5dd2bc0d15e9b49bce920e2930465ec0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

5dd2bc0d15e9b49bce920e2930465ec0N.exe
Size

2.3MB
MD5

5dd2bc0d15e9b49bce920e2930465ec0
SHA1

1746e04aa5542cf6f22b675ed0ca22d46bdc1699
SHA256

e43b56710cf7f9f51699318957210f19c2cc9f21ca6fd2acc73a6201b3aec466
SHA512

45dbcc23d21c7d17814efcf9aef3525290dbef3dca7118a2598d30abf9bf5c43e646ef9f82cabf86c80696c596fdb78b92a395a52fb9e87266ecef3d700e5d03
SSDEEP

49152:GFtaV4yeYYBQqnKBYKrezRC1iK9/gPx3m29z5jQ:eByvFu4x9/a9z5U

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5dd2bc0d15e9b49bce920e2930465ec0N.exe

Files

5dd2bc0d15e9b49bce920e2930465ec0N.exe
.dll windows:6 windows x64 arch:x64

6ef808ed717726657d0f2b2677968909

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

GetLastError
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress

user32

wsprintfA

advapi32

CryptAcquireContextA

imagehlp

ImageNtHeader

shlwapi

StrTrimA

Exports

Exports

AddIPAddress
AllocateAndGetInterfaceInfoFromStack
AllocateAndGetIpAddrTableFromStack
CancelIPChangeNotify
CancelIfTimestampConfigChange
CancelMibChangeNotify2
CaptureInterfaceHardwareCrossTimestamp
CloseCompartment
CloseGetIPPhysicalInterfaceForDestination
ConvertCompartmentGuidToId
ConvertCompartmentIdToGuid
ConvertGuidToStringA
ConvertGuidToStringW
ConvertInterfaceAliasToLuid
ConvertInterfaceGuidToLuid
ConvertInterfaceIndexToLuid
ConvertInterfaceLuidToAlias
ConvertInterfaceLuidToGuid
ConvertInterfaceLuidToIndex
ConvertInterfaceLuidToNameA
ConvertInterfaceLuidToNameW
ConvertInterfaceNameToLuidA
ConvertInterfaceNameToLuidW
ConvertInterfacePhysicalAddressToLuid
ConvertIpv4MaskToLength
ConvertLengthToIpv4Mask
ConvertRemoteInterfaceAliasToLuid
ConvertRemoteInterfaceGuidToLuid
ConvertRemoteInterfaceIndexToLuid
ConvertRemoteInterfaceLuidToAlias
ConvertRemoteInterfaceLuidToGuid
ConvertRemoteInterfaceLuidToIndex
ConvertStringToGuidA
ConvertStringToGuidW
ConvertStringToInterfacePhysicalAddress
CreateAnycastIpAddressEntry
CreateCompartment
CreateIpForwardEntry
CreateIpForwardEntry2
CreateIpNetEntry
CreateIpNetEntry2
CreatePersistentTcpPortReservation
CreatePersistentUdpPortReservation
CreateProxyArpEntry
CreateSortedAddressPairs
CreateUnicastIpAddressEntry
DeleteAnycastIpAddressEntry
DeleteCompartment
DeleteIPAddress
DeleteIpForwardEntry
DeleteIpForwardEntry2
DeleteIpNetEntry
DeleteIpNetEntry2
DeletePersistentTcpPortReservation
DeletePersistentUdpPortReservation
DeleteProxyArpEntry
DeleteUnicastIpAddressEntry
DisableMediaSense
EnableRouter
FlushIpNetTable
FlushIpNetTable2
FlushIpPathTable
FreeDnsSettings
FreeInterfaceDnsSettings
FreeMibTable
GetAdapterIndex
GetAdapterOrderMap
GetAdaptersAddresses
GetAdaptersInfo
GetAnycastIpAddressEntry
GetAnycastIpAddressTable
GetBestInterface
GetBestInterfaceEx
GetBestRoute
GetBestRoute2
GetCurrentThreadCompartmentId
GetCurrentThreadCompartmentScope
GetDefaultCompartmentId
GetDnsSettings
GetExtendedTcpTable
GetExtendedUdpTable
GetFriendlyIfIndex
GetIcmpStatistics
GetIcmpStatisticsEx
GetIfEntry
GetIfEntry2
