tmpw7rafoat | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

tmpw7rafoat
Size

621KB
MD5

1b943292caf15fa919dc8a893ae142ba
SHA1

9ac81b80dc36a29031d76ac2c657a2a4e5698f3d
SHA256

ceed6ced801282eb7fea4975c7319af3357a0e289628f3f8f36cf36e3287f2b8
SHA512

b7fe8ffcfbaf6dc188f3ab14cb2a8d31edae77abb04c2cc4bddb92646424be94b22089ffb4a589e68bb26e51f3fff9841fced6e0f25e7159b0a577336fc86288
SSDEEP

12288:v75EAasPEzwMHkPAlhduytDmuEz+BiIPZKs6J6uhbk:vhPEkINlhdusDmENYvJ6Iw

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
tmpw7rafoat

Files

tmpw7rafoat
.exe windows:6 windows x64 arch:x64

b7cadb4b198069b6e24cfc3f473121dc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

F:\memexec\test_loading\target\release\deps\test_loading.pdb

Imports

user32

MessageBoxA

kernel32

HeapSize
AcquireSRWLockExclusive
LCMapStringW
CompareStringW
ReleaseSRWLockExclusive
FlsFree
FlsSetValue
LoadLibraryExA
FreeLibrary
GetConsoleOutputCP
HeapAlloc
HeapFree
FlsGetValue
FlsAlloc
GetLastError
WaitForSingleObject
CloseHandle
FormatMessageW
GetProcessHeap
GetCurrentProcess
FindClose
FindNextFileW
CreateFileW
FlushFileBuffers
SetFilePointerEx
GetStringTypeW
SetStdHandle
GetModuleHandleA
GetSystemTimeAsFileTime
GetCPInfo
RtlLookupFunctionEntry
ReleaseSRWLockShared
GetEnvironmentStringsW
SetEnvironmentVariableW
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
GetCommandLineA
GetModuleHandleExW
WriteFile
LoadLibraryExW
TlsFree
GetProcAddress
AcquireSRWLockShared
SetThreadStackGuarantee
GetCurrentThread
Sleep
AddVectoredExceptionHandler
ReleaseMutex
WaitForSingleObjectEx
GetCurrentProcessId
CreateMutexA
QueryPerformanceCounter
QueryPerformanceFrequency
GetStdHandle
RtlCaptureContext
GetConsoleMode
MultiByteToWideChar
WriteConsoleW
WideCharToMultiByte
SetLastError
HeapReAlloc
GetCommandLineW
TlsSetValue
TlsGetValue
TlsAlloc
GetModuleFileNameW
GetFullPathNameW
GetEnvironmentVariableW
InitializeCriticalSectionAndSpinCount
GetCurrentDirectoryW
DeleteCriticalSection
LeaveCriticalSection
GetModuleHandleW
FreeEnvironmentStringsW
LoadLibraryA
ExitProcess
EnterCriticalSection
EncodePointer
RaiseException
RtlPcToFileHeader
RtlUnwindEx
IsProcessorFeaturePresent
GetFileType
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
IsDebuggerPresent
RtlVirtualUnwind
InitializeSListHead
TryAcquireSRWLockExclusive
GetCurrentThreadId

ole32

CoCreateInstance
CoInitializeEx
CoInitializeSecurity
CoSetProxyBlanket

oleaut32

SafeArrayDestroy
VariantClear
SafeArrayUnaccessData
SafeArrayGetLBound
SafeArrayGetUBound
SysAllocStringLen
SafeArrayAccessData
SysStringLen
SysFreeString
GetErrorInfo

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

ntdll

NtWriteFile
RtlNtStatusToDosError

Sections

.text
Size: 383KB - Virtual size: 382KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 210KB - Virtual size: 210KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b7cadb4b198069b6e24cfc3f473121dc

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

user32

kernel32

ole32

oleaut32

bcrypt

advapi32

ntdll

Sections

.text Size: 383KB - Virtual size: 382KB

.rdata Size: 210KB - Virtual size: 210KB

.data Size: 5KB - Virtual size: 9KB

.pdata Size: 17KB - Virtual size: 17KB

_RDATA Size: 512B - Virtual size: 500B

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 383KB - Virtual size: 382KB

.rdata
Size: 210KB - Virtual size: 210KB

.data
Size: 5KB - Virtual size: 9KB

.pdata
Size: 17KB - Virtual size: 17KB

_RDATA
Size: 512B - Virtual size: 500B

.reloc
Size: 3KB - Virtual size: 3KB