a11b6652884da3f4c2d8246a0c9f13cfe1f216c44417fd67c53bdb4b7640351d

Sharing

Copy URL Twitter E-mail

General

Target

a11b6652884da3f4c2d8246a0c9f13cfe1f216c44417fd67c53bdb4b7640351d
Size

279KB
MD5

c5cb3a0da47eb697627627a4b66da41e
SHA1

41297d582db8037607fc10641a66567b3dc8e601
SHA256

a11b6652884da3f4c2d8246a0c9f13cfe1f216c44417fd67c53bdb4b7640351d
SHA512

016450dc5d64959e3fcb2486c0726ae7325b8cccf8bd0597a49c48afe9239fe87280c59fb029678aede6507bd261a9f256c3f1fa02e8b4df40dccc24223a915b
SSDEEP

6144:z/EuO6b92UUuyqpFbmOfA81ezm7M0ZrqI:z/ROnUUuyqpFbmgAwMMMg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a11b6652884da3f4c2d8246a0c9f13cfe1f216c44417fd67c53bdb4b7640351d

Files

a11b6652884da3f4c2d8246a0c9f13cfe1f216c44417fd67c53bdb4b7640351d
.exe windows:6 windows x86 arch:x86

721322ab759df8bd0482d94ffd9597fb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Git\oldtool\WHMON\bin\WHMON.pdb

Imports

kernel32

GetStdHandle
GetFileAttributesExW
SetConsoleTextAttribute
GetLastError
FindFirstFileA
TerminateProcess
GetLocalTime
CloseHandle
ReleaseMutex
GetTimeZoneInformation
CreateMutexA
DeviceIoControl
CreateFileA
GetNativeSystemInfo
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
GetModuleFileNameA
EncodePointer
DecodePointer
ReadFile
HeapFree
HeapAlloc
IsDebuggerPresent
IsProcessorFeaturePresent
InterlockedDecrement
ExitProcess
GetModuleHandleExW
GetProcAddress
AreFileApisANSI
MultiByteToWideChar
GetCommandLineA
EnterCriticalSection
LeaveCriticalSection
HeapSize
InitializeCriticalSectionAndSpinCount
RtlUnwind
GetConsoleMode
ReadConsoleW
SetLastError
InterlockedIncrement
GetCurrentThreadId
WriteFile
CreateProcessA
WideCharToMultiByte
GetConsoleCP
SetFilePointer
SetFilePointerEx
GetFileType
DeleteCriticalSection
InitOnceExecuteOnce
GetStartupInfoW
RaiseException
GetProcessHeap
UnhandledExceptionFilter
SetUnhandledExceptionFilter
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetCurrentProcess
GetModuleHandleW
FreeLibrary
LoadLibraryExW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
FlushFileBuffers
QueryPerformanceCounter
GetSystemTimeAsFileTime
GetTickCount64
GetEnvironmentStringsW
FreeEnvironmentStringsW
LoadLibraryW
HeapReAlloc
SetStdHandle
OutputDebugStringW
CompareStringEx
GetLocaleInfoEx
GetUserDefaultLocaleName
LCMapStringEx
IsValidLocaleName
EnumSystemLocalesEx
WriteConsoleW
GetStringTypeW
VirtualQuery
CreateFileW
SetEndOfFile
InitializeCriticalSectionEx
GetEnvironmentVariableA
GetExitCodeProcess
Sleep
GetTickCount
GetModuleFileNameW
WaitForSingleObject
SetEnvironmentVariableA

user32

FindWindowA
SendMessageA

shell32

ShellExecuteExA

atkex

EnableDebugMode
ECRam_Access
Smbus_Access
getTab

advapi32

StartServiceA
DeleteService
CloseServiceHandle
OpenServiceA
CreateServiceA
OpenSCManagerA
ControlService

Sections

.text
Size: 194KB - Virtual size: 194KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 7KB - Virtual size: 110KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

721322ab759df8bd0482d94ffd9597fb

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

shell32

atkex

advapi32

Sections

.text Size: 194KB - Virtual size: 194KB

.rdata Size: 39KB - Virtual size: 38KB

.data Size: 7KB - Virtual size: 110KB

.rsrc Size: 512B - Virtual size: 488B

.reloc Size: 37KB - Virtual size: 36KB

.text
Size: 194KB - Virtual size: 194KB

.rdata
Size: 39KB - Virtual size: 38KB

.data
Size: 7KB - Virtual size: 110KB

.rsrc
Size: 512B - Virtual size: 488B

.reloc
Size: 37KB - Virtual size: 36KB