490da7c7b6f2511c60946fb09e4db1ebc01b048eabcee8da2ba8bb53596082a0

Sharing

Copy URL Twitter E-mail

General

Target

490da7c7b6f2511c60946fb09e4db1ebc01b048eabcee8da2ba8bb53596082a0
Size

798KB
MD5

e1b0cb4901f0898aef1d492637b51978
SHA1

d94a4b7cacecf325114a0530f416b913cc4990a3
SHA256

490da7c7b6f2511c60946fb09e4db1ebc01b048eabcee8da2ba8bb53596082a0
SHA512

3d7a908286d759418baa8996803aca61fa49454d7c1b07362846ba76d35cf1ba488fec1ec2c2bc4cf2850c3335c1ffcd32cf77e0435d96f7d8fd2416a0fdb4af
SSDEEP

24576:WKuRinB+ZNq94UgAQoeNhRiHHJk5I8FIOHYHR:3uRK+294aLr8tOR

Score

3^/10

Malware Config

Signatures

Unsigned PE 3 IoCs

Checks for missing Authenticode signature.

resource
unpack001/idsutils90/x64win/ar2idt64.exe
unpack001/idsutils90/x64win/dll2idt64.exe
unpack001/idsutils90/x64win/zipids64.exe

Files

490da7c7b6f2511c60946fb09e4db1ebc01b048eabcee8da2ba8bb53596082a0
.zip
idsutils90/armmac/ar2idt64
.macho macos arch:arm64
idsutils90/armmac/dll2idt64
.macho macos arch:arm64
idsutils90/armmac/zipids64
.macho macos arch:arm64
idsutils90/readme.txt
idsutils90/x64linux/ar2idt64
.elf linux x64
idsutils90/x64linux/dll2idt64
.elf linux x64
idsutils90/x64linux/zipids64
.elf linux x64
idsutils90/x64mac/ar2idt64
.macho macos arch:x64
idsutils90/x64mac/dll2idt64
.macho macos arch:x64
idsutils90/x64mac/zipids64
.macho macos arch:x64
idsutils90/x64win/ar2idt64.exe
.exe windows:6 windows x64 arch:x64

6825b247cf3bd64b94787c2d000098c4

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

ar2idt64.pdb

Imports

msvcp140

?_Xlength_error@std@@YAXPEBD@Z

advapi32

CryptGenRandom
CryptAcquireContextA
CryptReleaseContext

kernel32

UnhandledExceptionFilter
IsDebuggerPresent
QueryPerformanceCounter
ExitProcess
GetSystemTimeAsFileTime
GetTempPathW
GetFileAttributesW
CloseHandle
MultiByteToWideChar
GetProcAddress
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
TerminateProcess
GetCurrentThreadId
GetCurrentProcessId
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
GetModuleHandleW
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
InitializeSListHead

vcruntime140

_purecall
__std_terminate
strchr
__std_exception_copy
__std_exception_destroy
strrchr
_CxxThrowException
memcpy
memmove
memset
strstr
memchr
__C_specific_handler
__current_exception
__current_exception_context

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-convert-l1-1-0

atoi
atol
_atoi64

api-ms-win-crt-stdio-l1-1-0

fwrite
_fseeki64
fread
feof
fclose
_wfopen_s
_set_fmode
_wfsopen
fputc
__p__commode
_ftelli64
__stdio_common_vfprintf
__acrt_iob_func
__stdio_common_vsscanf
__stdio_common_vsnprintf_s
__stdio_common_vsprintf

api-ms-win-crt-string-l1-1-0

strcmp
isxdigit
_strnicmp
isalnum
tolower
isdigit
strncmp
_stricmp
isspace

api-ms-win-crt-runtime-l1-1-0

_crt_atexit
_cexit
_register_onexit_function
_errno
_initialize_onexit_table
terminate
_initialize_narrow_environment
_configure_narrow_argv
_register_thread_local_exe_atexit_callback
_set_app_type
abort
strerror_s
_get_initial_narrow_environment
_initterm
_initterm_e
_exit
__p___argc
__p___argv
exit
_c_exit
_seh_filter_exe

api-ms-win-crt-time-l1-1-0

strftime
_time64
_localtime64_s

api-ms-win-crt-heap-l1-1-0

_set_new_mode
_callnewh
realloc
malloc
free
calloc

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-environment-l1-1-0

_dupenv_s

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 164KB - Virtual size: 164KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 92KB - Virtual size: 91KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 536B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
idsutils90/x64win/dll2idt64.exe
.exe windows:6 windows x64 arch:x64

65097302a22bfc93a6d12b678269d2d9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

dll2idt64.pdb

Imports

kernel32

IsDebuggerPresent
QueryPerformanceCounter
ExitProcess
GetSystemTimeAsFileTime
CloseHandle
MultiByteToWideChar
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TerminateProcess
GetCurrentThreadId
InitializeSListHead
GetCurrentProcessId
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
GetModuleHandleW

vcruntime140

__std_terminate
strchr
__current_exception_context
__std_exception_copy
__std_exception_destroy
strstr
_CxxThrowException
memmove
memset
strrchr
_purecall
__C_specific_handler
__current_exception

