01130468be2f5788bb2fb85340ca3987db1f6a0191a80b2ce7f92e2083b6eab5[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

01130468be2f5788bb2fb85340ca3987db1f6a0191a80b2ce7f92e2083b6eab5.exe
Size

78KB
MD5

02368888cd073dbe5ad504cc4ad56dd8
SHA1

8bb884a41b5f1b21b92986cf75e58ab8a1e49bad
SHA256

01130468be2f5788bb2fb85340ca3987db1f6a0191a80b2ce7f92e2083b6eab5
SHA512

0f908fed2cd2160a9f09bc2aa55693fa79e1614c5c43edf5bf421fdc680193eab5ee45794773bed9e7390b095e7dee52d8abbfee2fa2f407f2958e34265ea010
SSDEEP

768:AJLEGVXBWVv3omlbiEDtRVz8GX9hbhAl3Sbn8zyHSuM2OCWWgy:e7V4VvblbXRJht9hMib8mUWg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
01130468be2f5788bb2fb85340ca3987db1f6a0191a80b2ce7f92e2083b6eab5.exe

Files

01130468be2f5788bb2fb85340ca3987db1f6a0191a80b2ce7f92e2083b6eab5.exe
.dll windows:6 windows x64 arch:x64

b9e1779d5e96868e8427749cc9e524b8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

MSSHooks.pdb

Imports

msvcrt

_amsg_exit
_initterm
??3@YAXPEAX@Z
memmove_s
free
malloc
??1type_info@@UEAA@XZ
_errno
realloc
_onexit
_lock
__dllonexit
_unlock
_XcptFilter
__C_specific_handler
_CxxThrowException

ntdll

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
RaiseException
GetLastError
SetUnhandledExceptionFilter

api-ms-win-core-libraryloader-l1-1-0

GetModuleHandleW

api-ms-win-core-misc-l1-1-0

lstrcmpiW
Sleep

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

user32

SetWindowsHookExW
UnhookWindowsHookEx
GetClassNameW

Exports

Exports

LoadMSSearchHooks

Sections

.text
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 612B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 968B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_WRITE

V&�v
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

b9e1779d5e96868e8427749cc9e524b8

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-core-debug-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-libraryloader-l1-1-0

api-ms-win-core-misc-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

user32

Exports

Exports

Sections

.text Size: 5KB - Virtual size: 5KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 2KB - Virtual size: 1KB

.pdata Size: 1024B - Virtual size: 612B

.rsrc Size: 1024B - Virtual size: 968B

.reloc Size: 512B - Virtual size: 32B

V&�v Size: 64KB - Virtual size: 64KB

.text
Size: 5KB - Virtual size: 5KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 2KB - Virtual size: 1KB

.pdata
Size: 1024B - Virtual size: 612B

.rsrc
Size: 1024B - Virtual size: 968B

.reloc
Size: 512B - Virtual size: 32B

V&�v
Size: 64KB - Virtual size: 64KB