7da8069b95932632ba864e0e1a0f08f392752c28c6645f747ddfb9906b4b3b6e[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

7da8069b95932632ba864e0e1a0f08f392752c28c6645f747ddfb9906b4b3b6e.exe
Size

9.6MB
MD5

58a0e58ca1ebc303fe7bff44bd03544b
SHA1

6beb5ba2f5a5368f01a9c1a8c02199bc511284bb
SHA256

7da8069b95932632ba864e0e1a0f08f392752c28c6645f747ddfb9906b4b3b6e
SHA512

29a167b96e12e870dfe9c6c6c1959211f6346301c9fb33634644014fdaf87ba13c4407f71b0776ff7d817f1cb1f2bdf3c7c7cdf1c74831d89b5bde1dffed3cea
SSDEEP

98304:08+payKTL8+OQmyhcKlsEyCq28p+FeTo6Nn:0jVKrOQmIc6sEyCqRyeToCn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7da8069b95932632ba864e0e1a0f08f392752c28c6645f747ddfb9906b4b3b6e.exe

Files

7da8069b95932632ba864e0e1a0f08f392752c28c6645f747ddfb9906b4b3b6e.exe
.dll windows:6 windows x64 arch:x64

ab5e2e36c1e62672dddd7b4d2e5d81d4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

LCMapStringW
IsDBCSLeadByte
GetACP
GetCPInfo
SetConsoleTitleW
AllocConsole
FreeConsole
GetTempFileNameW
GetTempPathW
MoveFileExW
MoveFileW
FlushFileBuffers
CompareFileTime
GetFileTime
QueryInformationJobObject
IsProcessInJob
VirtualUnlock
SetThreadAffinityMask
SetThreadGroupAffinity
GetWriteWatch
ResetWriteWatch
SetThreadIdealProcessor
VerifyVersionInfoW
DeleteFileW
GetUserDefaultLCID
GetSystemDefaultLCID
ConnectNamedPipe
CreateNamedPipeW
DisconnectNamedPipe
GetPrivateProfileIntW
SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolTimer
CreateMemoryResourceNotification
GetSystemTimeAsFileTime
InterlockedFlushSList
InitializeSListHead
InterlockedPopEntrySList
PeekNamedPipe
GetProcessTimes
LeaveCriticalSection
EnterCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
RemoveVectoredExceptionHandler
AddVectoredExceptionHandler
TerminateProcess
UnhandledExceptionFilter
CopyContext
SetXStateFeaturesMask
InitializeContext
GetEnabledXStateFeatures
SetThreadContext
GetThreadContext
ResetEvent
GetFileAttributesExW
ReadFile
SetFilePointer
GetThreadTimes
SuspendThread
Sleep
IsThreadAFiber
SetThreadStackGuarantee
SignalObjectAndWait
GetThreadPriority
SetThreadPriority
WaitForSingleObjectEx
DuplicateHandle
FreeEnvironmentStringsW
FindFirstFileW
FindClose
GetSystemDirectoryW
CreateActCtxW
ActivateActCtx
DeactivateActCtx
GetWindowsDirectoryW
ReleaseActCtx
SizeofResource
LockResource
FindResourceExW
LoadResource
FindNextFileW
GetEnvironmentVariableA
CreateProcessW
QueryActCtxW
LoadLibraryW
EncodePointer
DecodePointer
EnumTimeFormatsW
CompareStringW
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
EnumCalendarInfoExW
GetLocaleInfoW
GetCalendarInfoW
GetDateFormatW
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
LoadLibraryA
MapViewOfFile
HeapReAlloc
LocalAlloc
LoadLibraryExA
SetFileAttributesW
CopyFileW
RemoveDirectoryW
GetFileSizeEx
SetEndOfFile
GetSystemDirectoryA
CreateFileA
SetFileTime
WritePrivateProfileStringW
DeviceIoControl
FindResourceW
GetLocalTime
GetVolumeInformationW
LocalFileTimeToFileTime
DosDateTimeToFileTime
SystemTimeToFileTime
lstrlenA
GetDiskFreeSpaceA
GetWindowsDirectoryA
GetTimeFormatW
GetSystemTime
FlushViewOfFile
GetNativeSystemInfo
IsDBCSLeadByteEx
GetStringTypeW
CreateHardLinkW
SetPriorityClass
SetFilePointerEx
ExitThread
OpenFileMappingW
SearchPathW
GetTimeZoneInformation
GetNLSVersionEx
IsValidLocale
TzSpecificLocalTimeToSystemTime
FileTimeToSystemTime
GetConsoleTitleW
GetVersionExW
MultiByteToWideChar
FormatMessageW
ExitProcess
LoadLibraryExW
GetModuleFileNameW
GetModuleHandleExW
GetDriveTypeW
GetLastError
GetTickCount
SetEvent
GetCurrentProcessorNumber
QueueUserAPC
CloseHandle
WaitForSingleObject
GlobalMemoryStatusEx
CreateIoCompletionPort
GetProcAddress
SetLastError
GetThreadLocale
QueryPerformanceCounter
QueryPerformanceFrequency
PostQueuedCompletionStatus
FlushProcessWriteBuffers
CreateThread
ResumeThread
SleepEx
WaitForMultipleObjectsEx
GetQueuedCompletionStatus
GetCurrentThread
OutputDebugStringW
DebugBreak
GetCurrentProcess
ReleaseMutex
ReleaseSemaphore
CreateMutexW
CreateEventW
CreateSemaphoreW
LocalFree
GetCurrentProcessId
OpenProcess
GetModuleHandleW
ProcessIdToSessionId
GetCurrentThreadId
SetConsoleCtrlHandler
GetTickCount64
GetCommandLineW
GetCurrentDirectoryW
lstrlenW
GetFullPathNameW
GetShortPathNameW
GetLongPathNameW
GetSystemInfo
TlsGetValue
GetUserDefaultLangID
GetEnvironmentVariableW
SetEnvironmentVariableW
GetProcessId
GetOverlappedResult
CancelIo
GetProcessHeap
HeapFree
InterlockedPushEntrySList
WriteFile
GetStdHandle
WideCharToMultiByte
GetConsoleOutputCP
GetFileInformationByHandle
GetFileAttributesW
CreateDirectoryW
GetLogicalProcessorInformation
GetProcessAffinityMask
SetThreadLocale
MapViewOfFileEx
VirtualQuery
UnmapViewOfFile
SetErrorMode
FreeLibrary
FreeLibraryAndExitThread
IsDebuggerPresent
RaiseException
GetStringTypeExW
CreateFileMappingW
GetFileSize
TlsSetValue
GetModuleHandleA
TlsAlloc
TlsFree
HeapAlloc
FlushInstructionCache
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
CreateFileW
WaitNamedPipeW
SetNamedPipeHandleState
OpenEventW
TransactNamedPipe
VirtualAlloc
VirtualFree
VirtualProtect
HeapCreate
HeapDestroy
HeapValidate
SwitchToThread
GetEnvironmentStringsW

