5b8688bb5f51df4a4ab987566423d480N[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

5b8688bb5f51df4a4ab987566423d480N.exe
Size

45KB
MD5

5b8688bb5f51df4a4ab987566423d480
SHA1

c51bfaa2a4beab8006afa185d9135d5e6cd32a5c
SHA256

553dc86820712930b89b8d83276764c1c3fd450f3053cd4fb45afa5a9c01ec54
SHA512

861e9b85deaad5402b6532618dc20ed8f15b06d7af8bf8b92dd5422ea4c8bd214eedba343134a9a3f89bbd25f9e6f2d8091fcf72d8639700d9141978ea59b456
SSDEEP

768:OytMNE0WZ4HT4tOqIjKMLz7SGO/SHGCj:vflOqwKMLz7EaHd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5b8688bb5f51df4a4ab987566423d480N.exe

Files

5b8688bb5f51df4a4ab987566423d480N.exe
.dll windows:6 windows x64 arch:x64

c2b1f8a0cab017ee8024e61cccc7eede

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

lstrlenW
lstrcpynW
GetModuleFileNameW
MultiByteToWideChar
WideCharToMultiByte
LoadLibraryW
GetProcAddress
FreeLibrary
DisableThreadLibraryCalls
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
RtlCaptureContext
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException
__std_exception_destroy
__std_exception_copy
__C_specific_handler
wcschr
wcsrchr
strstr
__std_terminate
_purecall
memcpy
memset
__std_type_info_destroy_list

api-ms-win-crt-string-l1-1-0

wcsncpy_s
strncpy_s
_wcsdup
wcsncat_s
_strdup
_wcsicmp

api-ms-win-crt-heap-l1-1-0

free
realloc
malloc
_callnewh

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsnwprintf_s
__stdio_common_vsnprintf_s
__stdio_common_vswprintf_s

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_cexit
_seh_filter_dll
_configure_narrow_argv
_execute_onexit_table
_initialize_narrow_environment
_initialize_onexit_table
_initterm

Exports

Exports

kpi_CreateInstance

Sections

.text
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 552B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

c2b1f8a0cab017ee8024e61cccc7eede

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

vcruntime140_1

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

Exports

Exports

Sections

.text Size: 19KB - Virtual size: 19KB

.rdata Size: 21KB - Virtual size: 20KB

.data Size: 1024B - Virtual size: 2KB

.pdata Size: 1KB - Virtual size: 1KB

.reloc Size: 1024B - Virtual size: 552B

.text
Size: 19KB - Virtual size: 19KB

.rdata
Size: 21KB - Virtual size: 20KB

.data
Size: 1024B - Virtual size: 2KB

.pdata
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1024B - Virtual size: 552B