79224ead79f494e3c270b57be2e4b455bc8795b7bc87124f7f659e1fa7445a5d

Sharing

Copy URL Twitter E-mail

General

Target

79224ead79f494e3c270b57be2e4b455bc8795b7bc87124f7f659e1fa7445a5d
Size

33.8MB
MD5

5b14e8a2c76d90cc8b5aafac73dda56e
SHA1

98d09a0da10da6a9bdba11007d4ddfea4d0a0660
SHA256

79224ead79f494e3c270b57be2e4b455bc8795b7bc87124f7f659e1fa7445a5d
SHA512

d13a917747d9e884be1afe7ea6788a893b5d4e9e6f481afa115c929fd2b85ef1e8000f7b6fbfba9531b1ccd2bcb10f37e57123d2cfef2d51503b9c183f37574b
SSDEEP

393216:3upoRKKVMeKdLLIrPcNU2QlqaMUByqMFj9ofJOiF1IZby:3H8LIrWQlqGua3ay

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
79224ead79f494e3c270b57be2e4b455bc8795b7bc87124f7f659e1fa7445a5d

Files

79224ead79f494e3c270b57be2e4b455bc8795b7bc87124f7f659e1fa7445a5d
.exe windows:6 windows x64 arch:x64

0f86d767a0a17cae78de5d289ebbed5e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

advapi32

CryptEncrypt
CryptImportKey
CryptVerifySignatureA
GetUserNameW
OpenProcessToken
CryptExportKey
CryptSignHashA
CryptDestroyHash
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptGetKeyParam
CryptSetKeyParam
CryptGenKey
CryptGenRandom
CryptReleaseContext
CryptAcquireContextA
CryptCreateHash
RegCloseKey
RegEnumKeyExA
RegOpenKeyExA
RegOpenKeyExW
RegQueryInfoKeyA
RegQueryValueExA
RegQueryValueExW
SetThreadToken
OpenThreadToken
AccessCheck
AdjustTokenPrivileges
DuplicateTokenEx
GetFileSecurityW
LookupPrivilegeValueW
MapGenericMask
SetFileSecurityW
CryptDecrypt

ws2_32

freeaddrinfo
WSAEnumProtocolsW
WSAStartup
getaddrinfo
WSAEventSelect
listen
WSAGetLastError
gethostname
setsockopt
htons
htonl
getnameinfo
getsockopt
connect
closesocket
bind
ntohs
ntohl
select
sendto
accept
socket
WSASetLastError
send
WSAIoctl
WSAAddressToStringA
__WSAFDIsSet
shutdown
ioctlsocket
getsockname
WSASocketW
recvfrom
WSARecv
WSASend
recv

