734f0
SHA1

cf17d4c148cf74ee8bdbf11790986cdb8d56b333
SHA256

9a808eed498df524145a8793c4d12fbf8f202a6bc695becf4e7f4cda13c875e7
SHA512

0236da6d4bd6d9e8d21da4643f37169557d8ddf52d5f880dc472abcc4e37a0a76f7604953e80de018cd6b6363a7fdbbec9419ec9c6a14fc11c01bd79ba9f1257
SSDEEP

12288:6Vso7+aU1bjlJ85Z6sR/TneYTpEXJjgJqnkedOX8z:EsRaU1bj38b6sR/zeEEXJjgJ4kedOXy

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
49e20b1758f8bbe5390e4ca675e734f0N.exe

Files

49e20b1758f8bbe5390e4ca675e734f0N.exe
.dll windows:6 windows x64 arch:x64

b3bfe2dcaf49cba64fecbbf7b738e404

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

zlib

zlibVersion
inflateInit2_
inflateEnd
inflate
inflateInit_

libssh2

libssh2_session_method_pref
libssh2_session_last_error
libssh2_session_last_errno
libssh2_session_block_directions
libssh2_session_flag
libssh2_userauth_list
libssh2_userauth_authenticated
libssh2_userauth_password_ex
libssh2_userauth_publickey_fromfile_ex
libssh2_userauth_keyboard_interactive_ex
libssh2_channel_read_ex
libssh2_session_hostkey
libssh2_hostkey_hash
libssh2_session_free
libssh2_channel_write_ex
libssh2_session_set_blocking
libssh2_session_set_read_timeout
libssh2_channel_send_eof
libssh2_session_disconnect_ex
libssh2_session_handshake
libssh2_channel_wait_eof
libssh2_session_callback_set
libssh2_channel_wait_closed
libssh2_channel_free
libssh2_scp_recv2
libssh2_session_abstract
libssh2_scp_send64
libssh2_version
libssh2_knownhost_init
libssh2_knownhost_add
libssh2_knownhost_checkp
libssh2_session_init_ex
libssh2_knownhost_del
libssh2_knownhost_free
libssh2_knownhost_readfile
libssh2_knownhost_writefile
libssh2_exit
libssh2_init
libssh2_knownhost_get
libssh2_agent_init
libssh2_agent_connect
libssh2_agent_list_identities
libssh2_agent_get_identity
libssh2_agent_userauth
libssh2_agent_disconnect
libssh2_agent_free
libssh2_sftp_init
libssh2_sftp_shutdown
libssh2_sftp_last_error
libssh2_sftp_open_ex
libssh2_sftp_read
libssh2_sftp_readdir_ex
libssh2_sftp_write
libssh2_sftp_symlink_ex
libssh2_sftp_close_handle
libssh2_sftp_seek64
libssh2_sftp_stat_ex
libssh2_sftp_rename_ex
libssh2_sftp_unlink_ex
libssh2_sftp_statvfs
libssh2_sftp_mkdir_ex
libssh2_sftp_rmdir_ex

ws2_32

recvfrom
WSACleanup
WSAStartup
select
__WSAFDIsSet
htonl
ioctlsocket
WSAWaitForMultipleEvents
WSASetEvent
recv
htons
getsockopt
getsockname
getpeername
connect
bind
WSAGetLastError
WSASetLastError
send
closesocket
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
listen
accept
gethostname
freeaddrinfo
getaddrinfo
ntohs
socket
setsockopt
sendto
WSAIoctl

wldap32

ord147
ord133
ord79
ord142
ord167
ord127
ord27
ord26
ord117
ord301
ord145
ord219
ord46
ord14
ord216
ord73
ord208
ord41

advapi32

CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptImportKey
CryptEncrypt
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash

crypt32

CertFreeCertificateChainEngine
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CryptStringToBinaryW
CertFreeCertificateChain
CertGetCertificateChain
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringW
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore

bcrypt

BCryptGenRandom

kernel32

AcquireSRWLockExclusive
ReleaseSRWLockExclusive
CloseHandle
EnterCriticalSection
LeaveCriticalSection
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
IsProcessorFeaturePresent
InitializeCriticalSectionEx
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetFileSizeEx
CreateFileW
VerifyVersionInfoW
VerSetConditionMask
GetTickCount
QueryPerformanceCounter
WaitForMultipleObjects
PeekNamedPipe
ReadFile
GetFileType
GetStdHandle
LoadLibraryW
GetModuleHandleW
GetModuleHandleA
GetSystemDirectoryW
QueryPerformanceFrequency
FormatMessageW
SetLastError
GetLastError
GetCurrentProcessId
MoveFileExW
Sleep
GetEnvironmentVariableA
DeleteCriticalSection
SetEvent
WaitForSingleObject
CreateEventW
MultiByteToWideChar
SleepEx
WideCharToMultiByte
FreeLibrary
GetProcAddress
TerminateProcess
WaitForSingleObjectEx

