c10aad30d686a29d449482aa62f767d0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

c10aad30d686a29d449482aa62f767d0N.exe
Size

803KB
MD5

c10aad30d686a29d449482aa62f767d0
SHA1

c5d3fc729e064f00aae1aefc277b0b177fd43151
SHA256

43528625c5177a2351ea3e0d99449cccb1a38b336b78ef5e62b2092b644dfc4f
SHA512

58117ecdfcca14a6e0d2e086201313f947311e52ab0970c17260dbb9f42dbdc059f5d45ed19540b4f2b3a09771a8a6655357c38f00abe59c78b251cf410b2b4f
SSDEEP

24576:WohUMaExsnhV/i328ab4F+rM/aXq6bJfBUam6:7mNDX/i3da1YS6ozB

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c10aad30d686a29d449482aa62f767d0N.exe

Files

c10aad30d686a29d449482aa62f767d0N.exe
.exe windows:10 windows x86 arch:x86

486f924107195f6d293d7541b56fff5a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

betest.pdb

Imports

advapi32

OpenProcessToken
AdjustTokenPrivileges
GetTokenInformation
LookupPrivilegeValueW
CloseServiceHandle
ControlService
OpenSCManagerW
OpenServiceW
QueryServiceStatus
StartServiceW
ReportEventW
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
TraceEvent
DeregisterEventSource
OpenThreadToken
ConvertSidToStringSidW
RegOpenKeyExW
RegQueryValueExW
RegCloseKey
RegQueryInfoKeyW
RegEnumValueW
RegisterEventSourceW

kernel32

GetTempFileNameW
SetEndOfFile
SetFilePointer
RaiseException
GetFileSizeEx
CopyFileW
MoveFileExW
FindFirstFileW
GetVolumeNameForVolumeMountPointW
GetFileTime
GetFileAttributesW
lstrcmpiW
FindNextFileW
CloseHandle
GetLastError
HeapSetInformation
GetVersionExW
ExpandEnvironmentStringsW
GetFullPathNameW
GetVolumePathNameW
AcquireSRWLockShared
ReleaseSRWLockShared
AcquireSRWLockExclusive
FindClose
InitializeSRWLock
MultiByteToWideChar
FreeLibrary
GetCurrentThread
FormatMessageW
GetCommandLineW
GetSystemTime
TlsFree
TlsGetValue
GetProcAddress
TlsAlloc
TlsSetValue
GetTickCount
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
OutputDebugStringA
OutputDebugStringW
CreateDirectoryW
GetCurrentProcess
SetLastError
WriteFile
ReadFile
GetFileSize
CreateFileW
LocalFree
LocalAlloc
ReleaseSRWLockExclusive
CompareFileTime
Sleep
LoadLibraryExW

msvcrt

getchar
memcpy_s
memmove_s
_wcsicmp
wprintf
??0exception@@QAE@XZ
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
_except_handler4_common
_controlfp
??1type_info@@UAE@XZ
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
_initterm
__setusermatherr
__p__fmode
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
__p__commode
_XcptFilter
_callnewh
wcstoul
iswalpha
mbstowcs
_wcsdup
_vsnwprintf
time
swprintf
clock
_purecall
malloc
realloc
free
wcsrchr
memset
memcpy
printf
_wcsnicmp
wcsstr
wcschr
towlower
_vsnprintf
__CxxFrameHandler3
_CxxThrowException

atl

ord30

user32

LoadStringW
wsprintfW
CharUpperW

ole32

CoTaskMemRealloc
CoUninitialize
CoCreateInstance
CLSIDFromString
CoInitializeSecurity
CoFileTimeNow
StringFromCLSID
CoTaskMemAlloc
CoTaskMemFree
CoInitializeEx

oleaut32

VariantClear
SysAllocStringLen
SysAllocString
GetErrorInfo
SysStringLen
SysFreeString

rpcrt4

RpcStringFreeW
UuidFromStringW
UuidToStringW

vssapi

GetProviderMgmtInterfaceInternal
CreateWriter
CreateVssBackupComponentsInternal
CreateVssExamineWriterMetadataInternal

resutils

ClusterGetVolumePathName
ClusterIsPathOnSharedVolume
ClusterPrepareSharedVolumeForBackup
ClusterGetVolumeNameForVolumeMountPoint

api-ms-win-security-lsalookup-l1-1-0

LookupAccountSidLocalW

Sections

.text
Size: 215KB - Virtual size: 214KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 580KB - Virtual size: 584KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

486f924107195f6d293d7541b56fff5a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

msvcrt

atl

user32

ole32

oleaut32

rpcrt4

vssapi

resutils

api-ms-win-security-lsalookup-l1-1-0

Sections

.text Size: 215KB - Virtual size: 214KB

.data Size: 1024B - Virtual size: 7KB

.idata Size: 5KB - Virtual size: 4KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 580KB - Virtual size: 584KB

.text
Size: 215KB - Virtual size: 214KB

.data
Size: 1024B - Virtual size: 7KB

.idata
Size: 5KB - Virtual size: 4KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 580KB - Virtual size: 584KB