5de752d3e69b1724af49b9c64c82be20N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

5de752d3e69b1724af49b9c64c82be20N.exe
Size

667KB
MD5

5de752d3e69b1724af49b9c64c82be20
SHA1

01677a9daf39c6570903dd1762d0d3e0dc86e007
SHA256

80dffc54e1688cb3900afc553d0a1eb47de7d2fdaf14546b3373ee0fa3a49f87
SHA512

2445b9ec916a2db3013893d6ac0bfe47d3683fa1600990585f37787a4298e44a799382221ab73154171f348f28b5958dbb30e7af793c8aadaec739ae94b272b1
SSDEEP

12288:ATC3mpAaqzPTY53of4XgbXZqHfdQCaIY//RnhOWrZVoexdqCLH31Ii3Dn:kC66PYPwbXZq6C7Y/5kWrZVoe/1LH3bD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5de752d3e69b1724af49b9c64c82be20N.exe

Files

5de752d3e69b1724af49b9c64c82be20N.exe
.exe windows:10 windows x64 arch:x64

f9bc8bd9a4625c4e4d51d3742b03ca20

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

dccw.pdb

Imports

advapi32

RegCloseKey
RegQueryInfoKeyW
RegEnumKeyExW
RegOpenKeyExW
RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
EventRegister
EventUnregister
EventWrite
RegQueryValueExW

kernel32

WaitForSingleObject
CreateMutexW
HeapSetInformation
InitializeCriticalSection
GetModuleFileNameW
FindResourceExW
LoadResource
ReleaseMutex
MultiByteToWideChar
lstrcmpiW
GetModuleHandleW
LoadLibraryExW
GetProcAddress
FreeLibrary
GetLastError
CloseHandle
CreateFileW
GetTickCount
LockResource
FindResourceW
GlobalFree
GlobalUnlock
GlobalLock
GlobalAlloc
LocalFree
FormatMessageW
GetSystemDirectoryW
WriteFile
lstrlenW
WideCharToMultiByte
GetSystemTime
CopyFileW
SizeofResource
EnterCriticalSection
LeaveCriticalSection
RaiseException
DeleteCriticalSection
OutputDebugStringA
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
TerminateProcess
SetUnhandledExceptionFilter
HeapFree
VirtualFree
GetCurrentProcess
VirtualAlloc
LoadLibraryExA
EncodePointer
HeapAlloc
DecodePointer
GetProcessHeap
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
Sleep
GetStartupInfoW
UnhandledExceptionFilter
GetSystemTimeAsFileTime

gdi32

StretchBlt
CreateCompatibleBitmap
SetStretchBltMode
SelectObject
CreateCompatibleDC
GetObjectW
GetTextExtentPoint32W
SetDeviceGammaRamp
GetDeviceGammaRamp
GetStockObject
SetBkMode
SetBkColor
SetTextColor
CreateSolidBrush
GetDeviceCaps
CreateDCW
DeleteDC
DeleteObject

user32

LoadStringW
GetWindowLongW
GetWindow
ShowWindow
MessageBoxW
ReleaseDC
GetWindowTextW
GetWindowTextLengthW
GetDC
KillTimer
SetTimer
SetWindowTextW
PostMessageW
MapDialogRect
EnumChildWindows
DisplayConfigGetDeviceInfo
QueryDisplayConfig
GetDisplayConfigBufferSizes
EnumDisplayDevicesW
ShowCursor
LoadCursorW
SetCursor
GetMonitorInfoW
EnumDisplayMonitors
MonitorFromWindow
GetParent
InvalidateRect
MapWindowPoints
GetWindowRect
GetDlgItem
DefWindowProcW
SendMessageW
CallWindowProcW
SetWindowPos
SetForegroundWindow
OpenIcon
SetWindowLongPtrW
GetWindowLongPtrW
MonitorFromRect
SendMessageTimeoutW
AllowSetForegroundWindow
GetWindowThreadProcessId
FindWindowW
RegisterWindowMessageW
GetActiveWindow
GetSystemMetrics
CharNextW
DestroyWindow
UnregisterClassA
MoveWindow

msvcrt

iswupper
towlower
_vsnwprintf
memset
?terminate@@YAXXZ
realloc
_errno
_onexit
__dllonexit
_unlock
_lock
_commode
_fmode
_wcmdln
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
_callnewh
swscanf_s
wcsstr
_wcsupr
_purecall
memcpy_s
malloc
wcsncpy_s
free
__C_specific_handler
memcpy
powf

ntdll

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
WinSqmAddToStream

dxva2

GetNumberOfPhysicalMonitorsFromHMONITOR
GetPhysicalMonitorsFromHMONITOR
DestroyPhysicalMonitors
GetMonitorBrightness
SetMonitorBrightness
GetMonitorContrast
SetMonitorContrast
SetVCPFeature
GetVCPFeatureAndVCPFeatureReply

mscms

GetColorProfileFromHandle
DccwReleaseDisplayProfileAssociationList
WcsCreateIccProfile
InstallColorProfileW
SetColorProfileElement
CloseColorProfile
DccwSetDisplayProfileAssociationList
WcsGetUsePerUserProfiles
WcsGetDefaultColorProfile
WcsOpenColorProfileW
DccwGetGamutSize
DccwCreateDisplayProfileAssociationList
SetColorProfileElementSize
WcsGetCalibrationManagementState
WcsDisassociateColorProfileFromDevice
WcsSetDefaultColorProfile
UninstallColorProfileW
DccwGetDisplayProfileAssociationList
GetColorDirectoryW
WcsSetCalibrationManagementState

shell32

ShellExecuteW

gdiplus

GdipCreateHBITMAPFromBitmap
GdipDisposeImage
GdipCloneImage
GdipFree
GdipCreateLineBrushI
GdipFillRectangleI
GdipAlloc
GdipDeleteBrush
GdipCreateSolidFill
GdipDeleteGraphics
GdipCreateFromHDC
GdiplusShutdown
GdiplusStartup
GdipCreateBitmapFromStream

comctl32

TaskDialogIndirect
DestroyPropertySheetPage
CreatePropertySheetPageW
PropertySheetW

oleaut32

SysFreeString
VarUI4FromStr
SysAllocString

api-ms-win-core-com-l1-1-0

CoCreateInstance
StringFromCLSID
CreateStreamOnHGlobal
CoTaskMemRealloc
CoTaskMemFree
CoTaskMemAlloc

Sections

.text
Size: 66KB - Virtual size: 65KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 568KB - Virtual size: 572KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

f9bc8bd9a4625c4e4d51d3742b03ca20

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

gdi32

user32

msvcrt

ntdll

dxva2

mscms

shell32

gdiplus

comctl32

oleaut32

api-ms-win-core-com-l1-1-0

Sections

.text Size: 66KB - Virtual size: 65KB

.rdata Size: 24KB - Virtual size: 24KB

.data Size: 1KB - Virtual size: 3KB

.pdata Size: 3KB - Virtual size: 3KB

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 568KB - Virtual size: 572KB

.text
Size: 66KB - Virtual size: 65KB

.rdata
Size: 24KB - Virtual size: 24KB

.data
Size: 1KB - Virtual size: 3KB

.pdata
Size: 3KB - Virtual size: 3KB

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 568KB - Virtual size: 572KB