vcruntime140

__std_type_info_destroy_list
__C_specific_handler
strstr
wcschr
memcmp
memchr
strrchr
memmove
strchr
memset
memcpy

api-ms-win-crt-string-l1-1-0

strcmp
strncmp
wcsncpy
strpbrk
strcspn
wcspbrk
wcsncmp
_strdup
strspn
_wcsdup

api-ms-win-crt-stdio-l1-1-0

_fileno
_read
_write
__stdio_common_vswprintf
fclose
_close
feof
ftell
fgets
_wopen
fputs
__stdio_common_vsscanf
fflush
_wfopen
__stdio_common_vsprintf
fputc
fseek
__acrt_iob_func
fwrite
_fseeki64
fread
_lseeki64

api-ms-win-crt-convert-l1-1-0

strtoul
strtoll
wcstombs
atoi
strtol

api-ms-win-crt-time-l1-1-0

strftime
_gmtime64
_time64

api-ms-win-crt-runtime-l1-1-0

__sys_errlist
__sys_nerr
_initterm
_initterm_e
_errno
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_beginthreadex
_execute_onexit_table
_cexit

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-filesystem-l1-1-0

_fstat64
_wstat64
_unlink

api-ms-win-crt-heap-l1-1-0

calloc
realloc
free
malloc

api-ms-win-crt-math-l1-1-0

_fdopen

Exports

Exports

curl_easy_cleanup
curl_easy_duphandle
curl_easy_escape
curl_easy_getinfo
curl_easy_header
curl_easy_init
curl_easy_nextheader
curl_easy_option_by_id
curl_easy_option_by_name
curl_easy_option_next
curl_easy_pause
curl_easy_perform
curl_easy_recv
curl_easy_reset
curl_easy_send
curl_easy_setopt
curl_easy_strerror
curl_easy_unescape
curl_easy_upkeep
curl_escape
curl_formadd
curl_formfree
curl_formget
curl_free
curl_getdate
curl_getenv
curl_global_cleanup
curl_global_init
curl_global_init_mem
curl_global_sslset
curl_global_trace
curl_maprintf
curl_mfprintf
curl_mime_addpart
curl_mime_data
curl_mime_data_cb
curl_mime_encoder
curl_mime_filedata
curl_mime_filename
curl_mime_free
curl_mime_headers
curl_mime_init
curl_mime_name
curl_mime_subparts
curl_mime_type
curl_mprintf
curl_msnprintf
curl_msprintf
curl_multi_add_handle
curl_multi_assign
curl_multi_cleanup
curl_multi_fdset
curl_multi_get_handles
curl_multi_info_read
curl_multi_init
curl_multi_perform
curl_multi_poll
curl_multi_remove_handle
curl_multi_setopt
curl_multi_socket
curl_multi_socket_action
curl_multi_socket_all
curl_multi_strerror
curl_multi_timeout
curl_multi_wait
curl_multi_waitfds
curl_multi_wakeup
curl_mvaprintf
curl_mvfprintf
curl_mvprintf
curl_mvsnprintf
curl_mvsprintf
curl_pushheader_byname
curl_pushheader_bynum
curl_share_cleanup
curl_share_init
curl_share_setopt
curl_share_strerror
curl_slist_append
curl_slist_free_all
curl_strequal
curl_strnequal
curl_unescape
curl_url
curl_url_cleanup
curl_url_dup
curl_url_get
curl_url_set
curl_url_strerror
curl_version
curl_version_info
curl_ws_meta
curl_ws_recv
curl_ws_send

Sections

.text
Size: 433KB - Virtual size: 432KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 116KB - Virtual size: 116KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1016B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b3bfe2dcaf49cba64fecbbf7b738e404

Headers

DLL Characteristics

File Characteristics

Imports

zlib

libssh2

ws2_32

wldap32

advapi32

crypt32

bcrypt

kernel32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

Exports

Exports

Sections

.text Size: 433KB - Virtual size: 432KB

.rdata Size: 116KB - Virtual size: 116KB

.data Size: 10KB - Virtual size: 12KB

.pdata Size: 21KB - Virtual size: 21KB

.rsrc Size: 1024B - Virtual size: 1016B

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 433KB - Virtual size: 432KB

.rdata
Size: 116KB - Virtual size: 116KB

.data
Size: 10KB - Virtual size: 12KB

.pdata
Size: 21KB - Virtual size: 21KB

.rsrc
Size: 1024B - Virtual size: 1016B

.reloc
Size: 3KB - Virtual size: 2KB