b4533480a33a58cb27b256321018f4ce86094ca623d7a7a8c8bac4db86b16fb7

Sharing

Copy URL

Twitter E-mail

General

Target

b4533480a33a58cb27b256321018f4ce86094ca623d7a7a8c8bac4db86b16fb7
Size

529KB
MD5

95121bd73183a37ca502369d1351a58b
SHA1

fe8fa62c06c7e71461c725d57002772b55c130b4
SHA256

b4533480a33a58cb27b256321018f4ce86094ca623d7a7a8c8bac4db86b16fb7
SHA512

b11c4ea64928ff662b4a0669b2f98e729a0485db450466524fd2b051bef22072e00d32677e70b2e1db94e5bd019083f744ec83048131b0f5cb3e03938e7638d9
SSDEEP

12288:gg83khN4RBEWYgeWYg955/155/zrlph0lhSMXl+AZszDFC:gg83khN4Jh0lhSMXlHZszDF

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b4533480a33a58cb27b256321018f4ce86094ca623d7a7a8c8bac4db86b16fb7

Files

b4533480a33a58cb27b256321018f4ce86094ca623d7a7a8c8bac4db86b16fb7
.dll windows:6 windows x64 arch:x64

8862e685b80291bf253508d33fc52e31

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

F:\TemporaryBuilds\azure-adaware-pool-build-de-1\11\s\_build\bin\x64\Release\memory_boost.pdb

Imports

shell32

ExtractIconW

kernel32

FormatMessageA
WideCharToMultiByte
LocalFree
CloseHandle
HeapAlloc
GetProcessHeap
HeapFree
GetDynamicTimeZoneInformation
GetCurrentThreadId
GetCurrentProcessId
OpenProcess
K32GetProcessMemoryInfo
GetLastError
VirtualFree
VirtualAlloc
GlobalMemoryStatusEx
SetProcessWorkingSetSize
SetConsoleTextAttribute
GetConsoleScreenBufferInfo
WriteConsoleA
WriteFile
GetStdHandle
GetConsoleMode
LeaveCriticalSection
GetSystemDirectoryW
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
K32GetModuleFileNameExW
TerminateProcess
GetModuleFileNameW
MultiByteToWideChar
ReleaseSRWLockExclusive
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSection
QueryPerformanceCounter
GetModuleHandleW
AreFileApisANSI
AcquireSRWLockExclusive
WakeAllConditionVariable
SleepConditionVariableSRW
InitializeSListHead
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetSystemTimeAsFileTime
GetLocaleInfoEx

user32

GetIconInfo
DestroyIcon

gdi32

GetDIBits
DeleteDC
DeleteObject
CreateCompatibleDC

boost_thread-vc144-mt-x64-1_85

??0thread_data_base@detail@boost@@QEAA@XZ
?notify_all_at_thread_exit@thread_data_base@detail@boost@@UEAAXPEAVcondition_variable@3@PEAVmutex@3@@Z
?start_thread@thread@boost@@AEAAXXZ
??1thread@boost@@QEAA@XZ
??4thread@boost@@QEAAAEAV01@$$QEAV01@@Z
?join@thread@boost@@QEAAXXZ
??0thread@boost@@QEAA@XZ
?interruption_point@this_thread@boost@@YAXXZ
?interrupt@thread@boost@@QEAAXXZ
?joinable@thread@boost@@QEBA_NXZ
??1thread_data_base@detail@boost@@UEAA@XZ

fmt

?vformat@v10@fmt@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$basic_string_view@D@12@V?$basic_format_args@V?$basic_format_context@Vappender@v10@fmt@@D@v10@fmt@@@12@@Z
??$vformat_to@D@detail@v10@fmt@@YAXAEAV?$buffer@D@012@V?$basic_string_view@D@12@V?$basic_format_args@V?$basic_format_context@Vappender@v10@fmt@@D@v10@fmt@@@12@Vlocale_ref@012@@Z
?format_system_error@v10@fmt@@YAXAEAV?$buffer@D@detail@12@HPEBD@Z

msvcp140

?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?toupper@?$ctype@_W@std@@QEBA_W_W@Z
??Bid@locale@std@@QEAA_KXZ
?tolower@?$ctype@_W@std@@QEBA_W_W@Z
?is@?$ctype@_W@std@@QEBA_NF_W@Z
?_Winerror_map@std@@YAHH@Z
?_Syserror_map@std@@YAPEBDH@Z
?_Xbad_function_call@std@@YAXXZ
_Cnd_signal
?set_new_handler@std@@YAP6AXXZP6AXXZ@Z
_Cnd_destroy_in_situ
_Mtx_unlock
_Mtx_lock
_Thrd_join
?_Throw_Cpp_error@std@@YAXH@Z
_Thrd_id
_Xtime_get_ticks
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?id@?$ctype@_W@std@@2V0locale@2@A
?uncaught_exceptions@std@@YAHXZ

ntdll

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__C_specific_handler
__std_type_info_destroy_list
__current_exception_context
__std_terminate
__std_exception_copy
__std_exception_destroy
__std_type_info_compare
_purecall
__std_type_info_name
__current_exception
_CxxThrowException
memcpy
memmove
memset
memcmp

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__stdio_common_vfprintf

api-ms-win-crt-runtime-l1-1-0

_errno
_crt_atexit
_execute_onexit_table
_invalid_parameter_noinfo_noreturn
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_initterm
terminate
_cexit
_invalid_parameter_noinfo
_initterm_e
_register_onexit_function

api-ms-win-crt-time-l1-1-0

strftime
_gmtime64_s
_localtime64_s

api-ms-win-crt-heap-l1-1-0

free
malloc
_aligned_free
_aligned_malloc
_callnewh

api-ms-win-crt-string-l1-1-0

strcmp
isdigit

api-ms-win-crt-math-l1-1-0

ceilf

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

Exports

Exports

Create_Kernel
Create_Params

Sections

.text
Size: 254KB - Virtual size: 254KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 218KB - Virtual size: 217KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 34KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 14KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

boostdll
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

8862e685b80291bf253508d33fc52e31

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

shell32

kernel32

user32

gdi32

boost_thread-vc144-mt-x64-1_85

fmt

msvcp140

ntdll

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

version

Exports

Exports

Sections

.text Size: 254KB - Virtual size: 254KB

.rdata Size: 218KB - Virtual size: 217KB

.data Size: 34KB - Virtual size: 41KB

.pdata Size: 14KB - Virtual size: 14KB

boostdll Size: 512B - Virtual size: 16B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 254KB - Virtual size: 254KB

.rdata
Size: 218KB - Virtual size: 217KB

.data
Size: 34KB - Virtual size: 41KB

.pdata
Size: 14KB - Virtual size: 14KB

boostdll
Size: 512B - Virtual size: 16B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 4KB