d60b6603cbf3490e3b961a822774df4a061ae76f8dff29f3ea95d1b7f827f64a

Sharing

Copy URL Twitter E-mail

General

Target

d60b6603cbf3490e3b961a822774df4a061ae76f8dff29f3ea95d1b7f827f64a
Size

235KB
MD5

512736d8da7fd97c2377e644b8e57bdb
SHA1

c1262d98836007a4fefa8a9a3df36f20ae8f92bb
SHA256

d60b6603cbf3490e3b961a822774df4a061ae76f8dff29f3ea95d1b7f827f64a
SHA512

1f9feaa105c3085125c8b14afbe2c6e1d57dae09cbe85eb4ebc9c7b8d86af5741fc99d498d6c2842f85199d9995b9827147f9486e278a989ebd88f41bba6c4c5
SSDEEP

3072:EqYNME3QRw2iwpirePhkYRDRMoYUtJ60tbaHHHDtsvr1:UME3d2iwpirePd9Mp5S2HOv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d60b6603cbf3490e3b961a822774df4a061ae76f8dff29f3ea95d1b7f827f64a

Files

d60b6603cbf3490e3b961a822774df4a061ae76f8dff29f3ea95d1b7f827f64a
.exe windows:6 windows x64 arch:x64

e1671944c0a720af49694a09f228147a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\Administrator\Desktop\Y4\MultiClrLoader\x64\Release\MultiClrLoader.pdb

Imports

msvcrt

ceil
log10
_fileno
fflush
_isatty
___lc_codepage_func
strcpy_s
wctomb_s
_mbtowc_l
strtol
__CppXcptFilter
_initterm
__getmainargs
__wgetmainargs
_environ
_wenviron
_msize
?terminate@@YAXXZ
abort
realloc
__C_specific_handler
memcpy
memset
strrchr
memmove
__CxxFrameHandler3
_amsg_exit
wcstol
malloc
free
strnlen
wcsnlen
___mb_cur_max_func
tolower
__pctype_func
_iob
_errno
_unlock
_set_fmode
?_set_new_mode@@YAHH@Z
_XcptFilter
__set_app_type
_commode
wcstombs_s
_setmbcp
_getmbcp
strchr
wcsrchr
_clearfp
_lock

kernel32

GetLocaleInfoEx
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
VirtualQuery
LoadLibraryExW
GetSystemDirectoryW
GetModuleHandleExW
FreeLibrary
GetCurrentThreadId
ExitProcess
Sleep
GetProcAddress
GetStartupInfoW
GetModuleHandleW
MultiByteToWideChar
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
EnterCriticalSection
LeaveCriticalSection
RtlCaptureContext

mscoree

_CorExeMain

Sections

.text
Size: 120KB - Virtual size: 120KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.nep
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 41KB - Virtual size: 41KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 300B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e1671944c0a720af49694a09f228147a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

kernel32

mscoree

Sections

.text Size: 120KB - Virtual size: 120KB

.nep Size: 1KB - Virtual size: 1KB

.rdata Size: 63KB - Virtual size: 62KB

.data Size: 1KB - Virtual size: 3KB

.pdata Size: 6KB - Virtual size: 5KB

.rsrc Size: 41KB - Virtual size: 41KB

.reloc Size: 512B - Virtual size: 300B

.text
Size: 120KB - Virtual size: 120KB

.nep
Size: 1KB - Virtual size: 1KB

.rdata
Size: 63KB - Virtual size: 62KB

.data
Size: 1KB - Virtual size: 3KB

.pdata
Size: 6KB - Virtual size: 5KB

.rsrc
Size: 41KB - Virtual size: 41KB

.reloc
Size: 512B - Virtual size: 300B