backend-windows-x86_64[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

backend-windows-x86_64.exe
Size

2.1MB
MD5

1f73cee429e2fc854c84354cce96f146
SHA1

cc86d61eeff48effb0dd4ebdb075fe0f44a55a46
SHA256

509b73ddf2ded95fcbc08864aadd7d5a0e557e1d6065e9f35815b9add90ecc67
SHA512

2ebc84f70f6ca00deee3a401484663c13acf4922f4ee11dbdfc2ebf25f6c455a0687ff8a7688c647d65302a7af40bb6a47aa0aa978f3132381d8bb8fb657cd29
SSDEEP

24576:JBSImNvxBhYNyXLHcPHIYG5mydrfCVFvHbPHw+mU58HTLdImenOlm6puN+9:JBP0vxBaVPPB+DUxHwhUK0nOlm64

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
backend-windows-x86_64.exe

Files

backend-windows-x86_64.exe
.exe windows:6 windows x64 arch:x64

cbe70da9ff241c3190f35f17e1fdfce0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\olegl\GitHub Desktop\flipper-pc-monitor-backend\target\release\deps\flipper_pc_monitor_backend.pdb

Imports

ntdll

RtlVirtualUnwind
RtlCaptureContext
NtDeviceIoControlFile
NtReadFile
NtWriteFile
NtQuerySystemInformation
RtlNtStatusToDosError
NtCancelIoFileEx
NtQueryInformationProcess
RtlGetVersion
RtlLookupFunctionEntry

kernel32

GetCurrentProcessId
GetDriveTypeW
GetVolumeInformationW
GetProcessHeap
HeapFree
GetProcessTimes
GetLastError
HeapAlloc
OpenProcess
GetDiskFreeSpaceExW
GetLogicalDrives
GlobalMemoryStatusEx
GetSystemTimes
GetProcessIoCounters
GetTickCount64
LocalFree
VirtualQueryEx
ReadProcessMemory
GetFileInformationByHandleEx
GetSystemInfo
CreateFileW
GetStdHandle
SleepConditionVariableSRW
LoadLibraryA
GetProcAddress
FreeLibrary
ReleaseSRWLockShared
AcquireSRWLockShared
SetConsoleMode
GetConsoleMode
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
WaitForSingleObject
TryAcquireSRWLockExclusive
FormatMessageW
UnregisterWaitEx
GetCurrentProcess
DuplicateHandle
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
CloseHandle
GetCurrentThreadId
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
GetFileType
DeviceIoControl
SetUnhandledExceptionFilter
GetSystemTimeAsFileTime
TlsSetValue
TlsGetValue
CreateThread
WriteConsoleW
MultiByteToWideChar
GetFileAttributesW
CreateProcessW
GetWindowsDirectoryW
CreateIoCompletionPort
GetQueuedCompletionStatusEx
GetSystemDirectoryW
PostQueuedCompletionStatus
IsProcessorFeaturePresent
Sleep
GetModuleHandleA
CreateNamedPipeW
GetFullPathNameW
FreeEnvironmentStringsW
ReleaseMutex
CompareStringOrdinal
AddVectoredExceptionHandler
SetThreadStackGuarantee
SwitchToThread
GetCurrentThread
SetLastError
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
WriteFileEx
SleepEx
ReadFileEx
TerminateProcess
WakeAllConditionVariable
WakeConditionVariable
QueryPerformanceCounter
QueryPerformanceFrequency
HeapReAlloc
WaitForSingleObjectEx
CreateMutexA
GetFinalPathNameByHandleW
GetModuleFileNameW
GetModuleHandleW

ole32

CoInitializeSecurity
CoInitializeEx
CoUninitialize
CoCreateInstance
CoSetProxyBlanket

oleaut32

SysAllocString
SysFreeString
VariantClear
SysStringLen
GetErrorInfo

pdh

PdhCollectQueryData
PdhOpenQueryA
PdhCloseQuery
PdhRemoveCounter
PdhGetFormattedCounterValue
PdhAddEnglishCounterW

powrprof

CallNtPowerInformation

psapi

GetPerformanceInfo
GetModuleFileNameExW

netapi32

NetUserGetInfo
NetUserGetLocalGroups
NetUserEnum
NetApiBufferFree

secur32

LsaEnumerateLogonSessions
LsaGetLogonSessionData
LsaFreeReturnBuffer

advapi32

GetLengthSid
LookupAccountSidW
CopySid
SystemFunction036
IsValidSid
OpenProcessToken
GetTokenInformation

iphlpapi

GetIfEntry2
FreeMibTable
GetIfTable2
GetAdaptersAddresses

shell32

CommandLineToArgvW

bcrypt

BCryptGenRandom

vcruntime140

__current_exception_context
__current_exception
__CxxFrameHandler3
memmove
memcpy
memset
__C_specific_handler
_CxxThrowException
memcmp

api-ms-win-crt-heap-l1-1-0

_set_new_mode
free
malloc

api-ms-win-crt-string-l1-1-0

wcslen

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_initterm
_register_thread_local_exe_atexit_callback
_initialize_onexit_table
_c_exit
_cexit
__p___argv
__p___argc
_get_initial_narrow_environment
_register_onexit_function
_crt_atexit
_exit
_configure_narrow_argv
terminate
_seh_filter_exe
exit
_set_app_type
_initialize_narrow_environment

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 463KB - Virtual size: 462KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 85KB - Virtual size: 84KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cbe70da9ff241c3190f35f17e1fdfce0

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ntdll

kernel32

ole32

oleaut32

pdh

powrprof

psapi

netapi32

secur32

advapi32

iphlpapi

shell32

bcrypt

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 463KB - Virtual size: 462KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 85KB - Virtual size: 84KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 463KB - Virtual size: 462KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 85KB - Virtual size: 84KB

.reloc
Size: 8KB - Virtual size: 7KB