norton-antivirus[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

norton-antivirus.exe
Size

2.7MB
MD5

142f6ced9cb2841451ee2c165dd31c7e
SHA1

e250964032e4249c1ab62990c2822ba00c401401
SHA256

db345e5e35de1ef05878c099a6986fa384256083b4dd154515b2d9b2dfe19749
SHA512

db62036c33dcfee61af1975a751e1142c589dd9c4178e5b8df97d7a73f12b7a389d041b906cf19bf26f25de8364e05d05830563930b8933a631f9d56be6d19f5
SSDEEP

49152:AVI8ZcFalH+jxMeHaX9CRThdWVvetKFQgXKJ3D:AvZDQX3D

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
norton-antivirus.exe

Files

norton-antivirus.exe
.exe windows:6 windows x64 arch:x64

62566e1e23c01fefb27ee1a232a679d6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

norton_antivirus.pdb

Imports

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressAll
WaitOnAddress
WakeByAddressSingle

user32

RegisterClassExA
MessageBoxA
DispatchMessageA
TranslateMessage
GetMessageA
RegisterRawInputDevices
GetRawInputData
DefWindowProcA
CreateWindowExA

kernel32

GetQueuedCompletionStatusEx
PostQueuedCompletionStatus
CreateIoCompletionPort
SetHandleInformation
SetFileCompletionNotificationModes
GetCurrentThreadId
GetLastError
AddVectoredExceptionHandler
SetThreadStackGuarantee
SwitchToThread
WaitForSingleObject
QueryPerformanceCounter
RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry
SetLastError
GetCurrentDirectoryW
GetEnvironmentVariableW
GetSystemTimeAsFileTime
GetCurrentProcess
InitializeSListHead
GetStdHandle
GetCurrentProcessId
QueryPerformanceFrequency
HeapFree
IsDebuggerPresent
HeapReAlloc
lstrlenW
ReleaseMutex
GetProcessHeap
HeapAlloc
GetFinalPathNameByHandleW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetConsoleMode
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
MultiByteToWideChar
WriteConsoleW
CreateThread
GetCurrentThread
GetProcAddress
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
CloseHandle
GetModuleHandleA
GetComputerNameA
IsProcessorFeaturePresent

advapi32

RegSetValueExW
GetUserNameW
RegCreateKeyExW
RegCloseKey
RegQueryValueExW
RegOpenKeyExW

secur32

DecryptMessage
InitializeSecurityContextW
AcquireCredentialsHandleA
AcceptSecurityContext
FreeCredentialsHandle
DeleteSecurityContext
FreeContextBuffer
ApplyControlToken
EncryptMessage
QueryContextAttributesW

ws2_32

WSASend
recv
shutdown
getsockopt
ioctlsocket
setsockopt
bind
WSASocketW
getpeername
getsockname
WSAGetLastError
WSAStartup
WSACleanup
connect
freeaddrinfo
getaddrinfo
WSAIoctl
closesocket
send

crypt32

CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertOpenStore
CertCloseStore
CertDuplicateCertificateChain
CertDuplicateStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertVerifyCertificateChainPolicy
CertGetCertificateChain
CertFreeCertificateChain

ntdll

RtlNtStatusToDosError
NtDeviceIoControlFile
NtWriteFile
NtCreateFile
NtCancelIoFileEx

vcruntime140

memset
_CxxThrowException
__C_specific_handler
__current_exception_context
memcmp
__CxxFrameHandler3
memmove
memcpy
__current_exception

api-ms-win-crt-runtime-l1-1-0

_cexit
_c_exit
_register_thread_local_exe_atexit_callback
__p___argv
_initterm
_seh_filter_exe
_get_initial_narrow_environment
__p___argc
_initialize_narrow_environment
_initterm_e
_exit
_configure_narrow_argv
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
exit
_set_app_type

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 939KB - Virtual size: 939KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 96KB - Virtual size: 95KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

62566e1e23c01fefb27ee1a232a679d6

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

bcryptprimitives

api-ms-win-core-synch-l1-2-0

user32

kernel32

advapi32

secur32

ws2_32

crypt32

ntdll

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 939KB - Virtual size: 939KB

.data Size: 12KB - Virtual size: 12KB

.pdata Size: 96KB - Virtual size: 95KB

.reloc Size: 18KB - Virtual size: 17KB

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 939KB - Virtual size: 939KB

.data
Size: 12KB - Virtual size: 12KB

.pdata
Size: 96KB - Virtual size: 95KB

.reloc
Size: 18KB - Virtual size: 17KB