4755404f207a78314643253bdfbbb830N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

4755404f207a78314643253bdfbbb830N.exe
Size

109KB
MD5

4755404f207a78314643253bdfbbb830
SHA1

6c5f256c92a97bc908a63e58cc3a3b7cb136520f
SHA256

bed67479e3c2ef2a5d5c4dea1a126486a062c1b8f521cb7b02116751681c395d
SHA512

5c6572598d8f101580910e47b2f557d2324c1ec074233c93af33ad33193cffe3accf7520e0b22ff3fdfb2cdadad3bf8920951a57b711b6ea197786770604ddba
SSDEEP

1536:0KOhdkodQXEyJ7PW29Puyk48h9jEa8C4yAThVGqG+TT6I64UC8:0KOfkBRWvL/9jEC0hVikT6WUC8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4755404f207a78314643253bdfbbb830N.exe

Files

4755404f207a78314643253bdfbbb830N.exe
.dll windows:4 windows x64 arch:x64

5614604ddb79e3081b872d280b1dcef1

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

advapi32

GetTokenInformation
LookupAccountSidW
OpenProcessToken

iphlpapi

GetExtendedTcpTable
GetExtendedUdpTable

kernel32

CloseHandle
CreateEventW
CreateFileW
CreateProcessW
CreateThread
CreateToolhelp32Snapshot
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FindFirstVolumeMountPointA
FindNextVolumeMountPointA
FindVolumeMountPointClose
FreeLibrary
GetConsoleScreenBufferInfo
GetCurrentProcess
GetCurrentProcessId
GetDiskFreeSpaceExW
GetDriveTypeA
GetExitCodeProcess
GetLastError
GetLogicalDriveStringsA
GetModuleHandleA
GetModuleHandleW
GetNativeSystemInfo
GetPriorityClass
GetProcAddress
GetProcessAffinityMask
GetProcessHandleCount
GetProcessHeap
GetProcessTimes
GetStdHandle
GetSystemTimeAsFileTime
GetSystemTimes
GetTickCount
GetVolumeInformationA
GlobalMemoryStatusEx
HeapAlloc
HeapFree
InitializeCriticalSection
K32EnumProcessModules
K32EnumProcesses
K32GetModuleFileNameExW
K32GetProcessImageFileNameW
LeaveCriticalSection
LoadLibraryA
LocalFree
MultiByteToWideChar
OpenProcess
OpenThread
Process32FirstW
Process32NextW
QueryDosDeviceW
ReadProcessMemory
RegisterWaitForSingleObject
ResumeThread
SetErrorMode
SetEvent
SetLastError
SetPriorityClass
SetProcessAffinityMask
Sleep
SuspendThread
TerminateProcess
TerminateThread
Thread32First
Thread32Next
TlsGetValue
VirtualProtect
VirtualQuery
VirtualQueryEx
WaitForSingleObject
WideCharToMultiByte

api-ms-win-crt-convert-l1-1-0

mbrtowc
wcrtomb

api-ms-win-crt-environment-l1-1-0

__p__environ
__p__wenviron
getenv

api-ms-win-crt-heap-l1-1-0

_set_new_mode
calloc
free
malloc

api-ms-win-crt-locale-l1-1-0

localeconv

api-ms-win-crt-private-l1-1-0

memcpy
strrchr
strstr

api-ms-win-crt-runtime-l1-1-0

__p___argc
__p___argv
__p___wargv
_configure_narrow_argv
_configure_wide_argv
_crt_at_quick_exit
_crt_atexit
_errno
_execute_onexit_table
_exit
_initialize_narrow_environment
_initialize_onexit_table
_initialize_wide_environment
_initterm
_register_onexit_function
abort
strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__stdio_common_vfprintf
__stdio_common_vfwprintf
__stdio_common_vsprintf
fputc
fwrite

api-ms-win-crt-string-l1-1-0

isalpha
memset
strcat_s
strcmp
strcpy_s
strlen
strncmp
wcscmp
wcslen
wcsncmp

api-ms-win-crt-time-l1-1-0

__daylight
__timezone
__tzname
_tzset

pdh

PdhAddCounterW
PdhCollectQueryDataEx
PdhGetFormattedCounterValue
PdhOpenQueryW

shell32

CommandLineToArgvW

wtsapi32

WTSEnumerateSessionsA
WTSFreeMemory
WTSQuerySessionInformationA
WTSQuerySessionInformationW

r

INTEGER
LENGTH
LOGICAL
RAW
REAL
REprintf
REvprintf
R_BaseEnv
R_CHAR
R_ClassSymbol
R_ExternalPtrAddr
R_GlobalEnv
R_MakeExternalPtr
R_NaInt
R_NaReal
R_NaString
R_NamesSymbol
R_NilValue
R_PreserveObject
R_ProtectWithIndex
R_RegisterCFinalizerEx
R_Reprotect
R_alloc
R_forceSymbols
R_registerRoutines
R_useDynamicSymbols
Rf_ScalarInteger
Rf_ScalarLogical
Rf_ScalarRaw
Rf_ScalarReal
Rf_ScalarString
Rf_allocSExp
Rf_allocVector
Rf_defineVar
Rf_error
Rf_eval
Rf_findFun
Rf_install
Rf_isNull
Rf_lang2
Rf_length
Rf_lengthgets
Rf_list2
Rf_mkChar
Rf_mkCharLen
Rf_mkNamed
Rf_mkString
Rf_protect
Rf_setAttrib
Rf_unprotect
SET_STRING_ELT
SET_VECTOR_ELT
STRING_ELT
S_realloc
VECTOR_ELT

