e7c589f845284fa957ac78c956c49b3e1d4a9579a947861b0d58d8718de697d7

Sharing

Copy URL

Twitter E-mail

General

Target

e7c589f845284fa957ac78c956c49b3e1d4a9579a947861b0d58d8718de697d7
Size

277KB
MD5

dccbdcd8e429176c120c47c35bec0ec4
SHA1

75361740690cdd48d1d376c1afbe76c6d47dce4d
SHA256

e7c589f845284fa957ac78c956c49b3e1d4a9579a947861b0d58d8718de697d7
SHA512

e440ff924daf846a638f075c1fb8bb4104d17e4a5a10e980e920a0a35e69854a6c8786942bd8a48a9f3bc92e2f56922c38fee41c56202d4d4bc5dd1ad9d5932e
SSDEEP

6144:UJ0cVoYPc+Nbhp0oApWFan+PgE9ZrwVITd/uQ5UJMkBDQ:qVFhNbhp0oAqPgy8JM5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e7c589f845284fa957ac78c956c49b3e1d4a9579a947861b0d58d8718de697d7

Files

e7c589f845284fa957ac78c956c49b3e1d4a9579a947861b0d58d8718de697d7
.dll windows:6 windows x64 arch:x64

9882ecdedd8e960d2538c77c790c6a3f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

F:\TemporaryBuilds\azure-adaware-pool-build-de-1\11\s\_build\bin\x64\Release\support.pdb

Imports

kernel32

InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
GetDynamicTimeZoneInformation
GetCurrentThreadId
GetCurrentProcessId
HeapAlloc
GetProcessHeap
HeapFree
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
WriteConsoleA
WriteFile
GetStdHandle
GetConsoleMode
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
RtlCaptureContext
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
ReleaseSRWLockExclusive

boost_thread-vc144-mt-x64-1_85

?join@thread@boost@@QEAAXXZ
??1thread_data_base@detail@boost@@UEAA@XZ
??0thread_data_base@detail@boost@@QEAA@XZ
?notify_all_at_thread_exit@thread_data_base@detail@boost@@UEAAXPEAVcondition_variable@3@PEAVmutex@3@@Z
?joinable@thread@boost@@QEBA_NXZ
??1thread@boost@@QEAA@XZ
??4thread@boost@@QEAAAEAV01@$$QEAV01@@Z
?start_thread@thread@boost@@AEAAXXZ
?interruption_point@this_thread@boost@@YAXXZ
??0thread@boost@@QEAA@XZ
?interrupt@thread@boost@@QEAAXXZ

fmt

?format_system_error@v10@fmt@@YAXAEAV?$buffer@D@detail@12@HPEBD@Z
?vformat@v10@fmt@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$basic_string_view@D@12@V?$basic_format_args@V?$basic_format_context@Vappender@v10@fmt@@D@v10@fmt@@@12@@Z
??$vformat_to@D@detail@v10@fmt@@YAXAEAV?$buffer@D@012@V?$basic_string_view@D@12@V?$basic_format_args@V?$basic_format_context@Vappender@v10@fmt@@D@v10@fmt@@@12@Vlocale_ref@012@@Z

msvcp140

_Thrd_id
?_Throw_Cpp_error@std@@YAXH@Z
_Thrd_join
_Mtx_lock
_Mtx_unlock
_Cnd_destroy_in_situ
_Cnd_signal
?_Xbad_function_call@std@@YAXXZ
?_Xlength_error@std@@YAXPEBD@Z
_Xtime_get_ticks

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_copy
__std_exception_destroy
__std_type_info_compare
_purecall
__current_exception
__current_exception_context
__C_specific_handler
_CxxThrowException
memset
__std_type_info_destroy_list
memcpy
memmove
__std_terminate
memcmp

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf
__acrt_iob_func
__stdio_common_vfprintf

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_initterm
_initterm_e
terminate
_invalid_parameter_noinfo_noreturn
_seh_filter_dll
_errno

api-ms-win-crt-convert-l1-1-0

strtoll
strtoull
strtod

api-ms-win-crt-time-l1-1-0

strftime
_localtime64_s
_gmtime64_s

api-ms-win-crt-locale-l1-1-0

localeconv

api-ms-win-crt-heap-l1-1-0

malloc
_callnewh
free

api-ms-win-crt-string-l1-1-0

isdigit

api-ms-win-crt-math-l1-1-0

ceilf

Exports

Exports

Create_Kernel
Create_Params

Sections

.text
Size: 184KB - Virtual size: 184KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 18KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

boostdll
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 1000B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9882ecdedd8e960d2538c77c790c6a3f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

boost_thread-vc144-mt-x64-1_85

fmt

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

Exports

Exports

Sections

.text Size: 184KB - Virtual size: 184KB

.rdata Size: 60KB - Virtual size: 59KB

.data Size: 18KB - Virtual size: 20KB

.pdata Size: 10KB - Virtual size: 9KB

boostdll Size: 512B - Virtual size: 16B

.rsrc Size: 1024B - Virtual size: 1000B

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 184KB - Virtual size: 184KB

.rdata
Size: 60KB - Virtual size: 59KB

.data
Size: 18KB - Virtual size: 20KB

.pdata
Size: 10KB - Virtual size: 9KB

boostdll
Size: 512B - Virtual size: 16B

.rsrc
Size: 1024B - Virtual size: 1000B

.reloc
Size: 2KB - Virtual size: 1KB