aaf8142535cdb6f0d4d4c191e699dd53c41f3a0498fdc37a5e87dc9167c31466

Sharing

Copy URL Twitter E-mail

General

Target

aaf8142535cdb6f0d4d4c191e699dd53c41f3a0498fdc37a5e87dc9167c31466
Size

8KB
MD5

4fadb3ac032e1c83325b2b48a44a4d4a
SHA1

c0b212b4da1045a16910574930fba893f272f604
SHA256

aaf8142535cdb6f0d4d4c191e699dd53c41f3a0498fdc37a5e87dc9167c31466
SHA512

3bd880d16b3f39ae154bac98b57f8bceaffe6a37b7e2bc433f80b1a6225e3f2ab8733a528d0f824553a373031f1f18c42c83d2ceb6d24e2e0bc24e08ca66f349
SSDEEP

192:MdS1NQeO1UGjpSZJhOLx8xYRxIbW3WVEDEe:lNKKGAFqx8xYR+bB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aaf8142535cdb6f0d4d4c191e699dd53c41f3a0498fdc37a5e87dc9167c31466

Files

aaf8142535cdb6f0d4d4c191e699dd53c41f3a0498fdc37a5e87dc9167c31466
.exe windows:6 windows x64 arch:x64

30c09aa235da03ff80516aa7ba89462e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

G:\devops_yanfa\workspace\p-41dc660c9dff45ceb0ac4728906bfede\src\Src\SymbolTable\x64\Release\cmdCheckHEVC.pdb

Imports

kernel32

SetUnhandledExceptionFilter
SetEvent
OpenEventW
CloseHandle
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
IsDebuggerPresent
EncodePointer
DecodePointer

wscuda

ord76

ws_log

SetBugSplatActiveDialog
ord50
ord400
ord51
ord2

msvcr120

__crtTerminateProcess
wcstol
exit
_XcptFilter
_amsg_exit
__wgetmainargs
__set_app_type
_exit
_cexit
_configthreadlocale
__setusermatherr
_initterm_e
_onexit
__C_specific_handler
__winitenv
_fmode
_commode
__crt_debugger_hook
__crtUnhandledException
_initterm
__crtCapturePreviousContext
?terminate@@YAXXZ
__crtSetUnhandledExceptionFilter
_lock
_unlock
_calloc_crt
__dllonexit

Sections

.text
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 264B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

30c09aa235da03ff80516aa7ba89462e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

wscuda

ws_log

msvcr120

Sections

.text Size: 2KB - Virtual size: 2KB

.rdata Size: 3KB - Virtual size: 2KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 512B - Virtual size: 264B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 512B - Virtual size: 24B

.text
Size: 2KB - Virtual size: 2KB

.rdata
Size: 3KB - Virtual size: 2KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 512B - Virtual size: 264B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 512B - Virtual size: 24B