3d03cb514be425c6860f13ca4960a104d88c927b2210f421271400f318ba30ae

Sharing

Copy URL Twitter E-mail

General

Target

3d03cb514be425c6860f13ca4960a104d88c927b2210f421271400f318ba30ae
Size

850KB
MD5

28456803ae6cba4579238c3e8da6b2ea
SHA1

f17d9c687b42cfccb7d2289fb36d58336879a05d
SHA256

3d03cb514be425c6860f13ca4960a104d88c927b2210f421271400f318ba30ae
SHA512

0abfe631a58e8b057a653405a9d46f754165f0ed2d9edc7da10254bddcf9fb0570ff6fb0ce76aa16653095b85ef4ec062b4a3bdb233fdfa496d8c8d99cad0f52
SSDEEP

12288:2kVXi83YTfxyw/SY5qA21cPQ6FVrSf0nzzrG3RAqJW6xKQDf9c:2yy8oTf8w/zt3SsnzhkHKQTi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3d03cb514be425c6860f13ca4960a104d88c927b2210f421271400f318ba30ae

Files

3d03cb514be425c6860f13ca4960a104d88c927b2210f421271400f318ba30ae
.exe windows:6 windows x64 arch:x64

0258290054051dc97d524a35669fa771

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

rust_Xor_shellcode.pdb

Imports

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle
WakeByAddressAll
WaitOnAddress

ntdll

NtWriteFile
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlNtStatusToDosError
NtQuerySystemInformation
RtlGetVersion
NtQueryInformationProcess

advapi32

GetTokenInformation
OpenProcessToken
CopySid
GetLengthSid
IsValidSid

kernel32

GetModuleHandleA
IsProcessorFeaturePresent
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
CreateThread
HeapCreate
HeapAlloc
CloseHandle
GetSystemInfo
GetCurrentProcessId
VirtualQueryEx
GlobalMemoryStatusEx
K32GetPerformanceInfo
GetProcessTimes
LocalFree
GetProcessHeap
HeapFree
OpenProcess
GetSystemTimes
GetProcessIoCounters
ReadProcessMemory
LoadLibraryExA
GetProcAddress
FreeLibrary
GetLastError
WaitForSingleObject
FormatMessageW
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCurrentThread
SwitchToThread
QueryPerformanceCounter
SetLastError
GetCurrentDirectoryW
GetEnvironmentVariableW
GetCurrentProcess
GetStdHandle
GetSystemTimePreciseAsFileTime
HeapReAlloc
lstrlenW
ReleaseMutex
GetConsoleMode
GetModuleHandleW
MultiByteToWideChar
WriteConsoleW

pdh

PdhAddEnglishCounterW
PdhGetFormattedCounterValue
PdhRemoveCounter
PdhCloseQuery
PdhCollectQueryData
PdhOpenQueryA

powrprof

CallNtPowerInformation

oleaut32

SysFreeString
SysStringLen
GetErrorInfo

psapi

GetProcessMemoryInfo
GetModuleFileNameExW

shell32

CommandLineToArgvW

vcruntime140

memmove
__current_exception
memset
memcmp
memcpy
__C_specific_handler
_CxxThrowException
__CxxFrameHandler3
__current_exception_context

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode

api-ms-win-crt-string-l1-1-0

wcslen

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe
_set_app_type
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm_e
exit
_exit
terminate
_crt_atexit
__p___argc
_register_onexit_function
_initialize_onexit_table
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_initterm

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 205KB - Virtual size: 205KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 629KB - Virtual size: 629KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0258290054051dc97d524a35669fa771

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

bcryptprimitives

api-ms-win-core-synch-l1-2-0

ntdll

advapi32

kernel32

pdh

powrprof

oleaut32

psapi

shell32

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 205KB - Virtual size: 205KB

.rdata Size: 629KB - Virtual size: 629KB

.data Size: 512B - Virtual size: 904B

.pdata Size: 12KB - Virtual size: 12KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 205KB - Virtual size: 205KB

.rdata
Size: 629KB - Virtual size: 629KB

.data
Size: 512B - Virtual size: 904B

.pdata
Size: 12KB - Virtual size: 12KB

.reloc
Size: 1KB - Virtual size: 1KB