85e598730ffbae9b4aec79650b7143a1b111d0cbed1d823506a2f519bf58296b

Sharing

Copy URL

Twitter E-mail

General

Target

85e598730ffbae9b4aec79650b7143a1b111d0cbed1d823506a2f519bf58296b
Size

582KB
MD5

e4c6ae1e11ecd9cbd0873ef183640539
SHA1

5504929001d5cd90819c094deeae068d4c636056
SHA256

85e598730ffbae9b4aec79650b7143a1b111d0cbed1d823506a2f519bf58296b
SHA512

289e63adc5b3779d059d7f8eccc0d110a49626ed20ee92ef66b55a447842f96b8de9ff60eddc5bdbec0985336810d48fd72c36b2e129f05e4f6044cd0ef5ad81
SSDEEP

12288:VO5nlDrH4dsqrq4ZNKL6WYgeWYg955/155/iHjph0lhSMXl++psvN:VO5nlDrHWfbh0lhSMXl1iF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
85e598730ffbae9b4aec79650b7143a1b111d0cbed1d823506a2f519bf58296b

Files

85e598730ffbae9b4aec79650b7143a1b111d0cbed1d823506a2f519bf58296b
.dll windows:6 windows x64 arch:x64

b23ed0b4b0156d7dac27b52bc92a3bc6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

F:\TemporaryBuilds\azure-adaware-pool-build-de-1\11\s\_build\bin\x64\Release\device_drivers.pdb

Imports

kernel32

GetCurrentThreadId
GetCurrentProcessId
GetLastError
InitializeCriticalSectionEx
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
WriteConsoleA
GetDynamicTimeZoneInformation
GetStdHandle
GetConsoleMode
WideCharToMultiByte
MultiByteToWideChar
GetModuleHandleW
GetSystemDirectoryW
QueryPerformanceCounter
OutputDebugStringW
HeapFree
GetProcessHeap
HeapAlloc
WriteFile
InitializeCriticalSection
AreFileApisANSI
GetLocaleInfoEx
FormatMessageA
LocalFree
GetSystemTimeAsFileTime
IsDebuggerPresent
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent

user32

DestroyIcon
GetIconInfo

gdi32

GetDIBits
DeleteDC
DeleteObject
CreateCompatibleDC

shell32

ExtractIconW

ole32

CoCreateInstance
CoInitializeEx
CoSetProxyBlanket
CoInitializeSecurity
CoUninitialize

oleaut32

SysAllocString
SysFreeString
SysAllocStringLen
VariantClear
VariantInit

boost_thread-vc144-mt-x64-1_85

??1thread_data_base@detail@boost@@UEAA@XZ
?joinable@thread@boost@@QEBA_NXZ
?interrupt@thread@boost@@QEAAXXZ
??0thread@boost@@QEAA@XZ
?interruption_point@this_thread@boost@@YAXXZ
??0thread_data_base@detail@boost@@QEAA@XZ
?notify_all_at_thread_exit@thread_data_base@detail@boost@@UEAAXPEAVcondition_variable@3@PEAVmutex@3@@Z
?start_thread@thread@boost@@AEAAXXZ
??1thread@boost@@QEAA@XZ
??4thread@boost@@QEAAAEAV01@$$QEAV01@@Z
?join@thread@boost@@QEAAXXZ

fmt

??$vformat_to@D@detail@v10@fmt@@YAXAEAV?$buffer@D@012@V?$basic_string_view@D@12@V?$basic_format_args@V?$basic_format_context@Vappender@v10@fmt@@D@v10@fmt@@@12@Vlocale_ref@012@@Z
?vformat@v10@fmt@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$basic_string_view@D@12@V?$basic_format_args@V?$basic_format_context@Vappender@v10@fmt@@D@v10@fmt@@@12@@Z
?format_system_error@v10@fmt@@YAXAEAV?$buffer@D@detail@12@HPEBD@Z

msvcp140

?_Xbad_function_call@std@@YAXXZ
?id@?$ctype@_W@std@@2V0locale@2@A
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
_Cnd_destroy_in_situ
??Bid@locale@std@@QEAA_KXZ
?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ
?uncaught_exceptions@std@@YAHXZ
?id@?$numpunct@D@std@@2V0locale@2@A
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Gettrue@_Locinfo@std@@QEBAPEBDXZ
?_Getfalse@_Locinfo@std@@QEBAPEBDXZ
?_Getlconv@_Locinfo@std@@QEBAPEBUlconv@@XZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
?set_new_handler@std@@YAP6AXXZP6AXXZ@Z
_Mtx_unlock
_Mtx_lock
_Thrd_join
?_Throw_Cpp_error@std@@YAXH@Z
_Thrd_id
_Xtime_get_ticks
?_Xbad_alloc@std@@YAXXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
_Cnd_signal
?tolower@?$ctype@_W@std@@QEBA_W_W@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcpy
__std_type_info_name
_purecall
memmove
memset
__std_type_info_compare
__std_exception_destroy
memcmp
__std_exception_copy
__std_terminate
__current_exception
__C_specific_handler
__current_exception_context
_CxxThrowException
__std_type_info_destroy_list

api-ms-win-crt-heap-l1-1-0

malloc
_aligned_free
_aligned_malloc
_callnewh
free
calloc

api-ms-win-crt-runtime-l1-1-0

_errno
_invalid_parameter_noinfo
_seh_filter_dll
_invalid_parameter_noinfo_noreturn
terminate
_configure_narrow_argv
_initialize_narrow_environment
_initterm_e
_initterm
_cexit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf
__acrt_iob_func

api-ms-win-crt-time-l1-1-0

strftime
_localtime64_s
_gmtime64_s

api-ms-win-crt-string-l1-1-0

strcmp
isdigit

api-ms-win-crt-math-l1-1-0

_fdsign
_dsign
_ldsign
ceilf

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func

Exports

Exports

Create_Kernel
Create_Params

Sections

.text
Size: 287KB - Virtual size: 286KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 230KB - Virtual size: 230KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 41KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

boostdll
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b23ed0b4b0156d7dac27b52bc92a3bc6

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

shell32

ole32

oleaut32

boost_thread-vc144-mt-x64-1_85

fmt

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Exports

Exports

Sections

.text Size: 287KB - Virtual size: 286KB

.rdata Size: 230KB - Virtual size: 230KB

.data Size: 41KB - Virtual size: 47KB

.pdata Size: 16KB - Virtual size: 15KB

boostdll Size: 512B - Virtual size: 16B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 287KB - Virtual size: 286KB

.rdata
Size: 230KB - Virtual size: 230KB

.data
Size: 41KB - Virtual size: 47KB

.pdata
Size: 16KB - Virtual size: 15KB

boostdll
Size: 512B - Virtual size: 16B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 4KB