f2c1ac9e49e0aac814be2909dde03720N[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

f2c1ac9e49e0aac814be2909dde03720N.exe
Size

364KB
MD5

f2c1ac9e49e0aac814be2909dde03720
SHA1

a51a3bbaa94b7b5f4653c4e2da0e99952b7fbf7a
SHA256

773467b4d5e426f3b5067e9c9adb5b4157011f7d7efbdc1fbf3218ba4423d4aa
SHA512

e004f9416ab453e4d37980286ac7378dbe76d59a5d298f9be915aff2453d8c4bf5b844ab941a285f1d4502a1c798308b2498f1e987fb51512f6dbdf6cbee79e6
SSDEEP

6144:GQ9VQINgRBw/nZoZUBfgDR0MfBgV44GH25ILsEqJ3TdiFP:GYVQINgRBw/ZoZU4vKV44GnLsxVTd

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f2c1ac9e49e0aac814be2909dde03720N.exe

Files

f2c1ac9e49e0aac814be2909dde03720N.exe
.exe windows:4 windows x86 arch:x86

cb77eff64e4783700805bdcd0eb495e2

Headers

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\dnsrv\drivers\storage\volsnap\vss\server\vss-support\vshadow.sdk72\bin\Release-Server\vshadow.pdb

Imports

vssapi

ord6
?CreateVssBackupComponents@@YGJPAPAVIVssBackupComponents@@@Z
ord7

kernel32

GetModuleHandleA
GetLastError
GetVolumeNameForVolumeMountPointW
CloseHandle
WriteFile
CreateFileW
WideCharToMultiByte
GetVolumePathNamesForVolumeNameW
GetVolumePathNameW
FindClose
FindNextFileW
FindFirstFileW
GetFileAttributesW
QueryDosDeviceW
GetTimeFormatW
GetDateFormatW
GetThreadLocale
FileTimeToSystemTime
FileTimeToLocalFileTime
GetExitCodeProcess
WaitForSingleObject
CreateProcessW
ReadFile
GetFileSize
GetCommandLineW
InterlockedExchange
GetACP
GetLocaleInfoA
RaiseException
InitializeCriticalSection
DeleteCriticalSection
LocalFree
FormatMessageW
ExpandEnvironmentStringsW
LoadLibraryA
GetOEMCP
SetEndOfFile
CreateFileA
SetStdHandle
IsBadCodePtr
IsBadReadPtr
IsValidCodePage
MultiByteToWideChar
GetVersionExA
RtlUnwind
ExitProcess
GetCPInfo
HeapFree
IsValidLocale
HeapAlloc
LCMapStringA
LCMapStringW
GetProcAddress
TerminateProcess
GetCurrentProcess
GetStringTypeA
GetStringTypeW
HeapReAlloc
SetUnhandledExceptionFilter
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
GetModuleFileNameA
HeapDestroy
HeapCreate
VirtualFree
VirtualAlloc
IsBadWritePtr
FlushFileBuffers
SetHandleCount
GetStdHandle
GetFileType
GetStartupInfoA
SetFilePointer
VirtualQuery
HeapSize
UnhandledExceptionFilter
GetModuleFileNameW
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
VirtualProtect
GetSystemInfo
GetUserDefaultLCID
EnumSystemLocalesA
GetLocaleInfoW

ole32

CoInitializeSecurity
CoTaskMemFree
CoInitialize
CoUninitialize
CoCreateInstance
CLSIDFromString

oleaut32

SysAllocString
SysFreeString

Sections

.text
Size: 252KB - Virtual size: 248KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 80KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

�Von�uY
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

cb77eff64e4783700805bdcd0eb495e2

Headers

File Characteristics

PDB Paths

Imports

vssapi

kernel32

ole32

oleaut32

Sections

.text Size: 252KB - Virtual size: 248KB

.rdata Size: 80KB - Virtual size: 77KB

.data Size: 8KB - Virtual size: 11KB

�Von�uY Size: 20KB - Virtual size: 20KB

.text
Size: 252KB - Virtual size: 248KB

.rdata
Size: 80KB - Virtual size: 77KB

.data
Size: 8KB - Virtual size: 11KB

�Von�uY
Size: 20KB - Virtual size: 20KB