9eca935f0a5023c6a34ee53bd3df2d5c75d8098212a9c17931a3954b77b72ba0

Sharing

Copy URL

Twitter E-mail

General

Target

9eca935f0a5023c6a34ee53bd3df2d5c75d8098212a9c17931a3954b77b72ba0
Size

727KB
MD5

1997c2466ade89c197f8791811c05fbd
SHA1

9769bed0fa558b8ce4cb11bb768d5054f3a0315e
SHA256

9eca935f0a5023c6a34ee53bd3df2d5c75d8098212a9c17931a3954b77b72ba0
SHA512

d5ae794e16ebf0a5fc72c717a574093be93d1020d54505ba2099b52eb8462d0ca0a41cd81c893cd24ffbcb83e9e5f9d25e23e570ef771bba8c1fa52a79a05ba0
SSDEEP

12288:ohjviZgsrl5o9j0gR/ZtpQq6HlrE4wHeNHXHXjcTCCt:oj6Z5rl5o9gUqVwHeNHHjcTCg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9eca935f0a5023c6a34ee53bd3df2d5c75d8098212a9c17931a3954b77b72ba0

Files

9eca935f0a5023c6a34ee53bd3df2d5c75d8098212a9c17931a3954b77b72ba0
.exe windows:6 windows x64 arch:x64

d5a94b013b4f57e0bc8024d9e0ae92b8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\jks\workspace\RSClient_master\client-library\Win32CrashHandlerLibrary\winx64\crashpad\crashpad_handler.pdb

Imports

kernel32

GetLastError
OutputDebugStringW
GetLocalTime
GetCurrentProcessId
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
DeleteCriticalSection
SetLastError
GetFileInformationByHandleEx
GetCurrentProcess
RegisterWaitForSingleObject
TerminateProcess
GetQueuedCompletionStatus
WaitForSingleObject
DuplicateHandle
DisconnectNamedPipe
OpenProcess
PostQueuedCompletionStatus
CreateEventW
SetEvent
CreateThread
UnregisterWaitEx
CreateIoCompletionPort
ConnectNamedPipe
SetNamedPipeHandleState
CreateNamedPipeW
GetVersion
TransactNamedPipe
WaitNamedPipeW
LoadLibraryW
GetProcAddress
FindClose
ReleaseSemaphore
CreateSemaphoreW
FormatMessageA
FormatMessageW
ReadFile
GetFileSizeEx
GetStdHandle
WriteFile
SetEndOfFile
UnlockFileEx
SetFilePointerEx
LockFileEx
GetFileType
CreateDirectoryW
GetFileAttributesW
DeleteFileW
Wow64GetThreadContext
SuspendThread
ResumeThread
GetThreadContext
GetProcessTimes
GetTimeZoneInformation
GetSystemInfo
IsProcessorFeaturePresent
VerSetConditionMask
VerifyVersionInfoW
GetSystemDefaultLCID
GetThreadLocale
GetUserDefaultLCID
IsWow64Process
Sleep
RaiseException
SleepEx
FileTimeToSystemTime
GetCurrentThreadId
GetModuleHandleW
CreateProcessW
WTSGetActiveConsoleSessionId
CloseHandle
CreateFileW
GetProcessId
GetModuleFileNameW
SetUnhandledExceptionFilter
SetProcessShutdownParameters
LocalFree
SystemTimeToTzSpecificLocalTime
PeekNamedPipe
GetDriveTypeW
RtlUnwind
SetConsoleCtrlHandler
InitOnceExecuteOnce
InitializeCriticalSection
VirtualQueryEx
ReadProcessMemory
GetFileTime
RemoveDirectoryW
WriteConsoleW
HeapSize
GetProcessHeap
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
GetACP
IsValidCodePage
HeapReAlloc
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
EnumSystemLocalesW
IsValidLocale
GetLocaleInfoW
WideCharToMultiByte
GetLocaleInfoEx
GetCurrentDirectoryW
FindFirstFileExW
FindNextFileW
GetFileInformationByHandle
GetFullPathNameW
SetFileInformationByHandle
AreFileApisANSI
MultiByteToWideChar
InitOnceComplete
InitOnceBeginInitialize
InitializeCriticalSectionEx
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
RtlPcToFileHeader
RtlUnwindEx
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
GetCommandLineA
GetCommandLineW
ExitProcess
GetModuleHandleExW
HeapAlloc
HeapFree
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW

advapi32

SystemFunction036
RegCloseKey
RegQueryValueExA
RegOpenKeyExW
RegQueryValueExW
BuildExplicitAccessWithNameW
ConvertStringSecurityDescriptorToSecurityDescriptorW
BuildSecurityDescriptorW
RevertToSelf
ImpersonateNamedPipeClient
CreateProcessAsUserW

user32

RegisterClassW
TranslateMessage
GetWindowLongPtrW
DispatchMessageW
UnregisterClassW
CreateWindowExW
SetWindowLongPtrW
DestroyWindow
PostMessageW
DefWindowProcW
GetMessageW

winhttp

WinHttpWriteData
WinHttpCloseHandle
WinHttpOpenRequest
WinHttpReadData
WinHttpAddRequestHeaders
WinHttpOpen
WinHttpReceiveResponse
WinHttpCrackUrl
WinHttpConnect
WinHttpQueryHeaders
WinHttpSendRequest
WinHttpSetTimeouts

powrprof

CallNtPowerInformation

dbghelp

MiniDumpWriteDump

wtsapi32

WTSQueryUserToken

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

Sections

.text
Size: 546KB - Virtual size: 546KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 137KB - Virtual size: 137KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 348B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

CPADinfo
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

d5a94b013b4f57e0bc8024d9e0ae92b8

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

user32

winhttp

powrprof

dbghelp

wtsapi32

version

Sections

.text Size: 546KB - Virtual size: 546KB

.rdata Size: 137KB - Virtual size: 137KB

.data Size: 11KB - Virtual size: 17KB

.pdata Size: 26KB - Virtual size: 26KB

_RDATA Size: 512B - Virtual size: 348B

CPADinfo Size: 512B - Virtual size: 56B

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 546KB - Virtual size: 546KB

.rdata
Size: 137KB - Virtual size: 137KB

.data
Size: 11KB - Virtual size: 17KB

.pdata
Size: 26KB - Virtual size: 26KB

_RDATA
Size: 512B - Virtual size: 348B

CPADinfo
Size: 512B - Virtual size: 56B

.reloc
Size: 4KB - Virtual size: 3KB