GetIfEntry2Ex
GetIfStackTable
GetIfTable
GetIfTable2
GetIfTable2Ex
GetInterfaceCompartmentId
GetInterfaceCurrentTimestampCapabilities
GetInterfaceDnsSettings
GetInterfaceHardwareTimestampCapabilities
GetInterfaceInfo
GetInvertedIfStackTable
GetIpAddrTable
GetIpErrorString
GetIpForwardEntry2
GetIpForwardTable
GetIpForwardTable2
GetIpInterfaceEntry
GetIpInterfaceTable
GetIpNetEntry2
GetIpNetTable
GetIpNetTable2
GetIpNetworkConnectionBandwidthEstimates
GetIpPathEntry
GetIpPathTable
GetIpStatistics
GetIpStatisticsEx
GetJobCompartmentId
GetMulticastIpAddressEntry
GetMulticastIpAddressTable
GetNetworkInformation
GetNetworkParams
GetNumberOfInterfaces
GetOwnerModuleFromPidAndInfo
GetOwnerModuleFromTcp6Entry
GetOwnerModuleFromTcpEntry
GetOwnerModuleFromUdp6Entry
GetOwnerModuleFromUdpEntry
GetPerAdapterInfo
GetPerTcp6ConnectionEStats
GetPerTcp6ConnectionStats
GetPerTcpConnectionEStats
GetPerTcpConnectionStats
GetRTTAndHopCount
GetSessionCompartmentId
GetTcp6Table
GetTcp6Table2
GetTcpStatistics
GetTcpStatisticsEx
GetTcpStatisticsEx2
GetTcpTable
GetTcpTable2
GetTeredoPort
GetUdp6Table
GetUdpStatistics
GetUdpStatisticsEx
GetUdpStatisticsEx2
GetUdpTable
GetUniDirectionalAdapterInfo
GetUnicastIpAddressEntry
GetUnicastIpAddressTable
GetWPAOACSupportLevel
Icmp6CreateFile
Icmp6ParseReplies
Icmp6SendEcho2
IcmpCloseHandle
IcmpCreateFile
IcmpParseReplies
IcmpSendEcho
IcmpSendEcho2
IcmpSendEcho2Ex
InitializeCompartmentEntry
InitializeIpForwardEntry
InitializeIpInterfaceEntry
InitializeUnicastIpAddressEntry
InternalCleanupPersistentStore
InternalCreateAnycastIpAddressEntry
InternalCreateIpForwardEntry
InternalCreateIpForwardEntry2
InternalCreateIpNetEntry
InternalCreateIpNetEntry2
InternalCreateUnicastIpAddressEntry
InternalDeleteAnycastIpAddressEntry
InternalDeleteIpForwardEntry
InternalDeleteIpForwardEntry2
InternalDeleteIpNetEntry
InternalDeleteIpNetEntry2
InternalDeleteUnicastIpAddressEntry
InternalFindInterfaceByAddress
InternalGetAnycastIpAddressEntry
InternalGetAnycastIpAddressTable
InternalGetBoundTcp6EndpointTable
InternalGetBoundTcpEndpointTable
InternalGetForwardIpTable2
InternalGetIPPhysicalInterfaceForDestination
InternalGetIfEntry2
InternalGetIfTable
InternalGetIfTable2
InternalGetIpAddrTable
InternalGetIpForwardEntry2
InternalGetIpForwardTable
InternalGetIpInterfaceEntry
InternalGetIpInterfaceTable
InternalGetIpNetEntry2
InternalGetIpNetTable
InternalGetIpNetTable2
InternalGetMulticastIpAddressEntry
InternalGetMulticastIpAddressTable
InternalGetRtcSlotInformation
InternalGetTcp6Table2
InternalGetTcp6TableWithOwnerModule
InternalGetTcp6TableWithOwnerPid
InternalGetTcpTable
InternalGetTcpTable2
InternalGetTcpTableEx
InternalGetTcpTableWithOwnerModule
InternalGetTcpTableWithOwnerPid
InternalGetTunnelPhysicalAdapter
InternalGetUdp6TableWithOwnerModule
InternalGetUdp6TableWithOwnerPid
InternalGetUdpTable
InternalGetUdpTableEx
InternalGetUdpTableWithOwnerModule
InternalGetUdpTableWithOwnerPid
InternalGetUnicastIpAddressEntry
InternalGetUnicastIpAddressTable
InternalIcmpCreateFileEx
