bdc022a51f64f118a22a91c8d9b857cee7b6e5ba490094e0be0c5c18ee4be2c9

Sharing

Copy URL Twitter E-mail

General

Target

bdc022a51f64f118a22a91c8d9b857cee7b6e5ba490094e0be0c5c18ee4be2c9
Size

618KB
MD5

0c95b2bf00ac6e1ef61159cb2414d1cf
SHA1

d44d18e9e1a7ad88d0e2d1d479d2ae770ec60247
SHA256

bdc022a51f64f118a22a91c8d9b857cee7b6e5ba490094e0be0c5c18ee4be2c9
SHA512

edbc29f2c0f409a1519429855166eddaf0806c925f1231c96bd8b90fd0f6da73f6b0516786c25a1c59c5809abd64851f10c7241fbb4f476898d4791f81ed9d29
SSDEEP

12288:TQTDuaqzPTY53of4XgbXZqHfdQCaIY//RnhOWrZVoexdqCLH31Ii3Dn:TOIPYPwbXZq6C7Y/5kWrZVoe/1LH3bDn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bdc022a51f64f118a22a91c8d9b857cee7b6e5ba490094e0be0c5c18ee4be2c9

Files

bdc022a51f64f118a22a91c8d9b857cee7b6e5ba490094e0be0c5c18ee4be2c9
.exe windows:10 windows x64 arch:x64

161f3c69b9f275480c338bbab3da4d6e

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

lodctr.pdb

Imports

msvcrt

_amsg_exit
__wgetmainargs
__set_app_type
wcschr
exit
_exit
_cexit
__setusermatherr
_initterm
_fmode
_commode
__C_specific_handler
fprintf
_wsplitpath_s
_vsnwprintf
memcpy
_XcptFilter
?terminate@@YAXXZ
__iob_func
_wtof
wcstoul
_wcsnicmp
floor
memset

loadperf

BackupPerfRegistryToFileW
UpdatePerfNameFilesW
LoadPerfCounterTextStringsW
RestorePerfRegistryFromFileW
LpAcquireInstallationMutex
LpReleaseInstallationMutex
SetServiceAsTrustedW

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW
GetStdHandle
SearchPathW
GetCurrentDirectoryW

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegSetValueExW
RegOpenKeyExW
RegCloseKey
RegEnumKeyExW
RegQueryInfoKeyW
RegDeleteValueW
RegQueryValueExW

api-ms-win-core-heap-l1-1-0

HeapSetInformation
GetProcessHeap
HeapReAlloc
HeapAlloc
HeapFree

api-ms-win-core-errorhandling-l1-1-0

GetLastError
SetUnhandledExceptionFilter
SetLastError
UnhandledExceptionFilter

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventWriteTransfer
EventUnregister

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
CompareStringOrdinal
WideCharToMultiByte

api-ms-win-core-localization-l1-2-0

SetThreadPreferredUILanguages
FormatMessageW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-libraryloader-l1-2-0

LoadStringW
GetModuleHandleW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcess
GetCurrentThreadId
GetCurrentProcessId
TerminateProcess

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTimeAsFileTime

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

api-ms-win-core-file-l1-1-0

GetFileSize
CreateFileW
ReadFile
GetFileType
WriteFile

api-ms-win-core-console-l1-1-0

WriteConsoleW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-registry-l2-1-0

RegDeleteKeyW
RegEnumKeyW

api-ms-win-base-util-l1-1-0

IsTextUnicode

Sections

.text
Size: 29KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 888B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 568KB - Virtual size: 572KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

161f3c69b9f275480c338bbab3da4d6e

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

loadperf

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-registry-l2-1-0

api-ms-win-base-util-l1-1-0

Sections

.text Size: 29KB - Virtual size: 29KB

.rdata Size: 16KB - Virtual size: 16KB

.data Size: 512B - Virtual size: 3KB

.pdata Size: 1024B - Virtual size: 888B

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 568KB - Virtual size: 572KB

.text
Size: 29KB - Virtual size: 29KB

.rdata
Size: 16KB - Virtual size: 16KB

.data
Size: 512B - Virtual size: 3KB

.pdata
Size: 1024B - Virtual size: 888B

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 568KB - Virtual size: 572KB