7d20c812e389ee5350a0f4caf6b41580N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

7d20c812e389ee5350a0f4caf6b41580N.exe
Size

926KB
MD5

7d20c812e389ee5350a0f4caf6b41580
SHA1

bfb02ce9ed28ec385dae2fe1cb47d44732c467de
SHA256

4571318a414f04aeb3d28313a36f16846b1afbd2d75cf9caa305e9f688e5bdab
SHA512

bd5497cae7c58e3b0d8e0c0f64cf9a43a1615474fc95b9bceda6378e98ee59c72b783617af3eddda95a78b98d183dd695b758276179576a9f2b583c337efa53a
SSDEEP

24576:m9f19FvXph+NWTWPYPwbXZq6C7Y/5kWrZVoe/1LH3bDn:mJZb+NWTwYPyXZU7Y1D1z3bD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7d20c812e389ee5350a0f4caf6b41580N.exe

Files

7d20c812e389ee5350a0f4caf6b41580N.exe
.exe windows:10 windows x64 arch:x64

0e543673d54bf3a1fb3198407b216103

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

SIHClient.pdb

Imports

msvcp_win

??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z
??1?$codecvt@GDU_Mbstatet@@@std@@MEAA@XZ
??0?$codecvt@GDU_Mbstatet@@@std@@QEAA@_K@Z
?out@?$codecvt@GDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBG1AEAPEBGPEAD3AEAPEAD@Z
?_Addfac@_Locimp@locale@std@@AEAAXPEAVfacet@23@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xbad_function_call@std@@YAXXZ
?_Incref@facet@locale@std@@UEAAXXZ
??Bid@locale@std@@QEAA_KXZ
?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?id@?$codecvt@GDU_Mbstatet@@@std@@2V0locale@2@A
?_Xlength_error@std@@YAXPEBD@Z

api-ms-win-crt-runtime-l1-1-0

_c_exit
_initterm_e
_register_thread_local_exe_atexit_callback
_initterm

api-ms-win-crt-private-l1-1-0

_o__purecall
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_errno
_o__set_fmode
_o__set_new_mode
memmove
_o__wsplitpath_s
_o__wtoi
_o__wtoi64
_o__wtol
_o_exit
_o_free
_o_iswalnum
_o_iswalpha
_o_malloc
_o_memcpy_s
_o_qsort
_o_rand
_o_srand
_o_strncpy_s
_o_strtol
_o_terminate
_o_towlower
_o_wcscpy_s
_o_wcstoul
__C_specific_handler
__CxxFrameHandler3
_CxxThrowException
_o__exit
_o__errno
wcsrchr
_o__invalid_parameter_noinfo_noreturn
_o__invalid_parameter_noinfo
_o__initialize_wide_environment
_o__initialize_onexit_table
_o__crt_atexit
_o__configure_wide_argv
_o__configthreadlocale
_o__cexit
_o__callnewh
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsnprintf_s
_o__get_initial_wide_environment
_o___std_exception_destroy
_o___std_exception_copy
_o___p__commode
_o___p___wargv
_o___p___argc
wcsstr
strchr
__std_terminate
__CxxFrameHandler4
memcmp
memcpy

api-ms-win-crt-string-l1-1-0

memset
memmove_s

rpcrt4

UuidFromStringW
UuidCreate
RpcStringFreeA
UuidToStringA

api-ms-win-core-com-l1-1-0

CoUninitialize
IIDFromString
CoInitializeEx
StringFromGUID2
CoTaskMemFree
CoCreateInstance
CoTaskMemAlloc
CoCreateGuid

ntdll

RtlGetDeviceFamilyInfoEnum
EtwTraceMessageVa
RtlIsStateSeparationEnabled

api-ms-win-core-processthreads-l1-1-3

GetProcessInformation

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId
GetCurrentThreadId
TerminateProcess
GetCurrentProcess

