8559893f21a51a7012d811d2cff52a82e1a7e468af4a64e419d92864f5f47c26

Sharing

Copy URL Twitter E-mail

General

Target

8559893f21a51a7012d811d2cff52a82e1a7e468af4a64e419d92864f5f47c26
Size

1.6MB
MD5

0a90baeee118abe7468f7b9c115d6aad
SHA1

2c556a5d641716f7bed067992e3c58d37d4f9139
SHA256

8559893f21a51a7012d811d2cff52a82e1a7e468af4a64e419d92864f5f47c26
SHA512

10311bf724c2641e4b6a52fe53b73ec1fe84d3982e5d8f905f697b61250ffd82d2aaa5ae05660fb0f820824a87c6f7a546af4a292fe3885ab06cea5809b22ca0
SSDEEP

24576:eRv5tjVRv5tjg5GDGPU95BuwFv+diaC8/ZQD:8rc0DGPU9V4Y8mD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8559893f21a51a7012d811d2cff52a82e1a7e468af4a64e419d92864f5f47c26

Files

8559893f21a51a7012d811d2cff52a82e1a7e468af4a64e419d92864f5f47c26
.exe windows:6 windows x64 arch:x64

db2d3a5b75d43bfee6978a2fac633052

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\a\_work\2\b\Release\x64\bin\Win10GuideBrokerExe\PCHealthCheckBroker.pdb

Imports

wevtapi

EvtCreateRenderContext
EvtClose
EvtRender
EvtNext
EvtQuery

kernel32

GetSystemTimeAsFileTime
OutputDebugStringW
GetCurrentThreadId
FormatMessageW
IsDebuggerPresent
GetLastError
InitOnceBeginInitialize
InitOnceComplete
GetModuleFileNameA
CreateSemaphoreExW
HeapFree
SetLastError
ReleaseSemaphore
InitializeSListHead
WaitForSingleObject
ReleaseMutex
WaitForSingleObjectEx
OpenSemaphoreW
CloseHandle
HeapAlloc
GetProcAddress
CreateMutexExW
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
DebugBreak
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
GetCurrentProcess
GetModuleHandleExW
TerminateProcess
QueryPerformanceCounter
GetStartupInfoW
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
RtlCaptureContext

advapi32

EventSetInformation
EventWriteTransfer
EventUnregister
EventRegister

ole32

CoInitializeEx
CoUninitialize

msvcp140

?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_copy
__std_exception_destroy
__C_specific_handler
__std_terminate
__current_exception_context
memset
_CxxThrowException
memcpy
memmove
__current_exception

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf
__stdio_common_vsnprintf_s
_set_fmode
__p__commode

api-ms-win-crt-convert-l1-1-0

_wtoi

api-ms-win-crt-runtime-l1-1-0

_cexit
_initialize_onexit_table
_seh_filter_exe
_set_app_type
_configure_wide_argv
_initialize_wide_environment
_get_wide_winmain_command_line
_initterm
exit
_exit
_c_exit
_register_thread_local_exe_atexit_callback
_crt_atexit
_errno
_invalid_parameter_noinfo
_invalid_parameter_noinfo_noreturn
terminate
__p___wargv
_initterm_e
_register_onexit_function
__p___argc

api-ms-win-crt-heap-l1-1-0

_set_new_mode
free
malloc
_callnewh

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-string-l1-1-0

wcscmp

Sections

.text
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 123KB - Virtual size: 122KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.4MB - Virtual size: 1.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

db2d3a5b75d43bfee6978a2fac633052

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

wevtapi

kernel32

advapi32

ole32

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-string-l1-1-0

Sections

.text Size: 26KB - Virtual size: 25KB

.rdata Size: 11KB - Virtual size: 11KB

.data Size: 1024B - Virtual size: 2KB

.pdata Size: 2KB - Virtual size: 1KB

.rsrc Size: 123KB - Virtual size: 122KB

.reloc Size: 1.4MB - Virtual size: 1.4MB

.text
Size: 26KB - Virtual size: 25KB

.rdata
Size: 11KB - Virtual size: 11KB

.data
Size: 1024B - Virtual size: 2KB

.pdata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 123KB - Virtual size: 122KB

.reloc
Size: 1.4MB - Virtual size: 1.4MB