82ae276b787f3f63022121d36fdccf39d4c91a0cc449a74e7f57b4bcb51702e9

Sharing

Copy URL Twitter E-mail

General

Target

82ae276b787f3f63022121d36fdccf39d4c91a0cc449a74e7f57b4bcb51702e9
Size

294KB
MD5

9af1f79332477e3eced1687a54111f7d
SHA1

544223a80ad78ee39966052e8becd55448883821
SHA256

82ae276b787f3f63022121d36fdccf39d4c91a0cc449a74e7f57b4bcb51702e9
SHA512

ee27eb729278506ac6b2115fd092f03b926c94c520a7a5def63e3d3fcaaa7f2d40b87302f133b2762d259b9191245ee9825c5e47128a2976528803b411fc36c1
SSDEEP

6144:e8SjsynvWC4M9UU7+TlSYE6FKet+C6kD33H1zGR+FFWMbI:eYU9UUaTl1E6FKWH33H1a2A6I

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
82ae276b787f3f63022121d36fdccf39d4c91a0cc449a74e7f57b4bcb51702e9

Files

82ae276b787f3f63022121d36fdccf39d4c91a0cc449a74e7f57b4bcb51702e9
.exe windows:5 windows x86 arch:x86

b381777b8b2c033f3034a04b8121bcdd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\WindowsClient\CODE\Release\NamLoader.pdb

Imports

kernel32

ProcessIdToSessionId
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
OpenProcess
CreateThread
FormatMessageA
WTSGetActiveConsoleSessionId
TerminateProcess
WaitForMultipleObjects
Sleep
WideCharToMultiByte
MultiByteToWideChar
LocalFree
CreateMutexW
OpenEventW
WaitForSingleObject
SetEvent
CloseHandle
GetLastError
DeleteFileA
GetCurrentThreadId
GetModuleFileNameA
CreateDirectoryA
CreateEventW
InitializeCriticalSectionAndSpinCount
SetEndOfFile
SignalObjectAndWait
CreateFileW
GetSystemTimeAsFileTime
AreFileApisANSI
HeapFree
HeapAlloc
EncodePointer
DecodePointer
ReadFile
GetCommandLineW
RaiseException
RtlUnwind
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
TlsGetValue
CreateTimerQueueTimer
IsDebuggerPresent
IsProcessorFeaturePresent
MoveFileExW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
SetLastError
GetCurrentProcess
TlsAlloc
TlsSetValue
TlsFree
GetStartupInfoW
GetModuleHandleW
GetProcAddress
CreateSemaphoreW
GetProcessHeap
InterlockedDecrement
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile
GetModuleFileNameW
GetFileType
FlushFileBuffers
GetConsoleCP
GetConsoleMode
HeapSize
InterlockedIncrement
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
GetCurrentThread
SetFilePointer
SetFilePointerEx
ReadConsoleW
GetTimeZoneInformation
QueryPerformanceCounter
GetCurrentProcessId
GetEnvironmentStringsW
FreeEnvironmentStringsW
DeleteTimerQueueTimer
GetProcessAffinityMask
SetThreadAffinityMask
OutputDebugStringW
SwitchToThread
GetThreadTimes
FreeLibrary
FreeLibraryAndExitThread
GetModuleHandleA
LoadLibraryExW
SetThreadPriority
GetTickCount
GetVersionExW
VirtualAlloc
VirtualFree
VirtualProtect
DuplicateHandle
ReleaseSemaphore
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
InterlockedFlushSList
QueryDepthSList
UnregisterWaitEx
ChangeTimerQueueTimer
GetNumaHighestNodeNumber
RegisterWaitForSingleObject
CreateTimerQueue
HeapReAlloc
LoadLibraryW
SetStdHandle
WriteConsoleW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetStringTypeW
GetThreadPriority
UnregisterWait
SetEnvironmentVariableA

advapi32

StartServiceW
QueryServiceStatusEx
OpenServiceW
OpenSCManagerW
RevertToSelf
CreateProcessAsUserW
DuplicateTokenEx
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
OpenProcessToken
RegQueryValueExW
RegCloseKey
RegOpenKeyExW
CloseServiceHandle

userenv

CreateEnvironmentBlock
DestroyEnvironmentBlock

Sections

.text
Size: 194KB - Virtual size: 193KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 48KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b381777b8b2c033f3034a04b8121bcdd

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

userenv

Sections

.text Size: 194KB - Virtual size: 193KB

.rdata Size: 48KB - Virtual size: 47KB

.data Size: 9KB - Virtual size: 18KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 40KB - Virtual size: 40KB

.text
Size: 194KB - Virtual size: 193KB

.rdata
Size: 48KB - Virtual size: 47KB

.data
Size: 9KB - Virtual size: 18KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 40KB - Virtual size: 40KB