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-eventing-provider-l1-1-0

EventUnregister
EventSetInformation
EventRegister
EventWriteTransfer

api-ms-win-core-debug-l1-1-0

OutputDebugStringW
IsDebuggerPresent
DebugBreak

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter
SetLastError

api-ms-win-core-string-l1-1-0

WideCharToMultiByte
MultiByteToWideChar
CompareStringW

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount64
GetVersionExW
GetSystemTime
GetSystemDirectoryW
GetLocalTime
GetSystemTimeAsFileTime
GetSystemWindowsDirectoryW

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
FreeLibrary
GetModuleHandleW
GetModuleFileNameA
GetModuleHandleExW
LoadResource

api-ms-win-core-heap-l1-1-0

HeapReAlloc
HeapAlloc
GetProcessHeap
HeapFree

api-ms-win-core-memory-l1-1-0

UnmapViewOfFile
MapViewOfFile
MapViewOfFileEx
CreateFileMappingW

api-ms-win-core-registry-l1-1-0

RegQueryInfoKeyW
RegQueryValueExW
RegSetValueExW
RegCloseKey
RegDeleteValueW
RegOpenKeyExW
RegEnumKeyExW
RegCreateKeyExW
RegEnumValueW

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

api-ms-win-core-sysinfo-l1-2-0

GetProductInfo
GetNativeSystemInfo

oleaut32

VariantClear
VariantInit
SysStringLen
SysAllocStringLen
SysAllocString
SysFreeString

api-ms-win-stateseparation-helpers-l1-1-0

GetPersistedRegistryLocationW

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime
FileTimeToSystemTime

api-ms-win-security-base-l1-1-0

CheckTokenMembership
GetLengthSid
AllocateAndInitializeSid
CreateWellKnownSid
CopySid
FreeSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
RevertToSelf
ImpersonateLoggedOnUser
AddAccessAllowedAceEx
IsValidSid
GetTokenInformation
InitializeAcl
DuplicateTokenEx

api-ms-win-security-sddl-l1-1-0

ConvertStringSidToSidW
ConvertSidToStringSidW

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-file-l1-1-0

SetFileTime
GetFileAttributesW
GetFileInformationByHandle
SetFileAttributesW
GetFileTime
CreateDirectoryW
FindClose
SetFileInformationByHandle
FindFirstFileW
FindNextFileW
GetFinalPathNameByHandleW
GetFileSizeEx
CreateFileW
GetFileSize
ReadFile
WriteFile
GetTempFileNameW
CompareFileTime
GetVolumePathNameW
SetFilePointer
GetDiskFreeSpaceExW
GetDiskFreeSpaceW
GetFileAttributesExW
DeleteFileW
GetVolumeInformationW
GetDriveTypeW
GetFileType
LocalFileTimeToFileTime

api-ms-win-core-version-l1-1-0

GetFileVersionInfoExW
GetFileVersionInfoSizeExW
VerQueryValueW

api-ms-win-core-libraryloader-l1-2-1

FindResourceW
LoadLibraryW

api-ms-win-core-kernel32-legacy-l1-1-0

DosDateTimeToFileTime

api-ms-win-core-synch-l1-1-0

ReleaseMutex
EnterCriticalSection
DeleteCriticalSection
WaitForSingleObjectEx
CreateSemaphoreExW
LeaveCriticalSection
OpenSemaphoreW
InitializeCriticalSection
AcquireSRWLockExclusive
InitializeCriticalSectionEx
CreateMutexExW
ReleaseSRWLockShared
ReleaseSRWLockExclusive
WaitForSingleObject
AcquireSRWLockShared
OpenMutexW
CreateMutexW
ReleaseSemaphore