InternalSetIfEntry
InternalSetIpForwardEntry
InternalSetIpForwardEntry2
InternalSetIpInterfaceEntry
InternalSetIpNetEntry
InternalSetIpNetEntry2
InternalSetIpStats
InternalSetTcpEntry
InternalSetTeredoPort
InternalSetUnicastIpAddressEntry
IpReleaseAddress
IpRenewAddress
LookupPersistentTcpPortReservation
LookupPersistentUdpPortReservation
NTPTimeToNTFileTime
NTTimeToNTPTime
NhGetGuidFromInterfaceName
NhGetInterfaceDescriptionFromGuid
NhGetInterfaceNameFromDeviceGuid
NhGetInterfaceNameFromGuid
NhpAllocateAndGetInterfaceInfoFromStack
NotifyAddrChange
NotifyCompartmentChange
NotifyIfTimestampConfigChange
NotifyIpInterfaceChange
NotifyRouteChange
NotifyRouteChange2
NotifyStableUnicastIpAddressTable
NotifyTeredoPortChange
NotifyUnicastIpAddressChange
OpenCompartment
ParseNetworkString
PfAddFiltersToInterface
PfAddGlobalFilterToInterface
PfBindInterfaceToIPAddress
PfBindInterfaceToIndex
PfCreateInterface
PfDeleteInterface
PfDeleteLog
PfGetInterfaceStatistics
PfMakeLog
PfRebindFilters
PfRemoveFilterHandles
PfRemoveFiltersFromInterface
PfRemoveGlobalFilterFromInterface
PfSetLogBuffer
PfTestPacket
PfUnBindInterface
ResolveIpNetEntry2
ResolveNeighbor
RestoreMediaSense
SendARP
SetAdapterIpAddress
SetCurrentThreadCompartmentId
SetCurrentThreadCompartmentScope
SetDnsSettings
SetIfEntry
SetInterfaceDnsSettings
SetIpForwardEntry
SetIpForwardEntry2
SetIpInterfaceEntry
SetIpNetEntry
SetIpNetEntry2
SetIpStatistics
SetIpStatisticsEx
SetIpTTL
SetJobCompartmentId
SetNetworkInformation
SetPerTcp6ConnectionEStats
SetPerTcp6ConnectionStats
SetPerTcpConnectionEStats
SetPerTcpConnectionStats
SetSessionCompartmentId
SetTcpEntry
SetUnicastIpAddressEntry
UnenableRouter
do_echo_rep
do_echo_req
if_indextoname
if_nametoindex
register_icmp

Sections

.text
Size: - Virtual size: 86KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.pdata
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 42KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ict
Size: - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.2Qo
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.-zJ
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 544B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 856B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6ef808ed717726657d0f2b2677968909

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

imagehlp

shlwapi

Exports

Exports

Sections

.text Size: - Virtual size: 86KB

.pdata Size: - Virtual size: 4KB

.rdata Size: - Virtual size: 42KB

.data Size: - Virtual size: 33KB

.ict Size: - Virtual size: 1.6MB

.2Qo Size: 3KB - Virtual size: 2KB

.-zJ Size: 2.3MB - Virtual size: 2.3MB

.reloc Size: 1024B - Virtual size: 544B

.rsrc Size: 1024B - Virtual size: 856B

.text
Size: - Virtual size: 86KB

.pdata
Size: - Virtual size: 4KB

.rdata
Size: - Virtual size: 42KB

.data
Size: - Virtual size: 33KB

.ict
Size: - Virtual size: 1.6MB

.2Qo
Size: 3KB - Virtual size: 2KB

.-zJ
Size: 2.3MB - Virtual size: 2.3MB

.reloc
Size: 1024B - Virtual size: 544B

.rsrc
Size: 1024B - Virtual size: 856B