ConsoleApplication4[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

ConsoleApplication4.exe
Size

440KB
MD5

57af9f8ace4ef7916f3fee50ce8e9e21
SHA1

5bba0970399a3f8cd5f00552cc01a8779f2ab9b9
SHA256

08a14dba6dd0346166cb3f83910445da3e940559543b670b04de8c22c94d78be
SHA512

5c4464ba99b851380a7040e66bfd5f1c1721a97cbf12561731076a0825e172182e353aeef291fad872e0e227e22f00193a3eb0a633b06fd86338ba3ef4def1b6
SSDEEP

6144:hEY5x8yvYfwmZVMGANc3OCbgFOCIJfkTn5OEfvpQDdubt8OHJmf68T7kJ8KoIw:WY5OyvIwmZANc+CbYGWVfFWpTQj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ConsoleApplication4.exe

Files

ConsoleApplication4.exe
.exe windows:6 windows x86 arch:x86

87ae66c73db11d7eb34bf33d9d49b645

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\fadi\source\repos\ConsoleApplication4\Release\ConsoleApplication4.pdb

Imports

ws2_32

gethostname
ioctlsocket
getpeername
sendto
recvfrom
freeaddrinfo
getaddrinfo
recv
listen
htonl
send
WSACloseEvent
getsockname
connect
bind
accept
select
__WSAFDIsSet
inet_pton
socket
htons
WSAIoctl
setsockopt
WSACleanup
WSAStartup
inet_ntop
WSASetLastError
ntohs
WSAGetLastError
getsockopt
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
WSAWaitForMultipleEvents
closesocket

crypt32

CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CertFindExtension
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertGetNameStringW
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
CryptStringToBinaryW

kernel32

IsDebuggerPresent
InitializeSListHead
GetFileSizeEx
CreateFileW
VerifyVersionInfoW
GetModuleHandleA
VerSetConditionMask
SleepEx
GetCurrentProcessId
WaitForMultipleObjects
PeekNamedPipe
ReadFile
GetFileType
GetStdHandle
GetEnvironmentVariableA
WaitForSingleObjectEx
MoveFileExW
WideCharToMultiByte
Sleep
LoadLibraryW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetCurrentThreadId
GetSystemTimeAsFileTime
SetLastError
WaitForSingleObject
MultiByteToWideChar
GetTempPathA
CloseHandle
CreateProcessW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetLastError
GetStartupInfoW
FormatMessageW
QueryPerformanceCounter
GetTickCount
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
QueryPerformanceFrequency
GetSystemDirectoryW
FreeLibrary
GetModuleHandleW
GetProcAddress

user32

MessageBoxA

advapi32

CryptGetHashParam
CryptReleaseContext
CryptAcquireContextW
CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash

msvcp140

?_Xlength_error@std@@YAXPBD@Z

bcrypt

BCryptGenRandom

vcruntime140

memmove
memchr
memcpy
strrchr
_CxxThrowException
strstr
__std_exception_copy
__std_exception_destroy
__current_exception
__current_exception_context
memset
wcschr
strchr
_except_handler4_common

api-ms-win-crt-stdio-l1-1-0

_set_fmode
fputs
fread
_lseeki64
__acrt_iob_func
fopen_s
__p__commode
fclose
fgets
_wfopen
_wopen
fflush
__stdio_common_vsprintf
fputc
__stdio_common_vsscanf
fwrite
fseek
ftell
_read
_write
feof
_fileno
_close

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function
_initialize_onexit_table
_controlfp_s
terminate
__sys_nerr
_beginthreadex
__sys_errlist
_invalid_parameter_noinfo_noreturn
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
_exit
_errno
_seh_filter_exe
_set_app_type
_crt_atexit
_configure_narrow_argv
_initialize_narrow_environment
_get_narrow_winmain_command_line
_initterm
_initterm_e
exit

api-ms-win-crt-heap-l1-1-0

_callnewh
malloc
realloc
_set_new_mode
free
calloc

api-ms-win-crt-string-l1-1-0

_wcsdup
wcspbrk
wcsncmp
strncpy
strpbrk
strspn
wcsncpy
strncmp
strcspn
_strdup

api-ms-win-crt-convert-l1-1-0

strtol
strtoll
strtoul
wcstombs
atoi

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

strftime
_gmtime64
_time64

api-ms-win-crt-filesystem-l1-1-0

_unlink
_fstat64
_waccess
_wstat64

api-ms-win-crt-math-l1-1-0

__setusermatherr
_fdopen

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 349KB - Virtual size: 349KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 73KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

87ae66c73db11d7eb34bf33d9d49b645

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

crypt32

kernel32

user32

advapi32

msvcp140

bcrypt

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 349KB - Virtual size: 349KB

.rdata Size: 73KB - Virtual size: 72KB

.data Size: 1KB - Virtual size: 2KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 15KB - Virtual size: 14KB

.text
Size: 349KB - Virtual size: 349KB

.rdata
Size: 73KB - Virtual size: 72KB

.data
Size: 1KB - Virtual size: 2KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 15KB - Virtual size: 14KB