763f9c7a5fddde308bcd0a70e6756f00N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

763f9c7a5fddde308bcd0a70e6756f00N.exe
Size

70KB
MD5

763f9c7a5fddde308bcd0a70e6756f00
SHA1

3efdde5dbc9654aab9c1aebc58f5dd63a8f8a4e5
SHA256

591557e1e18628cdbc6673cc09950dab6dd94149c7df874d95751a771006edfa
SHA512

ea9b3c0b78935d4052387b210368c2e1f79aa055ec586e8a83ff2a26efee0c1a762a59b0a4a48316947040f54330002346dab30f1a5e6c3b6c2c937c858476ab
SSDEEP

1536:X4DwUxsFeEK/KemjbcPlAjzVhB6Ul0idIdFGCq2iW7z:X4DwGsFeb2cPlAjN6crd+GCH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
763f9c7a5fddde308bcd0a70e6756f00N.exe

Files

763f9c7a5fddde308bcd0a70e6756f00N.exe
.exe windows:6 windows x86 arch:x86

c87f309c356f1c47dc02b5d96267d06c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\a\1\s\Win32\Release\idevicebackup2.pdb

Imports

kernel32

FindFirstFileExW
GetFullPathNameW
FindNextFileW
FindClose
GetLastError
QueryPerformanceFrequency
DeleteFileA
RemoveDirectoryA
GetDiskFreeSpaceExA
CreateDirectoryA
QueryPerformanceCounter
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetModuleHandleW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId

imobiledevice

idevice_free
afc_dictionary_free
instproxy_browse
diagnostics_relay_client_start_service
lockdownd_client_new_with_handshake
lockdownd_service_descriptor_free
sbservices_client_free
np_client_new
afc_remove_path
mobilebackup2_client_free
instproxy_client_options_new
diagnostics_relay_query_mobilegestalt
instproxy_client_options_set_return_attributes
afc_client_new
lockdownd_start_service_with_escrow_bag
afc_client_free
mobilebackup2_client_new
instproxy_client_free
afc_file_open
np_set_notify_callback
lockdownd_get_value
lockdownd_start_service
afc_get_file_info
lockdownd_client_free
idevice_new_with_options
idevice_set_debug_level
afc_make_directory
mobilebackup2_send_status_response
diagnostics_relay_client_free
instproxy_client_options_add
np_post_notification
sbservices_client_start_service
mobilebackup2_receive_raw
np_observe_notifications
afc_file_write
instproxy_client_options_free
afc_file_close
mobilebackup2_send_message
afc_file_read
np_client_free
diagnostics_relay_goodbye
mobilebackup2_send_request
mobilebackup2_send_raw
instproxy_client_start_service
sbservices_get_icon_pngdata
mobilebackup2_version_exchange
afc_file_lock
mobilebackup2_receive_message
idevice_get_udid

plist

plist_get_bool_val
plist_array_get_item
plist_get_string_val
plist_get_uint_val
plist_free
plist_new_array
plist_array_append_item
plist_new_dict
plist_access_path
plist_copy
plist_new_bool
plist_new_date
plist_dict_get_size
plist_new_uint
plist_new_data
plist_dict_set_item
plist_new_string
plist_dict_get_item
plist_dict_next_item
plist_from_xml
plist_get_real_val
plist_dict_new_iter
plist_from_bin
plist_to_xml
plist_array_get_size
plist_get_node_type

vcruntime140

memcpy
strchr
__current_exception
__current_exception_context
memset
_except_handler4_common
strrchr

api-ms-win-crt-stdio-l1-1-0

fseek
fclose
fopen
ftell
rewind
__p__commode
fwrite
__stdio_common_vsprintf
fread
fputc
fflush
fputs
__stdio_common_vsscanf
_set_fmode
__stdio_common_vfprintf
__acrt_iob_func

api-ms-win-crt-utility-l1-1-0

srand
rand

api-ms-win-crt-string-l1-1-0

isprint
toupper
_strdup

api-ms-win-crt-heap-l1-1-0

malloc
_set_new_mode
free

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-runtime-l1-1-0

_cexit
__p___argv
__p___argc
terminate
_exit
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_set_app_type
_seh_filter_exe
strerror
signal
_controlfp_s
_errno
_crt_atexit
_set_errno
_c_exit
_register_onexit_function
_initialize_onexit_table
_register_thread_local_exe_atexit_callback

api-ms-win-crt-convert-l1-1-0

atol
wcstombs_s
mbstowcs_s

api-ms-win-crt-filesystem-l1-1-0

_stat64i32
_stat64
rename

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-conio-l1-1-0

_getch

Sections

.text
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

��uF
Size: 16KB - Virtual size: 20KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

c87f309c356f1c47dc02b5d96267d06c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

imobiledevice

plist

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-conio-l1-1-0

Sections

.text Size: 31KB - Virtual size: 30KB

.rdata Size: 18KB - Virtual size: 17KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 3KB - Virtual size: 2KB

����uF Size: 16KB - Virtual size: 20KB

.text
Size: 31KB - Virtual size: 30KB

.rdata
Size: 18KB - Virtual size: 17KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 3KB - Virtual size: 2KB

��uF
Size: 16KB - Virtual size: 20KB