3fec08eb01d370e0b9fb0ced2470e520N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

3fec08eb01d370e0b9fb0ced2470e520N.exe
Size

293KB
MD5

3fec08eb01d370e0b9fb0ced2470e520
SHA1

6d96ac88f28b8de0c0b383b7f298b797dd7ff000
SHA256

acfd52c371a75d291ab6a7f9e4a9493b1d1a76d420dd8d7b18501d91273b00f0
SHA512

c18e8165315f597c37cfc50e3cfa1fe7750f2b2b4a44f4f66ce84c20a4e2a756fe23b68918f822f7a9b8786ac597aa276c262243b40598ba9ffff9ece8e9a91d
SSDEEP

3072:TrF7yjOpGAKFKHZZdZy3+hkB2Qcqyp48F1qiz0WRemrefgZ4bPt4+RqxjA+As4gp:7pToSZtxKpaJFpDZ4pc19fT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3fec08eb01d370e0b9fb0ced2470e520N.exe

Files

3fec08eb01d370e0b9fb0ced2470e520N.exe
.exe windows:4 windows x64 arch:x64

df305442911a9b69cb8dee16295f6648

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

AllocateAndInitializeSid
CheckTokenMembership
ConvertSidToStringSidA
DuplicateToken
EqualSid
FreeSid
GetTokenInformation
ImpersonateLoggedOnUser
LsaNtStatusToWinError
OpenProcessToken
OpenThreadToken
RevertToSelf

cryptdll

CDLocateCSystem

kernel32

CloseHandle
CreateToolhelp32Snapshot
DeleteCriticalSection
EnterCriticalSection
FileTimeToSystemTime
GetLastError
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
MultiByteToWideChar
OpenProcess
Process32FirstW
Process32NextW
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
WideCharToMultiByte

msasn1

ASN1BERDecBitString
ASN1BERDecEndOfContents
ASN1BERDecExplicitTag
ASN1BERDecGeneralizedTime
ASN1BERDecNotEndOfContents
ASN1BERDecOctetString
ASN1BERDecPeekTag
ASN1BERDecS32Val
ASN1BERDecSXVal
ASN1BERDecZeroCharString
ASN1BEREncCharString
ASN1BEREncEndOfContents
ASN1BEREncExplicitTag
ASN1BEREncOctetString
ASN1BEREncS32
ASN1DecAlloc
ASN1Free
ASN1_CloseDecoder
ASN1_CloseEncoder
ASN1_CloseModule
ASN1_CreateDecoder
ASN1_CreateEncoder
ASN1_CreateModule
ASN1_Decode
ASN1_Encode
ASN1_FreeDecoded
ASN1_FreeEncoded
ASN1bitstring_free
ASN1intx_free
ASN1octetstring_free
ASN1ztcharstring_free

msvcrt

__C_specific_handler
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_cexit
_commode
_errno
_fmode
_initterm
_lock
_onexit
_snprintf
_unlock
_vsnprintf
abort
calloc
exit
fprintf
fputc
free
fwrite
localeconv
malloc
mbstowcs
memcpy
memset
signal
strerror
strlen
strncmp
strtol
vfprintf
wcslen

ntdll

RtlFreeAnsiString
RtlUnicodeStringToAnsiString

secur32

AcquireCredentialsHandleA
DeleteSecurityContext
FreeContextBuffer
FreeCredentialsHandle
InitializeSecurityContextA
LsaCallAuthenticationPackage
LsaConnectUntrusted
LsaDeregisterLogonProcess
LsaEnumerateLogonSessions
LsaFreeReturnBuffer
LsaGetLogonSessionData
LsaLookupAuthenticationPackage
LsaRegisterLogonProcess

Sections

.text
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 164B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/4
Size: 1024B - Virtual size: 608B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/19
Size: 93KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/31
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/45
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/57
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/70
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/81
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/97
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/113
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

df305442911a9b69cb8dee16295f6648

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

cryptdll

kernel32

msasn1

msvcrt

ntdll

secur32

Sections

.text Size: 56KB - Virtual size: 55KB

.data Size: 2KB - Virtual size: 1KB

.rdata Size: 8KB - Virtual size: 7KB

.pdata Size: 2KB - Virtual size: 1KB

.xdata Size: 2KB - Virtual size: 2KB

.bss Size: - Virtual size: 2KB

.idata Size: 5KB - Virtual size: 4KB

.CRT Size: 512B - Virtual size: 96B

.tls Size: 512B - Virtual size: 16B

.reloc Size: 512B - Virtual size: 164B

/4 Size: 1024B - Virtual size: 608B

/19 Size: 93KB - Virtual size: 92KB

/31 Size: 9KB - Virtual size: 9KB

/45 Size: 23KB - Virtual size: 22KB

/57 Size: 6KB - Virtual size: 6KB

/70 Size: 2KB - Virtual size: 1KB

/81 Size: 4KB - Virtual size: 3KB

/97 Size: 19KB - Virtual size: 19KB

/113 Size: 1KB - Virtual size: 1KB

.text
Size: 56KB - Virtual size: 55KB

.data
Size: 2KB - Virtual size: 1KB

.rdata
Size: 8KB - Virtual size: 7KB

.pdata
Size: 2KB - Virtual size: 1KB

.xdata
Size: 2KB - Virtual size: 2KB

.bss
Size: - Virtual size: 2KB

.idata
Size: 5KB - Virtual size: 4KB

.CRT
Size: 512B - Virtual size: 96B

.tls
Size: 512B - Virtual size: 16B

.reloc
Size: 512B - Virtual size: 164B

/4
Size: 1024B - Virtual size: 608B

/19
Size: 93KB - Virtual size: 92KB

/31
Size: 9KB - Virtual size: 9KB

/45
Size: 23KB - Virtual size: 22KB

/57
Size: 6KB - Virtual size: 6KB

/70
Size: 2KB - Virtual size: 1KB

/81
Size: 4KB - Virtual size: 3KB

/97
Size: 19KB - Virtual size: 19KB

/113
Size: 1KB - Virtual size: 1KB