6b702b6567f4798694d80c0fc17f55c0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

6b702b6567f4798694d80c0fc17f55c0N.exe
Size

6.4MB
MD5

6b702b6567f4798694d80c0fc17f55c0
SHA1

9154f7dafc8ef806c0849549c985b3376b4a7321
SHA256

99459b987300335f4f078d1110ecf0c4900651ae4cc8b09d72c1007034737fe4
SHA512

53235db47578c243b078724f976fe22b7223e8938c2703c971bfb8705c4786fde5a64087c5d02a4e37f463e3a3a1f7a023a91edf3d18ce9929c16717abe004bf
SSDEEP

196608:mtoA9AT3mDYdY2+Ts1irhAz//kdc02E/iM3aQuydMVKg9V6uMNSV:goAI38hO/kdcLydMVcSV

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6b702b6567f4798694d80c0fc17f55c0N.exe

Files

6b702b6567f4798694d80c0fc17f55c0N.exe
.exe windows:6 windows x86 arch:x86

af751637688d6f9f27fe59c27b7838c0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

kernel32

WriteConsoleW
WideCharToMultiByte
QueryPerformanceFrequency
GetStringTypeW
TlsFree
GetStdHandle
RtlUnwind
GetTickCount
ReadFile
GetProcAddress
GetCurrentProcess
DecodePointer
CreateThread
InitializeCriticalSection
WriteFile
GetModuleHandleExW
SystemTimeToTzSpecificLocalTime
GetACP
GetVersionExA
SetEnvironmentVariableW
SetStdHandle
GetCPInfo
ExitProcess
GetSystemTimeAsFileTime
Sleep
CreateFileW
GetFileSize
SetFilePointerEx
DeleteFileW
WaitForMultipleObjects
GetEnvironmentVariableA
LoadLibraryExW
FileTimeToSystemTime
MoveFileExW
GetModuleHandleA
PeekNamedPipe
FindClose
UnhandledExceptionFilter
FindNextFileW
FindFirstFileExW
GetConsoleOutputCP
GetSystemDirectoryA
InitializeSListHead
RaiseException
GetLastError
CompareStringW
QueryPerformanceCounter
GetEnvironmentStringsW
HeapSize
GetFileSizeEx
GetFullPathNameW
FormatMessageA
LeaveCriticalSection
MultiByteToWideChar
GetCurrentProcessId
FlushFileBuffers
SleepEx
ExitThread
EnterCriticalSection
SetLastError
InitializeCriticalSectionAndSpinCount
GetFileAttributesExW
GetOEMCP
LoadLibraryA
FreeEnvironmentStringsW
GetCurrentDirectoryW
TlsAlloc
TerminateProcess
IsProcessorFeaturePresent
GetModuleFileNameW
WaitForSingleObject
TlsSetValue
CreateFileA
IsDebuggerPresent
IsValidCodePage
HeapReAlloc
LCMapStringW
EncodePointer
FreeLibrary
GetCommandLineW
GetFileType
FreeLibraryAndExitThread
GetFileInformationByHandle
HeapAlloc
GetTimeZoneInformation
CloseHandle
HeapFree
ReadConsoleW
GetModuleHandleW
SetUnhandledExceptionFilter
DeleteCriticalSection
GetProcessHeap
TlsGetValue
GetDriveTypeW
GetConsoleMode
GetCurrentThreadId
MoveFileExA
SetEndOfFile
GetStartupInfoW
GetCommandLineA

user32

LoadIconW
DrawTextW
CreateWindowExW
RedrawWindow
PostQuitMessage
GetWindowRect
DefWindowProcW
FillRect
ShowWindow
RegisterClassExW
GetClientRect
TranslateMessage
BeginPaint
SetWindowPos
DispatchMessageW
MessageBoxW
GetMessageW
GetSystemMetrics
UpdateWindow
PostMessageW
EndPaint

gdi32

CreateSolidBrush
SetTextColor
DeleteObject
SetBkMode

advapi32

CryptReleaseContext
CryptGetHashParam
CryptEncrypt
CryptCreateHash
CryptAcquireContextA
CryptHashData
RegEnumKeyExA
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptGenRandom

crypt32

CertFreeCertificateContext
CryptDecodeObjectEx
CertFreeCertificateChain
CertFindExtension
CertEnumCertificatesInStore
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
PFXImportCertStore
CertFindCertificateInStore
CertCloseStore
CertAddCertificateContextToStore
CertOpenStore
CryptQueryObject
CryptStringToBinaryA

wldap32

ord46
ord41
ord27
ord301
ord33
ord79
ord35
ord32
ord200
ord30
ord26
ord45
ord60
ord22
ord211
ord50
ord143
ord217

ws2_32

closesocket
send
WSAGetLastError
WSACleanup
WSAStartup
recv
ntohs
getsockname
getpeername
WSASetLastError
getsockopt
setsockopt
connect
WSAIoctl
bind
htons
socket
inet_ntoa
htonl
gethostbyname
inet_addr
getservbyname
gethostbyaddr
getservbyport
accept
listen
sendto
recvfrom
select
__WSAFDIsSet
gethostname
ntohl
ioctlsocket

Sections

.text
Size: 5.8MB - Virtual size: 5.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 136KB - Virtual size: 135KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 74KB - Virtual size: 74KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

af751637688d6f9f27fe59c27b7838c0

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

crypt32

wldap32

ws2_32

Sections

.text Size: 5.8MB - Virtual size: 5.8MB

.rdata Size: 136KB - Virtual size: 135KB

.data Size: 44KB - Virtual size: 58KB

.rsrc Size: 68KB - Virtual size: 67KB

.reloc Size: 74KB - Virtual size: 74KB

.text
Size: 5.8MB - Virtual size: 5.8MB

.rdata
Size: 136KB - Virtual size: 135KB

.data
Size: 44KB - Virtual size: 58KB

.rsrc
Size: 68KB - Virtual size: 67KB

.reloc
Size: 74KB - Virtual size: 74KB