Exports

Exports

GetLibraryProcAddress
LONG_PATH_PREFIX
LONG_PATH_PREFIX_LEN
LoadAvgCallback
PS__CHECK_HANDLE
PS__DEBUG
PS__TESTING
R_init_ps
STATUS_BUFFER_TOO_SMALL
STATUS_INFO_LENGTH_MISMATCH
UNC_PATH_PREFIX
UNC_PATH_PREFIX_LEN
_NtQueryVirtualMemory
g_dwLength
g_dwSize
g_hEvtFinish
g_hEvtStart
g_hFile
g_hThread
g_initialized
g_pNameBuffer
g_status
load_avg_15m
load_avg_1m
load_avg_5m
load_avg_inited
ps__NtQueryObject
ps__NtQueryObjectThread
ps__access_denied
ps__assert_pid_exists
ps__assert_pid_not_exists
ps__boot_time
ps__build_list
ps__build_named_list
ps__build_string
ps__check_phandle
ps__convert_dos_path
ps__count_set_bits
ps__cpu_count_logical
ps__cpu_count_physical
ps__debug
ps__define_errno
ps__define_socket_address_families
ps__define_socket_types
ps__define_tcp_statuses
ps__disk_partitions
ps__disk_usage
ps__dummy
ps__exe
ps__filetime_to_unix
ps__find_if_env
ps__get_cmdline
ps__get_cwd
ps__get_environ
ps__get_loadavg
ps__get_modules
ps__get_num_cpus
ps__get_open_files
ps__get_open_files_init
ps__get_pids
ps__get_proc_address_from_lib
ps__get_proc_info
ps__handle_from_pid
ps__handle_from_pid_waccess
ps__inet_ntop
ps__init
ps__init_loadavg_counter
ps__is_phandle_running
ps__kill_if_env
ps__last_error
ps__last_error_string
ps__loadavg
ps__memory_maps
ps__name
ps__no_memory
ps__no_such_process
ps__not_implemented
ps__os_type
ps__pid_in_pids
ps__pids
ps__ppid
ps__proc_cpu_times
ps__proc_info
ps__proc_kill
ps__proc_name
ps__proc_num_threads
ps__proc_resume
ps__proc_suspend
ps__proc_suspend_or_resume
ps__proc_username
ps__protect_free_finalizer
ps__set_error
ps__set_error_from_errno
ps__set_error_from_windows_error
ps__set_error_impl
ps__set_testing
ps__str_to_utf8
ps__str_to_utf8_size
ps__system_cpu_times
ps__system_memory
ps__system_swap
ps__throw_error
ps__tty_size
ps__users
ps__utf16_to_charsxp
ps__utf16_to_rawsxp
ps__utf16_to_strsxp
ps__utf8_to_utf16
ps__zombie_process
psll_cmdline
psll_connections
psll_cpu_times
psll_create_time
psll_cwd
psll_dlls
psll_environ
psll_exe
psll_format
psll_get_cpu_aff
psll_get_nice
psll_gids
psll_handle
psll_interrupt
psll_is_running
psll_kill
psll_memory_info
psll_memory_uss
psll_name
psll_num_fds
psll_num_threads
psll_open_files
psll_parent
psll_pid
psll_ppid
psll_resume
psll_send_signal
psll_set_cpu_aff
psll_set_nice
psll_status
psll_suspend
psll_terminal
psll_terminate
psll_uids
psll_username
psp__pid_exists
psp__stat_st_rdev
psp__waitpid
psp__zombie
psw__realpath

Sections

.text
Size: 74KB - Virtual size: 74KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 304B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 512B - Virtual size: 384B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5614604ddb79e3081b872d280b1dcef1

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

iphlpapi

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

pdh

shell32

wtsapi32

r

Exports

Exports

Sections

.text Size: 74KB - Virtual size: 74KB

.data Size: 512B - Virtual size: 304B

.rdata Size: 14KB - Virtual size: 13KB

.pdata Size: 3KB - Virtual size: 2KB

.xdata Size: 3KB - Virtual size: 2KB

.bss Size: - Virtual size: 3KB

.edata Size: 4KB - Virtual size: 3KB

.idata Size: 8KB - Virtual size: 7KB

.CRT Size: 512B - Virtual size: 88B

.tls Size: 512B - Virtual size: 16B

.reloc Size: 512B - Virtual size: 384B

.text
Size: 74KB - Virtual size: 74KB

.data
Size: 512B - Virtual size: 304B

.rdata
Size: 14KB - Virtual size: 13KB

.pdata
Size: 3KB - Virtual size: 2KB

.xdata
Size: 3KB - Virtual size: 2KB

.bss
Size: - Virtual size: 3KB

.edata
Size: 4KB - Virtual size: 3KB

.idata
Size: 8KB - Virtual size: 7KB

.CRT
Size: 512B - Virtual size: 88B

.tls
Size: 512B - Virtual size: 16B

.reloc
Size: 512B - Virtual size: 384B