1418e667251606b707473ff28c7bf5a1bcda05523c8ee13aeccf266b083b091e

Sharing

Copy URL

Twitter E-mail

General

Target

1418e667251606b707473ff28c7bf5a1bcda05523c8ee13aeccf266b083b091e
Size

167KB
MD5

5acf7e15ca196ee7f59002c1224a577a
SHA1

8c1c62b9db9e0d99387452cc55adca4bb02703ed
SHA256

1418e667251606b707473ff28c7bf5a1bcda05523c8ee13aeccf266b083b091e
SHA512

cf12e9acca7a1febb996d8708a9dba9328878a2d888841ef3a1efba89d1c067220aade9acc9522725d1ecb6311b70671698329ca0d47a979d4cca6e76d773c72
SSDEEP

1536:e4GPFpTjV6ENT0Ii51XJnxj7f6t0z2zYTeDMh+K8nTpVYbk5WwSVD:et7vV6Et0IGX3z2zYTWMh+K8PjfKD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1418e667251606b707473ff28c7bf5a1bcda05523c8ee13aeccf266b083b091e

Files

1418e667251606b707473ff28c7bf5a1bcda05523c8ee13aeccf266b083b091e
.exe windows:6 windows x86 arch:x86

b5091753f14d031663e8c73c96a37624

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\jenkins\workspace\CWA_SSONWrapper_release-2402-cu1\SSONWrapper\SSON\src\ssondir\ssonsvr\Release\Ssonsvr.pdb

Imports

wintrust

WinVerifyTrust

msi

ord89

secur32

LsaGetLogonSessionData
LsaFreeReturnBuffer

rpcrt4

RpcServerInqBindings
RpcServerListen
RpcBindingVectorFree
RpcServerRegisterIf3
RpcServerUnregisterIf
RpcServerUseProtseqEpA
RpcMgmtStopServerListening
RpcServerRegisterAuthInfoA
RpcEpRegisterA
I_RpcBindingInqLocalClientPID
RpcBindingSetAuthInfoA
RpcStringFreeA
RpcStringBindingComposeA
RpcBindingFromStringBindingA
RpcBindingFree
NdrServerCall2

kernel32

WriteFile
CreateNamedPipeA
ReadFile
FreeLibrary
GetProcAddress
LoadLibraryA
GetLongPathNameA
OpenProcess
QueryFullProcessImageNameA
SetEnvironmentVariableA
HeapAlloc
HeapFree
GetProcessHeap
SetEvent
ReleaseSemaphore
WaitForSingleObject
OpenEventA
GetCurrentProcessId
CreateSemaphoreA
CreateFileA
SetNamedPipeHandleState
ResetEvent
CreateEventA
Sleep
ProcessIdToSessionId
MapViewOfFile
UnmapViewOfFile
CreateFileMappingA
CreateDirectoryA
GetFileAttributesA
OutputDebugStringA
GetCurrentThreadId
FindClose
FindFirstFileA
GetCurrentProcess
GetModuleFileNameA
GetModuleHandleA
MultiByteToWideChar
LoadLibraryW
GetSystemDirectoryW
InitializeCriticalSection
InterlockedIncrement
VirtualFree
IsBadReadPtr
VirtualAlloc
VirtualLock
LeaveCriticalSection
EnterCriticalSection
GetVersionExA
GetComputerNameA
GetVersion
ConnectNamedPipe
LocalFree
LocalAlloc
CreateThread
DisconnectNamedPipe
GetLastError
CloseHandle
FlushFileBuffers
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
OpenSemaphoreA
GetSystemDirectoryA

user32

TranslateMessage
DispatchMessageA
DefWindowProcA
PostMessageA
PostQuitMessage
RegisterClassExA
CreateWindowExA
GetMessageA
RegisterWindowMessageA

advapi32

RegCloseKey
IsValidSecurityDescriptor
SetEntriesInAclA
SetSecurityDescriptorDacl
IsValidSid
InitializeSecurityDescriptor
FreeSid
AllocateAndInitializeSid
RegOpenKeyExA
RegQueryValueExA
OpenProcessToken
GetUserNameA
RegCreateKeyExW
CryptHashData
RegSetValueExA
RegOpenKeyA
RegDeleteValueA
RegDeleteKeyA
RegCreateKeyA
SetSecurityInfo
ConvertStringSecurityDescriptorToSecurityDescriptorA
RegQueryValueExW
RegOpenKeyExW
LookupAccountNameW
AddAccessAllowedAce
CopySid
EqualSid
GetLengthSid
GetTokenInformation
InitializeAcl
IsWellKnownSid
SetSecurityDescriptorOwner

msvcp140

?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAVios_base@1@AAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
?uncaught_exception@std@@YA_NXZ
?_Xlength_error@std@@YAXPBD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ

vcruntime140

__std_exception_copy
__std_exception_destroy
_CxxThrowException
__CxxFrameHandler3
memmove
_except_handler4_common
__std_type_info_destroy_list
__current_exception
__current_exception_context
memset
__std_terminate
strchr
strrchr
wcsstr
strstr
memcpy

api-ms-win-crt-runtime-l1-1-0

_errno
_invalid_parameter_noinfo
_register_onexit_function
_initialize_onexit_table
_seh_filter_dll
_crt_atexit
_crt_at_quick_exit
_controlfp_s
_register_thread_local_exe_atexit_callback
terminate
_c_exit
_cexit
_exit
_initterm_e
_invalid_parameter_noinfo_noreturn
exit
_seh_filter_exe
_set_app_type
_execute_onexit_table
_configure_narrow_argv
_initialize_narrow_environment
_initterm
_get_narrow_winmain_command_line

api-ms-win-crt-string-l1-1-0

strncpy_s
_strdup
_strnicmp
strncmp
strnlen
_wcsicmp
wcsncpy_s
strspn
toupper
wcscat_s
_strupr_s
_stricmp
strncat_s
strcat_s
wcscpy_s
strcpy_s

api-ms-win-crt-heap-l1-1-0

realloc
malloc
_callnewh
_set_new_mode
free

api-ms-win-crt-convert-l1-1-0

_wtol
_strtoui64
_atoi64
atol

api-ms-win-crt-stdio-l1-1-0

_set_fmode
fgets
fclose
__stdio_common_vsnwprintf_s
fseek
ftell
__stdio_common_vsprintf_s
__p__commode
fflush
__stdio_common_vsnprintf_s
__stdio_common_vfprintf
fopen

api-ms-win-crt-locale-l1-1-0

setlocale
_configthreadlocale

api-ms-win-crt-time-l1-1-0

strftime
_time64
_localtime64

api-ms-win-crt-math-l1-1-0

__setusermatherr

Sections

.text
Size: 82KB - Virtual size: 82KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 11KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 270B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b5091753f14d031663e8c73c96a37624

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

wintrust

msi

secur32

rpcrt4

kernel32

user32

advapi32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

Sections

.text Size: 82KB - Virtual size: 82KB

.rdata Size: 26KB - Virtual size: 26KB

.data Size: 3KB - Virtual size: 8KB

.idata Size: 11KB - Virtual size: 10KB

.00cfg Size: 512B - Virtual size: 270B

.rsrc Size: 36KB - Virtual size: 36KB

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 82KB - Virtual size: 82KB

.rdata
Size: 26KB - Virtual size: 26KB

.data
Size: 3KB - Virtual size: 8KB

.idata
Size: 11KB - Virtual size: 10KB

.00cfg
Size: 512B - Virtual size: 270B

.rsrc
Size: 36KB - Virtual size: 36KB

.reloc
Size: 6KB - Virtual size: 6KB