api-ms-win-core-localization-l1-2-0

FormatMessageW
GetLocaleInfoW

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-file-l2-1-0

MoveFileExW

api-ms-win-core-shlwapi-legacy-l1-1-0

PathStripToRootW
PathIsRootW
PathIsUNCW
PathIsRelativeW

api-ms-win-shell-shdirectory-l1-1-0

ord290

api-ms-win-eventing-controller-l1-1-0

ControlTraceW
StartTraceW
EnableTraceEx2

api-ms-win-core-file-l1-2-1

GetCompressedFileSizeW

api-ms-win-eventing-consumer-l1-1-0

CloseTrace

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrRChrW
StrChrW

api-ms-win-core-namespace-l1-1-0

AddSIDToBoundaryDescriptor
DeleteBoundaryDescriptor
OpenPrivateNamespaceW
ClosePrivateNamespace
CreateBoundaryDescriptorW
CreatePrivateNamespaceW

winhttp

WinHttpConnect
WinHttpSetStatusCallback
WinHttpSetOption
WinHttpOpenRequest
WinHttpQueryAuthSchemes
WinHttpSendRequest
WinHttpReceiveResponse
WinHttpCrackUrl
WinHttpSetTimeouts
WinHttpQueryOption
WinHttpReadData
WinHttpQueryHeaders
WinHttpCloseHandle
WinHttpOpen
WinHttpAddRequestHeaders

ws2_32

inet_addr
getnameinfo

dnsapi

DnsSetNrptRules
DnsFreeNrptRule
DnsFreeNrptRuleNamesList
DnsFree
DnsQuery_W
DnsRemoveNrptRule
DnsGetNrptRuleNamesList

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

cabinet

ord23
ord21
ord22
ord20

api-ms-win-core-localization-obsolete-l1-2-0

EnumUILanguagesW
CompareStringA

api-ms-win-core-threadpool-l1-2-0

SetThreadpoolTimer
CreateThreadpoolTimer
CloseThreadpoolTimer
WaitForThreadpoolTimerCallbacks

crypt32

CertFreeCertificateContext
CertGetCertificateContextProperty
CertVerifyCertificateChainPolicy
CertOpenStore
CertFreeCertificateChain
CertCloseStore
CertControlStore
CryptHashPublicKeyInfo
CertFindCertificateInStore
CertGetCertificateChain
CertGetEnhancedKeyUsage

api-ms-win-security-cryptoapi-l1-1-0

CryptCreateHash
CryptGetHashParam
CryptHashData
CryptAcquireContextW
CryptDestroyHash
CryptReleaseContext

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Sections

.text
Size: 255KB - Virtual size: 254KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.wpp_sf
Size: 512B - Virtual size: 134B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 87KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 120B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 568KB - Virtual size: 572KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

0e543673d54bf3a1fb3198407b216103

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcp_win

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

rpcrt4

api-ms-win-core-com-l1-1-0

ntdll

api-ms-win-core-processthreads-l1-1-3

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

oleaut32

api-ms-win-stateseparation-helpers-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-version-l1-1-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-shell-shdirectory-l1-1-0

api-ms-win-eventing-controller-l1-1-0

api-ms-win-core-file-l1-2-1

api-ms-win-eventing-consumer-l1-1-0

api-ms-win-core-shlwapi-obsolete-l1-1-0

api-ms-win-core-namespace-l1-1-0

winhttp

ws2_32

dnsapi

api-ms-win-core-apiquery-l1-1-0

cabinet

api-ms-win-core-localization-obsolete-l1-2-0

api-ms-win-core-threadpool-l1-2-0

crypt32

api-ms-win-security-cryptoapi-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Sections

.text Size: 255KB - Virtual size: 254KB

.wpp_sf Size: 512B - Virtual size: 134B

.rdata Size: 87KB - Virtual size: 86KB

.data Size: 3KB - Virtual size: 5KB

.pdata Size: 9KB - Virtual size: 9KB

.didat Size: 512B - Virtual size: 120B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 568KB - Virtual size: 572KB

.text
Size: 255KB - Virtual size: 254KB

.wpp_sf
Size: 512B - Virtual size: 134B

.rdata
Size: 87KB - Virtual size: 86KB

.data
Size: 3KB - Virtual size: 5KB

.pdata
Size: 9KB - Virtual size: 9KB

.didat
Size: 512B - Virtual size: 120B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 568KB - Virtual size: 572KB