83bd9627757ab25691a0deb0001988d68dac8f0ba71702618592853c9b88763f

Sharing

Copy URL Twitter E-mail

General

Target

83bd9627757ab25691a0deb0001988d68dac8f0ba71702618592853c9b88763f
Size

1.1MB
MD5

c187008a33aec172a3ad002fce4fbcdb
SHA1

0cbdfb50ce77365e654a7fc6d85d736656b35d79
SHA256

83bd9627757ab25691a0deb0001988d68dac8f0ba71702618592853c9b88763f
SHA512

f6de50c491a2e3871c0a501637a938544f3be31af076dfa4f36f8667ee9c5ad63d868d30307bc623d75ea4022ce292b670b7db20661e1bc6e6bb4d5e46270b8a
SSDEEP

24576:oRJ1jmOKJtrFDyYPCl4G/z61eiGQvLJrTZXQ:6jm3DKVz61ei/91XQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
83bd9627757ab25691a0deb0001988d68dac8f0ba71702618592853c9b88763f

Files

83bd9627757ab25691a0deb0001988d68dac8f0ba71702618592853c9b88763f
.exe windows:5 windows x86 arch:x86

adf09dee826515c9bd6ba4f10951220f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

G:\se15_114\src\out\Release\win_clang_x86\initialexe\ceup.exe.pdb

Imports

msimg32

AlphaBlend

version

GetFileVersionInfoSizeW
GetFileVersionInfoW
VerQueryValueW

kernel32

AcquireSRWLockExclusive
AssignProcessToJobObject
CancelWaitableTimer
CloseHandle
CompareStringW
CreateEventW
CreateFileA
CreateFileW
CreateMutexW
CreateProcessW
CreateThread
CreateWaitableTimerW
DecodePointer
DeleteCriticalSection
DeleteFileW
DeleteProcThreadAttributeList
DeviceIoControl
EncodePointer
EnterCriticalSection
EnumSystemLocalesW
ExitProcess
ExitThread
ExpandEnvironmentStringsW
FindClose
FindFirstFileExW
FindNextFileW
FindResourceW
FlushFileBuffers
FlushInstructionCache
FormatMessageW
FreeEnvironmentStringsW
FreeLibrary
FreeLibraryAndExitThread
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetConsoleMode
GetConsoleOutputCP
GetCurrentDirectoryW
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetDateFormatW
GetDiskFreeSpaceExW
GetDriveTypeW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetExitCodeProcess
GetFileAttributesExW
GetFileAttributesW
GetFileSize
GetFileSizeEx
GetFileType
GetFullPathNameW
GetLastError
GetLocalTime
GetLocaleInfoW
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetModuleHandleW
GetNativeSystemInfo
GetOEMCP
GetProcAddress
GetProcessHeap
GetProcessId
GetProductInfo
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemDirectoryW
GetSystemInfo
GetSystemTimeAsFileTime
GetTempFileNameW
GetTempPathW
GetThreadPriority
GetTickCount
GetTimeFormatW
GetTimeZoneInformation
GetUserDefaultLCID
GetUserDefaultLangID
GetVersionExW
GetWindowsDirectoryW
GlobalAlloc
GlobalFree
HeapAlloc
HeapDestroy
HeapFree
HeapLock
HeapReAlloc
HeapSize
HeapUnlock
HeapWalk
InitOnceExecuteOnce
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
InitializeProcThreadAttributeList
InitializeSListHead
InterlockedPopEntrySList
InterlockedPushEntrySList
IsBadReadPtr
IsBadWritePtr
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
IsWow64Process
K32GetModuleFileNameExW
LCMapStringW
LeaveCriticalSection
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
LoadResource
LocalFileTimeToFileTime
LocalFree
LockResource
MultiByteToWideChar
OpenProcess
OpenThread
OutputDebugStringA
OutputDebugStringW
QueryPerformanceCounter
QueryPerformanceFrequency
QueryThreadCycleTime
RaiseException
ReadConsoleW
ReadFile
ReleaseMutex
ReleaseSRWLockExclusive
ResetEvent
RtlCaptureStackBackTrace
RtlUnwind
SetEndOfFile
SetEnvironmentVariableW
SetEvent
SetFilePointer
SetFilePointerEx
SetFileTime
SetHandleInformation
SetLastError
SetStdHandle
SetThreadPriority
SetUnhandledExceptionFilter
SetWaitableTimer
SizeofResource
Sleep
SleepConditionVariableSRW
SystemTimeToFileTime
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryAcquireSRWLockExclusive
UnhandledExceptionFilter
UpdateProcThreadAttribute
VerSetConditionMask
VerifyVersionInfoW
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WaitForSingleObjectEx
WakeAllConditionVariable
WideCharToMultiByte
WriteConsoleW
WriteFile
lstrcmpA
lstrcmpiA
lstrcmpiW

ole32

CoCreateInstance
CoInitialize
CoTaskMemAlloc
CoTaskMemFree
CoTaskMemRealloc
CoUninitialize
CreateStreamOnHGlobal

gdiplus

GdipAlloc
GdipCloneImage
GdipCreateBitmapFromStream
GdipCreateHBITMAPFromBitmap
GdipDisposeImage
GdipFree
GdiplusShutdown
GdiplusStartup

winmm

timeGetTime

netapi32

Netbios

Exports

Exports

GetHandleVerifier

Sections

.text
Size: 818KB - Virtual size: 818KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 114KB - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 181B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 112KB - Virtual size: 112KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 34KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

adf09dee826515c9bd6ba4f10951220f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msimg32

version

kernel32

ole32

gdiplus

winmm

netapi32

Exports

Exports

Sections

.text Size: 818KB - Virtual size: 818KB

.rdata Size: 114KB - Virtual size: 114KB

.data Size: 14KB - Virtual size: 96KB

.tls Size: 512B - Virtual size: 181B

.rsrc Size: 112KB - Virtual size: 112KB

.reloc Size: 34KB - Virtual size: 33KB

.text
Size: 818KB - Virtual size: 818KB

.rdata
Size: 114KB - Virtual size: 114KB

.data
Size: 14KB - Virtual size: 96KB

.tls
Size: 512B - Virtual size: 181B

.rsrc
Size: 112KB - Virtual size: 112KB

.reloc
Size: 34KB - Virtual size: 33KB