0e85d0a9fcf30f823c43e697f99cf61743ef1d29228e160f19005e343f2a5b50[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

0e85d0a9fcf30f823c43e697f99cf61743ef1d29228e160f19005e343f2a5b50.exe
Size

550KB
MD5

f004176cb0a58af018acc7b3ee4398af
SHA1

4fc9105afcbefcdfc0dbff01c5fc3ee8cc45ef75
SHA256

0e85d0a9fcf30f823c43e697f99cf61743ef1d29228e160f19005e343f2a5b50
SHA512

42f73084adda1175edc7587ca119501b0040a42cd99418a16d57329d0c88b1a03e66c231d0fb8c5111d7104153d31040dd1ab47e3fc1ef9041b0a711e8354eb0
SSDEEP

6144:EPww4FehRKMT22sHO54gFbq1gXbMyxe8Z8ly1+QHGMY9JWaOKhlbA9NI9gZbCdpe:Ne5+8bYyxe8F1bHGPWaphL6Z+DQb

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0e85d0a9fcf30f823c43e697f99cf61743ef1d29228e160f19005e343f2a5b50.exe

Files

0e85d0a9fcf30f823c43e697f99cf61743ef1d29228e160f19005e343f2a5b50.exe
.exe windows:6 windows x64 arch:x64

db08c3223cd165743a4b23c7602f4588

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\devel\ark7\bin.win32\bz.x64.pdb

Imports

kernel32

GetTempFileNameW
DeleteFileW
lstrlenW
GetFileAttributesW
GetFileSizeEx
LocalFree
GetFullPathNameW
FindNextFileW
RemoveDirectoryW
SetFileAttributesW
LoadLibraryExW
GetSystemDirectoryW
LoadLibraryW
WideCharToMultiByte
MultiByteToWideChar
IsDBCSLeadByteEx
WaitForSingleObject
GetCurrentProcessId
OpenProcess
TerminateProcess
HeapDestroy
HeapSize
HeapReAlloc
HeapFree
HeapAlloc
GetProcessHeap
SizeofResource
LockResource
LoadResource
FindResourceExW
FindResourceW
FormatMessageW
SetFilePointerEx
WriteFile
lstrlenA
RtlCaptureContext
GlobalMemoryStatusEx
CreateThread
ExitProcess
SetUnhandledExceptionFilter
GetCurrentThreadId
Sleep
GetFileInformationByHandle
GetFileInformationByHandleEx
GetTempPathW
GetStdHandle
GetConsoleScreenBufferInfo
FillConsoleOutputCharacterW
MoveFileW
SetConsoleCtrlHandler
FlushFileBuffers
InitializeCriticalSectionEx
DeleteCriticalSection
GetPrivateProfileIntW
WriteConsoleW
ReadConsoleW
GetStringTypeW
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
FindFirstFileExW
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
GetConsoleMode
GetConsoleOutputCP
SetStdHandle
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
GetCommandLineW
GetCommandLineA
PeekNamedPipe
GetFileType
GetDriveTypeW
GetModuleHandleExW
TlsFree
RtlUnwind
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
EncodePointer
SetLastError
GetCurrentDirectoryW
GetModuleFileNameW
GetCurrentThread
GetCurrentProcess
GetProcAddress
FreeLibrary
GetModuleHandleW
SystemTimeToTzSpecificLocalTime
GetTimeZoneInformation
FileTimeToSystemTime
GetSystemTimeAsFileTime
FindClose
FindFirstFileW
ReadFile
CreateFileW
GetTickCount64
OutputDebugStringW
CloseHandle
GetLastError
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
QueryPerformanceCounter
GetStartupInfoW
IsProcessorFeaturePresent
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
LeaveCriticalSection
EnterCriticalSection
RaiseException
IsDebuggerPresent

user32

SendMessageW
FindWindowW
wsprintfW
MessageBoxW
RegisterWindowMessageW
CharNextExA

advapi32

IsTextUnicode
GetTokenInformation
OpenProcessToken

shlwapi

PathCanonicalizeW
PathIsDirectoryW
PathFileExistsW
PathMatchSpecW

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

wininet

HttpOpenRequestA
HttpEndRequestW
InternetWriteFile
HttpSendRequestExW
HttpSendRequestW
InternetErrorDlg
InternetQueryDataAvailable
HttpAddRequestHeadersW
InternetConnectA
InternetSetOptionW
InternetOpenW
InternetCrackUrlA
InternetCloseHandle
InternetQueryOptionW
InternetReadFile
HttpQueryInfoW

Sections

.text
Size: 384KB - Virtual size: 384KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 111KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 6KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

db08c3223cd165743a4b23c7602f4588

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shlwapi

version

wininet

Sections

.text Size: 384KB - Virtual size: 384KB

.rdata Size: 111KB - Virtual size: 111KB

.data Size: 6KB - Virtual size: 15KB

.pdata Size: 15KB - Virtual size: 15KB

_RDATA Size: 512B - Virtual size: 500B

.rsrc Size: 5KB - Virtual size: 5KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 384KB - Virtual size: 384KB

.rdata
Size: 111KB - Virtual size: 111KB

.data
Size: 6KB - Virtual size: 15KB

.pdata
Size: 15KB - Virtual size: 15KB

_RDATA
Size: 512B - Virtual size: 500B

.rsrc
Size: 5KB - Virtual size: 5KB

.reloc
Size: 3KB - Virtual size: 2KB