6418dac177d6e8ef5976d9a0935c6730N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

6418dac177d6e8ef5976d9a0935c6730N.exe
Size

62KB
MD5

6418dac177d6e8ef5976d9a0935c6730
SHA1

9c57020b6658c3b583f373fa6d29d35d6fc241ff
SHA256

ffbcb0411b9f9e735b0eac5e60e1440479c489a73f4158498368cde649c0b009
SHA512

362415656100ebb23cfbc3ccf8981b8722aa4d343f928e2f0f4ca195b22b7a1d1d027ecd0f51796490665f336b9e5154a2cad8c95371278651af5d6de68abc18
SSDEEP

1536:kG4HDREhO8mda36bSfOjwP+Tp67RY9WUKpe:uHKO8sa36SOjw8ERY4pe

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6418dac177d6e8ef5976d9a0935c6730N.exe

Files

6418dac177d6e8ef5976d9a0935c6730N.exe
.dll windows:4 windows x86 arch:x86

7e4783e84e39e84aaf5729ac570536cc

Headers

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

D:\smartloader\kernel_proj\trunk\kernel_smartloader\bin\ReleaseA\pdb\KernelLiveUpdate.pdb

Imports

kernel32

CreateProcessA
GetVersionExA
WritePrivateProfileStringA
GetProcAddress
GetPrivateProfileStringA
GetModuleHandleA
GetSystemInfo
CloseHandle
CreateDirectoryA
OutputDebugStringA
CreateFileA
SetFilePointer
WriteFile
FileTimeToSystemTime
ReadFile
SetEndOfFile
GetProcessTimes
GetCurrentProcess
FileTimeToLocalFileTime
GetPrivateProfileIntA
GetSystemTimeAsFileTime
GetCurrentProcessId
GetModuleFileNameA
CopyFileA
GetFileAttributesA
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
IsDebuggerPresent
InterlockedExchange
GetACP
GetLocaleInfoA
GetThreadLocale
Sleep
InterlockedCompareExchange
TerminateProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter

user32

MessageBoxA

shell32

SHGetSpecialFolderPathA
SHGetSpecialFolderLocation
SHGetPathFromIDListA

msvcp80

??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z
?substr@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBE?AV12@II@Z
?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@ID@Z
?_Tidy@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@IAEX_NI@Z
?rfind@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIPBDII@Z
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z
?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z
?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z
??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z
?replace@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@V?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@0ABV12@@Z
?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?begin@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ
?assign@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@V?$_String_const_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@0@Z
??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@PBD@Z
??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ
??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@PBD@Z
??$?HDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@ABV10@0@Z
?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB
??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z
??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

msvcr80

??0exception@std@@QAE@ABV01@@Z
??1exception@std@@UAE@XZ
_access
_chmod
_unlink
__RTDynamicCast
_vsnprintf_s
_mbscmp
_time64
_purecall
_mbsrchr
strftime
_localtime64
_unlock
__dllonexit
_encode_pointer
_lock
_onexit
_decode_pointer
_malloc_crt
free
_encoded_null
_initterm
_initterm_e
_amsg_exit
_adjust_fdiv
__CppXcptFilter
?terminate@@YAXXZ
?_type_info_dtor_internal_method@type_info@@QAEXXZ
_crt_debugger_hook
_except_handler4_common
__clean_type_info_names_internal
__CxxFrameHandler3
memset
??3@YAXPAX@Z
_invalid_parameter_noinfo
??2@YAPAXI@Z
??0exception@std@@QAE@XZ
_CxxThrowException

wininet

HttpOpenRequestA
InternetConnectA
HttpSendRequestA
InternetCloseHandle
InternetOpenA

Exports

Exports

CreateObject

Sections

.text
Size: 28KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 12KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 428B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7e4783e84e39e84aaf5729ac570536cc

Headers

File Characteristics

PDB Paths

Imports

kernel32

user32

shell32

msvcp80

msvcr80

wininet

Exports

Exports

Sections

.text Size: 28KB - Virtual size: 25KB

.rdata Size: 12KB - Virtual size: 10KB

.data Size: 4KB - Virtual size: 3KB

.rsrc Size: 4KB - Virtual size: 428B

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 28KB - Virtual size: 25KB

.rdata
Size: 12KB - Virtual size: 10KB

.data
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 4KB - Virtual size: 428B

.reloc
Size: 4KB - Virtual size: 3KB