userenv

GetUserProfileDirectoryW

kernel32

ReOpenFile
CreateDirectoryW
DeleteFileW
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
GetFileAttributesW
GetFileAttributesExW
GetFileInformationByHandle
GetFinalPathNameByHandleW
GetFullPathNameW
GetVolumeInformationW
GetVolumePathNameW
RemoveDirectoryW
SetEndOfFile
SetFileAttributesW
SetFileTime
CreateIoCompletionPort
DeviceIoControl
LocalAlloc
FormatMessageW
CopyFileExW
CreateSymbolicLinkW
GetHandleInformation
SetLastError
GetQueuedCompletionStatusEx
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
DeleteCriticalSection
InitOnceExecuteOnce
GetTickCount64
GetModuleHandleW
SetFileCompletionNotificationModes
GetFileType
GetConsoleCP
GetConsoleMode
ReadFile
GetFileTime
GetModuleHandleExW
GetEnvironmentStrings
GetEnvironmentStringsW
FreeEnvironmentStringsA
FreeEnvironmentStringsW
GetProcessTimes
GetCurrentProcessId
TerminateProcess
GetExitCodeProcess
OpenProcess
CreatePipe
CreateProcessW
GetProcessId
GetConsoleWindow
PeekNamedPipe
GetNumberOfConsoleInputEvents
PeekConsoleInputA
GetSystemTimeAsFileTime
GetProcessAffinityMask
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
SetConsoleMode
AddVectoredContinueHandler
CloseHandle
CreateEventA
CreateFileMappingW
CreateFileW
DuplicateHandle
EnterCriticalSection
FlushFileBuffers
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentThread
GetCurrentThreadId
GetLastError
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
GetStdHandle
GetSystemDirectoryW
GetFileSizeEx
GetDiskFreeSpaceW
SetFilePointerEx
VerifyVersionInfoW
VerSetConditionMask
GlobalFree
WideCharToMultiByte
GetSystemInfo
SetHandleInformation
FormatMessageA
LocalFree
GetUserDefaultLCID
GetUserGeoID
GetGeoInfoA
GetLocaleInfoA
MultiByteToWideChar
GetDynamicTimeZoneInformation
GetTimeZoneInformation
WriteFile
WakeAllConditionVariable
WaitForSingleObject
VirtualQuery
VirtualProtect
VirtualFree
VirtualAlloc
UnmapViewOfFile
SwitchToThread
SleepConditionVariableCS
Sleep
SetEvent
ResumeThread
ResetEvent
QueryPerformanceFrequency
QueryPerformanceCounter
LoadLibraryA
LeaveCriticalSection
InitializeCriticalSection
InitializeConditionVariable
GlobalMemoryStatusEx
GetWindowsDirectoryW
GetVersionExA
GetTempPathW

vcruntime140

__C_specific_handler
__current_exception
__current_exception_context
__std_exception_destroy
wcsrchr
wcsstr
wcschr
memset
memcpy
__std_exception_copy
_CxxThrowException

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe
_beginthreadex
abort
_set_app_type
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_initterm_e
strerror_s
_errno
__p___argc
__p___argv
terminate
exit
_exit
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_configure_narrow_argv
_initialize_onexit_table
_register_onexit_function
_crt_atexit

api-ms-win-crt-environment-l1-1-0

_wgetdcwd
getenv
_wgetcwd
_wgetenv

api-ms-win-crt-heap-l1-1-0

realloc
_set_new_mode
malloc
free
calloc
_callnewh

api-ms-win-crt-string-l1-1-0

strlen
wcsncat
_strdup
strcpy
strncpy_s
strncpy
strcat
wcstok_s
_wcsdup
wcscmp
wcsncmp
wcscpy
iswctype
wcscat
_wcsupr
towupper
strcmp
isdigit
wcslen

api-ms-win-crt-convert-l1-1-0

strtoull
wcstombs

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__stdio_common_vsprintf
__stdio_common_vsnprintf_s
_set_fmode
__stdio_common_vswprintf
__stdio_common_vswscanf
__stdio_common_vfprintf
__p__commode
fputs
fflush

api-ms-win-crt-filesystem-l1-1-0

_wfullpath

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

ncrypt

NCryptSignHash
NCryptFreeObject
NCryptImportKey
NCryptGetProperty
NCryptOpenStorageProvider
NCryptExportKey
NCryptVerifySignature
NCryptTranslateHandle

crypt32

CertGetCertificateChain
CertOpenSystemStoreA
CertGetNameStringA
CryptAcquireCertificatePrivateKey
CertGetPublicKeyLength
CertFreeCertificateChain
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore

winhttp

WinHttpOpen
WinHttpGetProxyForUrl
WinHttpGetIEProxyConfigForCurrentUser

iphlpapi

GetFriendlyIfIndex
GetAdaptersAddresses
GetIfTable
GetIpAddrTable

Exports

Exports

IsolateEnterStub__CEntryPointNativeFunctions__attachThread__90932bcc20ecbcf858aacee06591a5d6accfc6c5__1d183c6f5747eae8664b2040486512f94f76e80a
IsolateEnterStub__CEntryPointNativeFunctions__createIsolate__4da00afe966ec86044a696c1c6cc5edee54f5947__fb52e230acd1e8278801cbbab0a45b63420d9206
IsolateEnterStub__CEntryPointNativeFunctions__detachAllThreadsAndTearDownIsolate__8ad059985878d3e833133ac81d31e6a5e663588c__0d033185a2ea569ff357a8e6934b8ca0f839fd2d
IsolateEnterStub__CEntryPointNativeFunctions__detachThread__69c773a2192ecb2e69e075ae79e8981eca9341c1__c685f50aa5dc4b82f2c79a10bffa488cd558e2fa
IsolateEnterStub__CEntryPointNativeFunctions__getCurrentThread__bc628616827b1c7a7e7fb487755d59e6aa965543__57d5ce0e01f37a287472c8d15afe2cdc157f5509
IsolateEnterStub__CEntryPointNativeFunctions__getIsolate__f4dc764d5e397da0c8702a7275b47a8472e550bf__04b2f6f0c083a3b5b0a994740f3f7115171ef12e
IsolateEnterStub__CEntryPointNativeFunctions__tearDownIsolate__e7eeccdf82350fb403383062c77028f83fcd185b__e6fc8f8e2ce918658a1f234c445c2b8917a757ef
IsolateEnterStub__JNIInvocationInterface_0024Exports__JNI__CreateJavaVM__5039eb5aa99cf9f72730ab2d0e29ae6c12b19e97__6f26f759c4dc3632fadc91c510a779de59b468b6
IsolateEnterStub__JNIInvocationInterface_0024Exports__JNI__GetCreatedJavaVMs__fabdcd9e9fd8550f0f1221268cfc2a219bdb7163__97d7bdacedb6148df54e2712802128d4da7335c0
IsolateEnterStub__JNIInvocationInterface_0024Exports__JNI__GetDefaultJavaVMInitArgs__3826dec25e2ca0c5d372c66d418722771fb21f83__a6af4db3692ab963e1eb0ca0c68be8363379e799
IsolateEnterStub__JavaMainWrapper__run__3148eece06270530b6e0d4d60311411342c82698__6639c63c0a0b7601e24c7fab81d8f5dd272de493
IsolateEnterStub__VmLocatorSymbol__vmLocatorSymbol__08573e35796b561e5eb64c338e890eaaca9db6ca__b221d1e506d93db269f08ef3b5e83204e91b0e7b
JNI_CreateJavaVM
JNI_GetCreatedJavaVMs
JNI_GetDefaultJavaVMInitArgs
__svm_code_section
__svm_version_info
__svm_vm_java_version
__svm_vm_target_ccompiler
__svm_vm_target_libc
__svm_vm_target_libraries
__svm_vm_target_platform
__svm_vm_target_staticlibraries
graal_attach_thread
graal_create_isolate
graal_detach_all_threads_and_tear_down_isolate
graal_detach_thread
graal_get_current_thread
graal_get_isolate
graal_tear_down_isolate
graal_vm_locator_symbol
main

Sections

.text
Size: 17.2MB - Virtual size: 17.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rodata
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.svm_hea
Size: 16.4MB - Virtual size: 16.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 88KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0f86d767a0a17cae78de5d289ebbed5e

Headers

DLL Characteristics

File Characteristics

Imports

version

advapi32

ws2_32

userenv

kernel32

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

ncrypt

crypt32

winhttp

iphlpapi

Exports

Exports

Sections

.text Size: 17.2MB - Virtual size: 17.2MB

.rdata Size: 48KB - Virtual size: 47KB

.data Size: 8KB - Virtual size: 10KB

.pdata Size: 8KB - Virtual size: 5KB

.rodata Size: 20KB - Virtual size: 18KB

.svm_hea Size: 16.4MB - Virtual size: 16.4MB

.reloc Size: 88KB - Virtual size: 86KB

.text
Size: 17.2MB - Virtual size: 17.2MB

.rdata
Size: 48KB - Virtual size: 47KB

.data
Size: 8KB - Virtual size: 10KB

.pdata
Size: 8KB - Virtual size: 5KB

.rodata
Size: 20KB - Virtual size: 18KB

.svm_hea
Size: 16.4MB - Virtual size: 16.4MB

.reloc
Size: 88KB - Virtual size: 86KB