register[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

register.exe
Size

19KB
MD5

ce20d652f15d1d3cf97cced6746daf5f
SHA1

edc8e147c95ead173fe6fc39414a6d6da02155ad
SHA256

01bc46ca158533e8684029f2f0da0aa9141780a2fb0e24d872ae2f601d298901
SHA512

018e897864663b301770ceec8db1af3ff41b33c2fcd5a063e9b3431dda17d9de7470ae2b8619e70eeeb8e8457cc814efa807d41728b3895ea9c827cea7163ba8
SSDEEP

384:Vlr6X6gA0RIr6C4Aw8c4WGW4fezjmWzPB8BGlsQ5:rA6fWzA2ZGozjmYZlsQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
register.exe

Files

register.exe
.exe windows:6 windows x64 arch:x64

ee1d8ed3e65bc218f20d68fd8f52d981

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\admin\source\repos\register\x64\Release\register.pdb

Imports

kernel32

CreateThreadpoolWork
GetDriveTypeW
SubmitThreadpoolWork
CreateThreadpoolCleanupGroup
GetLastError
Sleep
CloseThreadpoolCleanupGroupMembers
CloseThreadpoolCleanupGroup
FindClose
GetModuleFileNameW
FindNextFileW
CreateThreadpool
FindFirstFileW
RtlLookupFunctionEntry
CloseThreadpool
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
GetModuleHandleW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
IsProcessorFeaturePresent
RtlCaptureContext

advapi32

CryptDestroyKey
CryptAcquireContextW
CryptEncrypt
CryptGenRandom
AllocateAndInitializeSid
CryptCreateHash
CryptDeriveKey
CryptHashData
CryptDestroyHash
FreeSid
CheckTokenMembership
CryptSetKeyParam
CryptReleaseContext

shell32

SHGetKnownFolderPath
ShellExecuteExW
ShellExecuteW

ole32

CoTaskMemFree

wininet

InternetCloseHandle
HttpSendRequestW
HttpOpenRequestW
InternetConnectW
InternetOpenW

vcruntime140

__current_exception
memset
__current_exception_context
strrchr
strstr
__C_specific_handler
memcpy

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_get_initial_narrow_environment
_initterm_e
_configure_narrow_argv
_initialize_onexit_table
_register_onexit_function
_exit
_crt_atexit
terminate
_initialize_narrow_environment
_initterm
exit
_set_app_type

api-ms-win-crt-utility-l1-1-0

srand
rand

api-ms-win-crt-stdio-l1-1-0

_set_fmode
fread
feof
__stdio_common_vsprintf
__p__commode
__stdio_common_vfprintf
fclose
__acrt_iob_func
fopen
fwrite

api-ms-win-crt-filesystem-l1-1-0

remove
_stat64i32

api-ms-win-crt-string-l1-1-0

_stricmp
_strdup
strcmp

api-ms-win-crt-convert-l1-1-0

wcstombs

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-heap-l1-1-0

free
malloc
_set_new_mode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 696B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ee1d8ed3e65bc218f20d68fd8f52d981

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

shell32

ole32

wininet

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 8KB - Virtual size: 7KB

.rdata Size: 7KB - Virtual size: 7KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 1024B - Virtual size: 696B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 512B - Virtual size: 48B

.text
Size: 8KB - Virtual size: 7KB

.rdata
Size: 7KB - Virtual size: 7KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 1024B - Virtual size: 696B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 512B - Virtual size: 48B