vcruntime140_1_clr0400

__CxxFrameHandler4

vcruntime140_clr0400

_CxxThrowException
wcsrchr
memcpy
__C_specific_handler
_purecall
memcmp
strchr
wcsstr
strrchr
wcschr
__current_exception
__current_exception_context
__std_type_info_destroy_list
memset
memchr
memmove

ucrtbase_clr0400

__stdio_common_vswprintf_p
_wcsnicmp
_ltow_s
wcsnlen
_atoi64
_time64
_strdup
fopen
fwrite
__stdio_common_vsnprintf_s
fclose
_cexit
_wfopen
toupper
wcsncmp
wcscmp
isalpha
strncpy_s
fflush
_copysign
_isnan
_finite
modf
modff
towupper
_invalid_parameter_noinfo
__stdio_common_vswscanf
towlower
iswupper
_wtoi
__acrt_iob_func
_wcstoui64
_errno
__stdio_common_vsscanf
isdigit
_strnicmp
atol
iswspace
wcstoul
iswascii
wcsncat_s
_wcslwr_s
__stdio_common_vsnwprintf_s
__stdio_common_vsprintf_s
strcat_s
__stdio_common_vfprintf
strcpy_s
strncmp
qsort
_controlfp_s
__stdio_common_vsprintf
_wcsicmp
strcmp
strlen
_itow_s
__stdio_common_vswprintf_s
_stricmp
__stdio_common_vswprintf
wcsncpy_s
wcscat_s
wcscpy_s
__stdio_common_vfwprintf
terminate
sinh
_flushall
_putws
strncat_s
wcstok_s
bsearch
_initterm
_initterm_e
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
isxdigit
malloc
free
atoi
strtoul
_wmakepath_s
_wsplitpath_s
wmemcpy_s
iswxdigit
iswdigit
isupper
_ecvt
fopen_s
strnlen
fputs
acos
asin
atan
atan2
ceil
cosh
exp
floor
fmod
log
log10
pow
tanh

