bb389b8e582c01b96b6143962831f810N[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

bb389b8e582c01b96b6143962831f810N.exe
Size

101KB
MD5

bb389b8e582c01b96b6143962831f810
SHA1

3ef37977ce55ced2b386d2bd23d13eb51d65bed3
SHA256

bfc61783e9c02c0f7afd2f37cf54fd1c89a98d8dea970a28b85e9fead216c1a1
SHA512

13fef833b6e55187799c8de3bbe5cbc6f9b1eedec9020994a91c58999e7cb96745b27bd3098d14dc44303bf043ace0d5932c52f5cd06d49b2045d854f63c7b1c
SSDEEP

1536:/+JM5sEmb2mOysSV+KXI9RD0ARU0z1v09zYTRMjLiN7tMAVTB7CNAT:Tq24VSD0ARU0xaYlMPiLMA1B7L

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bb389b8e582c01b96b6143962831f810N.exe

Files

bb389b8e582c01b96b6143962831f810N.exe
.exe windows:10 windows x64 arch:x64

3b2108530cac6f7c09c7743186a4975c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

AssignedAccessGuard.pdb

Imports

advapi32

RegGetValueW
RegOpenKeyExW
RegCloseKey
RegQueryValueExW
RegCreateKeyExW
RegSetValueExW
EventWriteTransfer
EventUnregister
EventSetInformation
EventRegister
ConvertSidToStringSidW
GetTokenInformation
EventActivityIdControl

kernel32

OutputDebugStringW
WaitForSingleObjectEx
OpenSemaphoreW
CloseHandle
HeapAlloc
GetProcAddress
CreateMutexExW
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
DebugBreak
IsDebuggerPresent
GetFileAttributesW
CompareStringW
FormatMessageW
CreateProcessW
LocalAlloc
GetFullPathNameW
ExpandEnvironmentStringsW
OpenProcess
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
CreateThread
ResumeThread
ReleaseSRWLockShared
AcquireSRWLockShared
RegisterWaitForSingleObject
SetEvent
CreateEventExW
UnregisterWaitEx
GetExitCodeProcess
lstrcmpA
SetProcessShutdownParameters
Sleep
InitOnceBeginInitialize
InitOnceComplete
GetCommandLineW
GetModuleFileNameA
CreateSemaphoreExW
InterlockedPushEntrySList
GetLastError
ReleaseMutex
GetCurrentThreadId
WaitForSingleObject
GetModuleHandleExW
ReleaseSemaphore
SetLastError
HeapFree
LocalFree

user32

GetSysColor
EndPaint
DestroyWindow
BeginPaint
SetWindowPos
MoveWindow
TranslateMessage
GetClientRect
PostQuitMessage
DispatchMessageW
WaitMessage
GetWindowLongPtrW
LoadStringW
PostMessageW
SetWindowLongW
ShowWindow
UpdateWindow
LoadCursorW
RegisterClassExW
CreateWindowExW
SetWindowLongPtrW
PeekMessageW
DefWindowProcW

msvcp_win

?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e
_register_thread_local_exe_atexit_callback
_c_exit

api-ms-win-crt-private-l1-1-0

_o___stdio_common_vswprintf
_o__callnewh
_o__cexit
_o__configthreadlocale
_o__configure_wide_argv
_o__crt_atexit
_o__errno
_o__exit
_o__get_wide_winmain_command_line
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
_o__wcsicmp
_o_exit
_o_free
_o_iswspace
_o_malloc
_o_terminate
_o_wcscat_s
_o_wcscpy_s
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
__std_terminate
__CxxFrameHandler4
_o___std_exception_destroy
_o___std_exception_copy
_o___p__commode
_o___stdio_common_vsnprintf_s
memcpy
memmove

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-core-path-l1-1-0

PathCchAppend

crypt32

CertCloseStore
CryptQueryObject
CertGetCertificateChain
CertVerifyCertificateChainPolicy
CryptDecodeObject
CertFindCertificateInStore
CryptMsgGetParam
CertFreeCertificateChain
CertFreeCertificateContext
CryptMsgClose

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString
WindowsCreateStringReference
WindowsCreateString
WindowsGetStringRawBuffer

api-ms-win-core-winrt-l1-1-0

RoUninitialize
RoInitialize
RoGetActivationFactory

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcess
GetStartupInfoW

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

shlwapi

ord197

oleaut32

SysStringLen
SysFreeString

api-ms-win-core-winrt-error-l1-1-0

SetRestrictedErrorInfo
GetRestrictedErrorInfo

api-ms-win-core-winrt-error-l1-1-1

RoOriginateLanguageException

api-ms-win-core-com-l1-1-0

CoIncrementMTAUsage

Sections

.text
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 324B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3b2108530cac6f7c09c7743186a4975c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

user32

msvcp_win

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-core-path-l1-1-0

crypt32

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

shlwapi

oleaut32

api-ms-win-core-winrt-error-l1-1-0

api-ms-win-core-winrt-error-l1-1-1

api-ms-win-core-com-l1-1-0

Sections

.text Size: 68KB - Virtual size: 67KB

.rdata Size: 24KB - Virtual size: 23KB

.data Size: 2KB - Virtual size: 4KB

.pdata Size: 4KB - Virtual size: 3KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 324B

.text
Size: 68KB - Virtual size: 67KB

.rdata
Size: 24KB - Virtual size: 23KB

.data
Size: 2KB - Virtual size: 4KB

.pdata
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 324B