ff086bda7b3d7f5a145ab98d04068030N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

ff086bda7b3d7f5a145ab98d04068030N.exe
Size

78KB
MD5

ff086bda7b3d7f5a145ab98d04068030
SHA1

375d7c251f2b4c850902ea6316484f712775ff28
SHA256

ba406afe89daa0f672e299071b6e60535a06adaaeebd033795c8b3e5e655394b
SHA512

c9df6ff0def7aa770805cf300382ef7b23e7c3d0d8850c0f0b8c7e590c8dd0199d6d0bc9cd64d538dd54fa654a3139a499d3252d5087d1cce4f302372239c119
SSDEEP

1536:zfCrI2jp7qqojOpJYl2z2FKHZZ24GUy3+hrGVD+wB5k1VdQc:WrF7yjOpGAKFKHZZdZy3+hkB2Qc

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ff086bda7b3d7f5a145ab98d04068030N.exe

Files

ff086bda7b3d7f5a145ab98d04068030N.exe
.exe windows:4 windows x64 arch:x64

df305442911a9b69cb8dee16295f6648

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

advapi32

AllocateAndInitializeSid
CheckTokenMembership
ConvertSidToStringSidA
DuplicateToken
EqualSid
FreeSid
GetTokenInformation
ImpersonateLoggedOnUser
LsaNtStatusToWinError
OpenProcessToken
OpenThreadToken
RevertToSelf

cryptdll

CDLocateCSystem

kernel32

CloseHandle
CreateToolhelp32Snapshot
DeleteCriticalSection
EnterCriticalSection
FileTimeToSystemTime
GetLastError
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
MultiByteToWideChar
OpenProcess
Process32FirstW
Process32NextW
SetUnhandledExceptionFilter
Sleep
TlsGetValue
VirtualProtect
VirtualQuery
WideCharToMultiByte

msasn1

ASN1BERDecBitString
ASN1BERDecEndOfContents
ASN1BERDecExplicitTag
ASN1BERDecGeneralizedTime
ASN1BERDecNotEndOfContents
ASN1BERDecOctetString
ASN1BERDecPeekTag
ASN1BERDecS32Val
ASN1BERDecSXVal
ASN1BERDecZeroCharString
ASN1BEREncCharString
ASN1BEREncEndOfContents
ASN1BEREncExplicitTag
ASN1BEREncOctetString
ASN1BEREncS32
ASN1DecAlloc
ASN1Free
ASN1_CloseDecoder
ASN1_CloseEncoder
ASN1_CloseModule
ASN1_CreateDecoder
ASN1_CreateEncoder
ASN1_CreateModule
ASN1_Decode
ASN1_Encode
ASN1_FreeDecoded
ASN1_FreeEncoded
ASN1bitstring_free
ASN1intx_free
ASN1octetstring_free
ASN1ztcharstring_free

msvcrt

__C_specific_handler
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_amsg_exit
_cexit
_commode
_errno
_fmode
_initterm
_lock
_onexit
_snprintf
_unlock
_vsnprintf
abort
calloc
exit
fprintf
fputc
free
fwrite
localeconv
malloc
mbstowcs
memcpy
memset
signal
strerror
strlen
strncmp
strtol
vfprintf
wcslen

ntdll

RtlFreeAnsiString
RtlUnicodeStringToAnsiString

secur32

AcquireCredentialsHandleA
DeleteSecurityContext
FreeContextBuffer
FreeCredentialsHandle
InitializeSecurityContextA
LsaCallAuthenticationPackage
LsaConnectUntrusted
LsaDeregisterLogonProcess
LsaEnumerateLogonSessions
LsaFreeReturnBuffer
LsaGetLogonSessionData
LsaLookupAuthenticationPackage
LsaRegisterLogonProcess

Sections

.text
Size: 56KB - Virtual size: 55KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 164B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

df305442911a9b69cb8dee16295f6648

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

cryptdll

kernel32

msasn1

msvcrt

ntdll

secur32

Sections

.text Size: 56KB - Virtual size: 55KB

.data Size: 2KB - Virtual size: 1KB

.rdata Size: 8KB - Virtual size: 7KB

.pdata Size: 2KB - Virtual size: 1KB

.xdata Size: 2KB - Virtual size: 2KB

.bss Size: - Virtual size: 2KB

.idata Size: 5KB - Virtual size: 4KB

.CRT Size: 512B - Virtual size: 96B

.tls Size: 512B - Virtual size: 16B

.reloc Size: 512B - Virtual size: 164B

.text
Size: 56KB - Virtual size: 55KB

.data
Size: 2KB - Virtual size: 1KB

.rdata
Size: 8KB - Virtual size: 7KB

.pdata
Size: 2KB - Virtual size: 1KB

.xdata
Size: 2KB - Virtual size: 2KB

.bss
Size: - Virtual size: 2KB

.idata
Size: 5KB - Virtual size: 4KB

.CRT
Size: 512B - Virtual size: 96B

.tls
Size: 512B - Virtual size: 16B

.reloc
Size: 512B - Virtual size: 164B