2ed092887f1a3c6f33990599bdc6cce0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

2ed092887f1a3c6f33990599bdc6cce0N.exe
Size

232KB
MD5

2ed092887f1a3c6f33990599bdc6cce0
SHA1

31b7cf4c417409a68014441cb794cb4047ae6444
SHA256

f402e2427947b0584a48e9a3d7db5910b29e0981abe715ade40d37e0b4c98cfb
SHA512

cf409ff6c8787790d0dc68f6572100e9ccea8895f4cc11c32f9bb8db2880f7246c4d43952943afced486a8c64df3a50d75cccc2c8699c3911c6b72cc7d05ee79
SSDEEP

3072:NVP/QXkdWAbjvl9W1yFc/aqIL5DSl5Fj2LMyvWUYDh3IeObvrQsO:NVP8koOvn7W5FjvguN3HOrbO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2ed092887f1a3c6f33990599bdc6cce0N.exe

Files

2ed092887f1a3c6f33990599bdc6cce0N.exe
.dll windows:10 windows x64 arch:x64

cfb1c964cccc2e4e07ca91650dc263f9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

onex.pdb

Imports

msvcrt

wcsnlen
_XcptFilter
_amsg_exit
memcmp
_initterm
__C_specific_handler
memcpy
malloc
free
wcscat_s
wcscpy_s
memset

ntdll

RtlNtStatusToDosError
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
WinSqmIsOptedIn
WinSqmAddToStreamEx
WinSqmIncrementDWORD
EtwEventWriteTransfer
EtwEventWrite
EtwEventActivityIdControl
EtwEventUnregister
EtwEventSetInformation
EtwEventRegister
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwTraceMessage

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
RaiseException
GetLastError
SetLastError
SetUnhandledExceptionFilter

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
GetCurrentProcess

api-ms-win-core-string-l1-1-0

CompareStringW

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetTickCount
GetVersionExW
GetTickCount64

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-security-base-l1-1-0

IsValidSid
EqualSid
RevertToSelf
ImpersonateLoggedOnUser
GetTokenInformation
CopySid

api-ms-win-core-libraryloader-l1-2-0

LoadStringW

api-ms-win-security-credentials-l1-1-0

CredDeleteW

ncrypt

NCryptFreeObject
NCryptSetProperty
NCryptOpenStorageProvider

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-threadpool-legacy-l1-1-0

QueueUserWorkItem
ChangeTimerQueueTimer
DeleteTimerQueueTimer
CreateTimerQueueTimer
DeleteTimerQueueEx
CreateTimerQueue

api-ms-win-core-kernel32-legacy-l1-1-0

GetComputerNameW
WTSGetActiveConsoleSessionId

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW

eappprxy

EapHostPeerGetAuthStatus
EapHostPeerGetUIContext
EapHostPeerProcessReceivedPacket
EapHostPeerSetUIContext
EapHostPeerGetResponseAttributes
EapHostPeerGetSendPacket
EapHostPeerGetResult
EapHostPeerSetResponseAttributes
EapHostPeerEndSession
EapHostPeerGetDataToUnplumbCredentials
EapHostPeerBeginSession
EapHostPeerClearConnection
EapHostPeerUninitialize
EapHostPeerInitialize
EapHostPeerFreeEapError

api-ms-win-core-synch-l1-1-0

DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
SetEvent
WaitForSingleObject
CreateEventW
InitializeCriticalSection

api-ms-win-core-heap-l1-1-0

HeapFree
GetProcessHeap
HeapAlloc

api-ms-win-core-registry-l1-1-0

RegOpenKeyExW
RegCloseKey

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Exports

Exports

OneXAddEapAttributes
OneXAddTLV
OneXCompareAuthParams
OneXCopyAuthParams
OneXCreateDefaultProfile
OneXCreateDiscoveryProfiles
OneXCreateSupplicantPort
OneXDeInitialize
OneXDestroySupplicantPort
OneXForceAuthenticatedState
OneXFreeAuthParams
OneXFreeMemory
OneXIndicatePacket
OneXIndicateSessionChange
OneXInitialize
OneXQueryAuthParams
OneXQueryPendingUIRequest
OneXQueryState
OneXQueryStatistics
OneXReasonCodeToString
OneXRestartReasonCodeToString
OneXSetAuthParams
OneXSetRuntimeState
OneXStartAuthentication
OneXStopAuthentication
OneXUIResponse
OneXUpdatePortProfile
OneXUpdateProfilePostDiscovery

Sections

.text
Size: 173KB - Virtual size: 172KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 288B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 300B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cfb1c964cccc2e4e07ca91650dc263f9

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-security-credentials-l1-1-0

ncrypt

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

eappprxy

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-apiquery-l1-1-0

Exports

Exports

Sections

.text Size: 173KB - Virtual size: 172KB

.rdata Size: 30KB - Virtual size: 29KB

.data Size: 1024B - Virtual size: 18KB

.pdata Size: 5KB - Virtual size: 5KB

.didat Size: 512B - Virtual size: 288B

.rsrc Size: 21KB - Virtual size: 20KB

.reloc Size: 512B - Virtual size: 300B

.text
Size: 173KB - Virtual size: 172KB

.rdata
Size: 30KB - Virtual size: 29KB

.data
Size: 1024B - Virtual size: 18KB

.pdata
Size: 5KB - Virtual size: 5KB

.didat
Size: 512B - Virtual size: 288B

.rsrc
Size: 21KB - Virtual size: 20KB

.reloc
Size: 512B - Virtual size: 300B