12a558c4314b54560080512c5fd4e6a5e19a0a0a8d5bb773cef5643e86ecfeef[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

12a558c4314b54560080512c5fd4e6a5e19a0a0a8d5bb773cef5643e86ecfeef.exe
Size

1.4MB
MD5

3853b99a1f2f24db0c61880d8a1dff64
SHA1

eebbeef71cde9c9c62b4b152aa1483e0c3372bcc
SHA256

12a558c4314b54560080512c5fd4e6a5e19a0a0a8d5bb773cef5643e86ecfeef
SHA512

97833b7b4c76e6b060144dc1e99fe8012579165c9000f99ccff37b194ab4aaf53afd1f489e6cd3f9916018ec071a9ae9cd9cadc6693fcf610a9bcc9c1abe0719
SSDEEP

24576:yev/NjlmWizGr0mqH5bhZTU5IsHcf7WgSoAa/Qn652FOe5nGT:vjlmPGomqlhZTU5xHS7WgSoAaC/tnGT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
12a558c4314b54560080512c5fd4e6a5e19a0a0a8d5bb773cef5643e86ecfeef.exe

Files

12a558c4314b54560080512c5fd4e6a5e19a0a0a8d5bb773cef5643e86ecfeef.exe
.exe windows:6 windows x64 arch:x64

7eb65afcd30fd9b210055bc633bffbd8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\Rust\loader\target\release\deps\loader.pdb

Imports

kernel32

SetHandleInformation
GetModuleHandleA
GetProcAddress
GetCurrentThread
GetStdHandle
GetConsoleMode
GetCurrentThreadId
WaitForSingleObject
MultiByteToWideChar
WriteConsoleW
QueryPerformanceFrequency
GetModuleHandleW
FormatMessageW
GetCurrentProcess
GetEnvironmentVariableW
GetFinalPathNameByHandleW
SetFileCompletionNotificationModes
PostQueuedCompletionStatus
SetLastError
CreateThread
TryAcquireSRWLockExclusive
QueryPerformanceCounter
GetCurrentDirectoryW
RtlCaptureContext
RtlLookupFunctionEntry
GetCurrentProcessId
CreateMutexA
WaitForSingleObjectEx
LoadLibraryA
ReleaseMutex
RtlVirtualUnwind
AcquireSRWLockShared
ReleaseSRWLockShared
WakeConditionVariable
SleepConditionVariableSRW
GetSystemTimeAsFileTime
GetQueuedCompletionStatusEx
InitializeSListHead
IsDebuggerPresent
WakeAllConditionVariable
HeapCreate
GetLastError
CreateIoCompletionPort
SetThreadStackGuarantee
AddVectoredExceptionHandler
SwitchToThread
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
HeapReAlloc
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
HeapFree
CloseHandle
HeapAlloc
GetProcessHeap

bcrypt

BCryptGenRandom

ws2_32

freeaddrinfo
getsockopt
connect
bind
WSAIoctl
ioctlsocket
WSASocketW
setsockopt
WSACleanup
shutdown
closesocket
recv
send
WSASend
getpeername
getaddrinfo
getsockname
WSAGetLastError
WSAStartup

ntdll

RtlNtStatusToDosError
NtCreateFile
NtCancelIoFileEx
NtDeviceIoControlFile
NtWriteFile

crypt32

CertDuplicateCertificateContext
CertAddCertificateContextToStore
CertCloseStore
CertEnumCertificatesInStore
CertDuplicateStore
CertDuplicateCertificateChain
CertFreeCertificateChain
CertVerifyCertificateChainPolicy
CertFreeCertificateContext
CertOpenStore
CertGetCertificateChain

secur32

ApplyControlToken
EncryptMessage
DeleteSecurityContext
FreeCredentialsHandle
AcquireCredentialsHandleA
DecryptMessage
InitializeSecurityContextW
AcceptSecurityContext
QueryContextAttributesW
FreeContextBuffer

advapi32

RegQueryValueExW
RegCloseKey
RegOpenKeyExW
SystemFunction036

vcruntime140

__C_specific_handler
memcmp
memset
__current_exception_context
__current_exception
memcpy
memmove
__CxxFrameHandler3

api-ms-win-crt-runtime-l1-1-0

__p___argc
__p___argv
_cexit
_exit
_get_initial_narrow_environment
_register_thread_local_exe_atexit_callback
exit
_initterm_e
_initialize_narrow_environment
_set_app_type
_initialize_onexit_table
_register_onexit_function
_initterm
_c_exit
_seh_filter_exe
_crt_atexit
_configure_narrow_argv
terminate

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode
free

Sections

.text
Size: 1.0MB - Virtual size: 1.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 416KB - Virtual size: 416KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 808B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7eb65afcd30fd9b210055bc633bffbd8

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

bcrypt

ws2_32

ntdll

crypt32

secur32

advapi32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 1.0MB - Virtual size: 1.0MB

.rdata Size: 416KB - Virtual size: 416KB

.data Size: 512B - Virtual size: 808B

.pdata Size: 17KB - Virtual size: 16KB

.reloc Size: 7KB - Virtual size: 6KB

.text
Size: 1.0MB - Virtual size: 1.0MB

.rdata
Size: 416KB - Virtual size: 416KB

.data
Size: 512B - Virtual size: 808B

.pdata
Size: 17KB - Virtual size: 16KB

.reloc
Size: 7KB - Virtual size: 6KB