9ea420abc95d684140fa0a479458e01facf4edce35163f08ac4940c0e737ba39

Sharing

Copy URL Twitter E-mail

General

Target

9ea420abc95d684140fa0a479458e01facf4edce35163f08ac4940c0e737ba39
Size

3.0MB
MD5

f0e51bdbc410aaedfa48755c7013ae40
SHA1

5d0fdd0eba63c5f0d39a405d1b3a30be52706222
SHA256

9ea420abc95d684140fa0a479458e01facf4edce35163f08ac4940c0e737ba39
SHA512

31579ae76ead8a8cf14867c03ce9b2b1e40b063519d1899ea66cc7c262851cd4b874ba556542a4231d72e6f5768f87644ae6d05aa8b9c2bbd3bf28136d77daf6
SSDEEP

49152:HvJLGz/dkaIKrecupsHS6W7U5ffyyr6RSEtNxFCDNJeuwChUN:kZupeotNxF+CCh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9ea420abc95d684140fa0a479458e01facf4edce35163f08ac4940c0e737ba39

Files

9ea420abc95d684140fa0a479458e01facf4edce35163f08ac4940c0e737ba39
.exe windows:6 windows x64 arch:x64

d28ce02480cee5609642dc9aa50c5784

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\michallispashidis\_git\t1c-packagers\rust\tools\launcher\target\x86_64-pc-windows-msvc\release\deps\keysign_split_install_launch.pdb

Imports

secur32

LsaEnumerateLogonSessions
LsaGetLogonSessionData
LsaFreeReturnBuffer

kernel32

UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
CloseHandle
AttachConsole
ReleaseSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
AcquireSRWLockShared
CreateFileW
GetConsoleMode
GetLastError
lstrlenW
GetProcAddress
GetCurrentProcessId
GetTickCount64
GlobalMemoryStatusEx
GetDiskFreeSpaceExW
GetProcessTimes
GetExitCodeProcess
GetProcessHeap
HeapFree
HeapAlloc
OpenProcess
LocalAlloc
LocalFree
GetSystemTimes
GetProcessIoCounters
VirtualQueryEx
ReadProcessMemory
GetSystemInfo
GetLogicalDrives
GetDriveTypeW
GetVolumeInformationW
DeviceIoControl
SleepConditionVariableSRW
TryAcquireSRWLockExclusive
TzSpecificLocalTimeToSystemTime
SystemTimeToFileTime
SystemTimeToTzSpecificLocalTime
GetStdHandle
GetFileInformationByHandleEx
FreeEnvironmentStringsW
ReleaseMutex
FindClose
CompareStringOrdinal
AddVectoredExceptionHandler
SetThreadStackGuarantee
SwitchToThread
Sleep
GetCurrentProcess
GetCurrentThread
RtlCaptureContext
RtlLookupFunctionEntry
SetLastError
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetCommandLineW
DuplicateHandle
SetFilePointerEx
WriteFileEx
SleepEx
ReadFileEx
WaitForSingleObject
TerminateProcess
GetProcessId
WakeAllConditionVariable
WakeConditionVariable
QueryPerformanceCounter
QueryPerformanceFrequency
HeapReAlloc
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetModuleHandleA
GetFileInformationByHandle
CreateDirectoryW
FindFirstFileW
DeleteFileW
CopyFileExW
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
ExitProcess
GetFullPathNameW
CreateNamedPipeW
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
MultiByteToWideChar
WriteConsoleW
WideCharToMultiByte
ReadConsoleW
CreateThread
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
InitializeSListHead
GetCurrentThreadId
RtlVirtualUnwind

advapi32

GetUserNameW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
OpenProcessToken
GetTokenInformation
SystemFunction036
LookupAccountSidW
CopySid
GetLengthSid
IsValidSid

shell32

SHGetKnownFolderPath
CommandLineToArgvW

ole32

CoUninitialize
CoInitializeSecurity
CoTaskMemFree
CoCreateInstance
CoSetProxyBlanket
CoInitializeEx

pdh

PdhAddEnglishCounterW
PdhCloseQuery
PdhOpenQueryA
PdhCollectQueryData
PdhGetFormattedCounterValue
PdhRemoveCounter

powrprof

CallNtPowerInformation

iphlpapi

GetAdaptersAddresses
FreeMibTable
GetIfTable2
GetIfEntry2

psapi

GetPerformanceInfo
GetProcessMemoryInfo
GetModuleFileNameExW

ntdll

NtQueryInformationProcess
RtlGetVersion
NtQuerySystemInformation
NtReadFile
RtlNtStatusToDosError
NtWriteFile

oleaut32

SysAllocString
SysFreeString
VariantClear

netapi32

NetUserEnum
NetUserGetInfo
NetUserGetLocalGroups
NetApiBufferFree

bcrypt

BCryptGenRandom

vcruntime140

__current_exception_context
memmove
__current_exception
__C_specific_handler
_CxxThrowException
memcmp
memcpy
__CxxFrameHandler3
memset

api-ms-win-crt-string-l1-1-0

strlen
wcslen

api-ms-win-crt-heap-l1-1-0

malloc
_set_new_mode
free
realloc

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv
_get_initial_narrow_environment
_set_app_type
_seh_filter_exe
_initterm
exit
_exit
_register_thread_local_exe_atexit_callback
__p___argc
__p___argv
_cexit
_c_exit
_initialize_narrow_environment
_crt_atexit
_initialize_onexit_table
_register_onexit_function
terminate
_initterm_e

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 2.4MB - Virtual size: 2.4MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 552KB - Virtual size: 551KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 78KB - Virtual size: 77KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d28ce02480cee5609642dc9aa50c5784

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

secur32

kernel32

advapi32

shell32

ole32

pdh

powrprof

iphlpapi

psapi

ntdll

oleaut32

netapi32

bcrypt

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 2.4MB - Virtual size: 2.4MB

.rdata Size: 552KB - Virtual size: 551KB

.data Size: 6KB - Virtual size: 10KB

.pdata Size: 78KB - Virtual size: 77KB

.reloc Size: 8KB - Virtual size: 8KB

.text
Size: 2.4MB - Virtual size: 2.4MB

.rdata
Size: 552KB - Virtual size: 551KB

.data
Size: 6KB - Virtual size: 10KB

.pdata
Size: 78KB - Virtual size: 77KB

.reloc
Size: 8KB - Virtual size: 8KB