ntdll

RtlEnterCriticalSection
RtlDeleteCriticalSection
RtlInitializeCriticalSection
vDbgPrintExWithPrefix
NtYieldExecution
RtlNtStatusToDosError
RtlVirtualUnwind
VerSetConditionMask
RtlUnwindEx
RtlInstallFunctionTableCallback
RtlRestoreContext
RtlLookupFunctionEntry
RtlCaptureContext
RtlDeleteFunctionTable
RtlLeaveCriticalSection

user32

DispatchMessageW
PeekMessageW
MsgWaitForMultipleObjectsEx
TranslateMessage
GetDesktopWindow
LoadStringW
GetUserObjectInformationW
GetProcessWindowStation
InSendMessage
GetFocus

shlwapi

PathCreateFromUrlW
UrlCanonicalizeW
PathAddBackslashW
UrlUnescapeW
StrCmpW
StrStrW
UrlCombineW
PathIsURLW
UrlGetPartW
StrRChrW
PathRemoveExtensionW
PathRemoveFileSpecW
StrChrW
StrToIntW
StrCmpNW
PathFindExtensionW
PathIsRelativeW
PathRemoveBackslashW
UrlEscapeW
PathIsUNCW
UrlIsW
PathCanonicalizeW
PathFindFileNameW
PathCombineW

advapi32

CryptSetProvParam
CryptEncrypt
CryptGetDefaultProviderW
CryptDecrypt
CryptDeriveKey
CryptSetKeyParam
DeleteAce
SaferCloseLevel
SetTokenInformation
CreateWellKnownSid
ConvertStringSidToSidW
SaferCreateLevel
AddAccessAllowedAceEx
SaferComputeTokenFromLevel
CryptVerifySignatureW
LookupAccountSidW
CryptEnumProvidersW
CryptGenKey
GetNamedSecurityInfoW
CryptSignHashW
CryptVerifySignatureA
CryptSetHashParam
RegQueryInfoKeyA
RegDeleteValueW
IsValidSid
GetSidIdentifierAuthority
CryptGetKeyParam
CryptImportKey
CryptGetProvParam
CryptAcquireContextA
CryptDestroyKey
CryptGetUserKey
CryptExportKey
CryptCreateHash
CryptHashData
CryptDestroyHash
CryptGetHashParam
CopySid
DuplicateToken
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegDeleteKeyW
RegCreateKeyExW
RegSetValueExW
RegEnumValueW
GetSidSubAuthorityCount
GetSidSubAuthority
AddAccessAllowedAce
GetLengthSid
ImpersonateLoggedOnUser
RegQueryInfoKeyW
EventWriteTransfer
RegQueryValueW
RegOpenKeyExW
CryptReleaseContext
CryptGenRandom
CryptAcquireContextW
EventUnregister
EventRegister
SetThreadToken
RevertToSelf
GetAce
InitializeAcl
GetSecurityDescriptorDacl
SetKernelObjectSecurity
RegQueryValueExW
RegEnumKeyExW
RegCloseKey
OpenThreadToken
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
FreeSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetEntriesInAclW
AllocateAndInitializeSid
GetTokenInformation
OpenProcessToken
EventWrite