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-stdio-l1-1-0

fputc
__p__commode
__stdio_common_vsnprintf_s
__stdio_common_vsprintf
__stdio_common_vfprintf
_ftelli64
_fseeki64
fread
feof
_set_fmode
fclose
_wfsopen
__acrt_iob_func

api-ms-win-crt-filesystem-l1-1-0

remove
_findclose
_wfindnext64
_wfindfirst64

api-ms-win-crt-string-l1-1-0

strncmp
isdigit
_stricmp

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_configure_narrow_argv
_set_app_type
_seh_filter_exe
_get_initial_narrow_environment
_exit
__p___argc
__p___argv
_cexit
_c_exit
_initialize_narrow_environment
_initterm
exit
terminate
_errno
_initialize_onexit_table
_register_onexit_function
_register_thread_local_exe_atexit_callback
_crt_atexit

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-heap-l1-1-0

free
malloc
_callnewh
_set_new_mode
realloc

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 144B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
idsutils90/x64win/zipids64.exe
.exe windows:6 windows x64 arch:x64

f5b328d813d0aa9ef0607a9a634da95a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

zipids64.pdb

Imports

msvcp140

?_Xlength_error@std@@YAXPEBD@Z

advapi32

CryptGenRandom
CryptAcquireContextA
CryptReleaseContext

kernel32

InitializeSListHead
WaitForSingleObjectEx
IsDebuggerPresent
QueryPerformanceCounter
ExitProcess
GetSystemTimeAsFileTime
GetTempPathW
CreateFileW
GetFileAttributesW
GetFileTime
CloseHandle
MultiByteToWideChar
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
TerminateProcess
GetCurrentThreadId
GetModuleFileNameW
GetProcAddress
LoadLibraryA
GetCurrentProcessId
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
IsProcessorFeaturePresent
CreateEventW
GetModuleHandleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess

vcruntime140

__std_terminate
__current_exception_context
memcpy
memmove
strchr
strrchr
__std_exception_copy
__std_exception_destroy
strstr
_CxxThrowException
_purecall
memset
__C_specific_handler
__current_exception

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_crt_atexit
_exit
__p___argc
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_set_app_type
_seh_filter_exe
_cexit
strerror_s
_c_exit
_register_thread_local_exe_atexit_callback
_errno
__p___argv
terminate
_register_onexit_function
_initialize_onexit_table

api-ms-win-crt-stdio-l1-1-0

fgets
fputc
_wfsopen
__p__commode
__stdio_common_vfprintf
fopen
fwrite
_ftelli64
_fseeki64
fread
fclose
_wfopen_s
ferror
feof
__acrt_iob_func
_set_fmode
__stdio_common_vsnprintf_s
__stdio_common_vsprintf

api-ms-win-crt-string-l1-1-0

strncmp
_stricmp
strspn
strpbrk
toupper
_strnicmp
isalnum
isdigit
isspace
tolower

api-ms-win-crt-convert-l1-1-0

strtol
atoi

api-ms-win-crt-heap-l1-1-0

free
malloc
realloc
_callnewh
_set_new_mode

api-ms-win-crt-time-l1-1-0

_localtime64_s
_time64

api-ms-win-crt-filesystem-l1-1-0

_findclose
_wstat64
_wfindnext64
_wfindfirst64
_wmkdir

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-environment-l1-1-0

_dupenv_s

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 97KB - Virtual size: 96KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 268B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6825b247cf3bd64b94787c2d000098c4

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcp140

advapi32

kernel32

vcruntime140

vcruntime140_1

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 164KB - Virtual size: 164KB

.rdata Size: 92KB - Virtual size: 91KB

.data Size: 512B - Virtual size: 2KB

.pdata Size: 5KB - Virtual size: 5KB

.reloc Size: 1024B - Virtual size: 536B

65097302a22bfc93a6d12b678269d2d9

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

vcruntime140

vcruntime140_1

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 17KB - Virtual size: 17KB

.rdata Size: 9KB - Virtual size: 9KB

.data Size: 512B - Virtual size: 3KB

.pdata Size: 2KB - Virtual size: 1KB

.reloc Size: 512B - Virtual size: 144B

f5b328d813d0aa9ef0607a9a634da95a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcp140

advapi32

kernel32

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 97KB - Virtual size: 96KB

.rdata Size: 30KB - Virtual size: 30KB

.text
Size: 164KB - Virtual size: 164KB

.rdata
Size: 92KB - Virtual size: 91KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 5KB - Virtual size: 5KB

.reloc
Size: 1024B - Virtual size: 536B

.text
Size: 17KB - Virtual size: 17KB

.rdata
Size: 9KB - Virtual size: 9KB

.data
Size: 512B - Virtual size: 3KB

.pdata
Size: 2KB - Virtual size: 1KB

.reloc
Size: 512B - Virtual size: 144B

.text
Size: 97KB - Virtual size: 96KB

.rdata
Size: 30KB - Virtual size: 30KB

.data
Size: 512B - Virtual size: 2KB

.pdata
Size: 5KB - Virtual size: 5KB

.reloc
Size: 512B - Virtual size: 268B