Exports

Exports

AttachProfiler
CertCreateAuthenticodeLicense
CertFreeAuthenticodeSignerInfo
CertFreeAuthenticodeTimestamperInfo
CertTimestampAuthenticodeLicense
CertVerifyAuthenticodeLicense
ClearDownloadCache
ClrCreateManagedInstance
CoEEShutDownCOM
CoInitializeCor
CoInitializeEE
CoUninitializeCor
CoUninitializeEE
CompareAssemblyIdentity
CompareAssemblyIdentityWithConfig
CopyPDBs
CorDllMainForThunk
CorExitProcess
CorLaunchApplication
CorMarkThreadInThreadPool
CreateActContext
CreateApplicationContext
CreateAssemblyCache
CreateAssemblyConfigCookie
CreateAssemblyEnum
CreateAssemblyNameObject
CreateCMSFromXml
CreateHistoryReader
CreateInstallReferenceEnum
DeleteShadowCache
DestroyAssemblyConfigCookie
DllCanUnloadNowInternal
DllGetActivationFactoryImpl
DllGetClassObjectInternal
DllRegisterServerInternal
DllUnregisterServerInternal
EEDllRegisterServer
EEDllUnregisterServer
GC_Initialize
GC_IsCompatibleWithRuntime
GetAddrOfContractShutoffFlag
GetAppIdAuthority
GetAssemblyIdentityFromFile
GetAssemblyMDImport
GetCLRFunction
GetCLRIdentityManager
GetCachePath
GetClassActivatorForApplicationImpl
GetHashFromAssemblyFile
GetHashFromAssemblyFileW
GetHashFromBlob
GetHashFromFile
GetHashFromFileW
GetHashFromHandle
GetHistoryFileDirectory
GetIdentityAuthority
GetMetaDataInternalInterface
GetMetaDataInternalInterfaceFromPublic
GetMetaDataPublicInterfaceFromInternal
GetPermissionRequests
GetPrivateContextsPerfCounters
GetRuntimeStackWalkInfo
GetUserStateManager
GetUserStore
IEE
InitializeFusion
InstallCustomModule
IsOS
LegacyNGenCompile
LegacyNGenCreateZapper
LegacyNGenFreeZapper
LegacyNGenTryEnumerateFusionCache
LoadStringRC
LoadStringRCEx
LogHelp_LogAssert
LogHelp_NoGuiOnAssert
LogHelp_TerminateOnAssert
LookupHistoryAssembly
MetaDataGetDispenser
NGenCreateNGenWorker
NukeDownloadedCache
ParseManifest
PostErrorVA
PreBindAssembly
PreBindAssemblyEx
ReOpenMetaDataWithMemory
ReOpenMetaDataWithMemoryEx
SetMSIHandleForLogging
SetRuntimeInfo
StrongNameCompareAssemblies
StrongNameDigestEmbed
StrongNameDigestGenerate
StrongNameDigestSign
StrongNameErrorInfo
StrongNameFreeBuffer
StrongNameGetBlob
StrongNameGetBlobFromImage
StrongNameGetPublicKey
StrongNameGetPublicKeyEx
StrongNameHashSize
StrongNameKeyDelete
StrongNameKeyGen
StrongNameKeyGenEx
StrongNameKeyInstall
StrongNameSignatureGeneration
StrongNameSignatureGenerationEx
StrongNameSignatureSize
StrongNameSignatureVerification
StrongNameSignatureVerificationEx
StrongNameSignatureVerificationEx2
StrongNameSignatureVerificationFromImage
StrongNameTokenFromAssembly
StrongNameTokenFromAssemblyEx
StrongNameTokenFromPublicKey
TranslateSecurityAttributes
_AxlGetIssuerPublicKeyHash
_AxlPublicKeyBlobToPublicKeyToken
_AxlRSAKeyValueToPublicKeyToken
_CorDllMain
_CorExeMain
_CorExeMain2

Sections

.text
Size: 7.2MB - Virtual size: 7.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 112KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 352KB - Virtual size: 352KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 56KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ab5e2e36c1e62672dddd7b4d2e5d81d4

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

vcruntime140_1_clr0400

vcruntime140_clr0400

ucrtbase_clr0400

ntdll

user32

shlwapi

advapi32

Exports

Exports

Sections

.text Size: 7.2MB - Virtual size: 7.2MB

.rdata Size: 1.8MB - Virtual size: 1.8MB

.data Size: 112KB - Virtual size: 112KB

.pdata Size: 352KB - Virtual size: 352KB

.didat Size: 4KB - Virtual size: 4KB

_RDATA Size: 68KB - Virtual size: 68KB

.rsrc Size: 4KB - Virtual size: 4KB

.reloc Size: 56KB - Virtual size: 56KB

.text
Size: 7.2MB - Virtual size: 7.2MB

.rdata
Size: 1.8MB - Virtual size: 1.8MB

.data
Size: 112KB - Virtual size: 112KB

.pdata
Size: 352KB - Virtual size: 352KB

.didat
Size: 4KB - Virtual size: 4KB

_RDATA
Size: 68KB - Virtual size: 68KB

.rsrc
Size: 4KB - Virtual size: 4KB

.reloc
Size: 56KB - Virtual size: 56KB