b539242e2246946facbe58110467b5b0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

b539242e2246946facbe58110467b5b0N.exe
Size

652KB
MD5

b539242e2246946facbe58110467b5b0
SHA1

83ee1a00f961061a176a41659b803edfae1272d4
SHA256

402795502e19f57c8b9d260e970f2b24639f03113674da2554e2066fa92f1d29
SHA512

f1a94b8c34ef0d765b7da356eb6aad26802689f9e4aae67b368a617b719511c1cd0339c35d24a8e378d063319e35515ab383fcc2db8ec3abe0fbb543e9c08350
SSDEEP

12288:kCOCBoQwaqzPTY53of4XgbXZqHfdQCaIY//RnhOWrZVoexdqCLH31Ii3Dn:kXCjqPYPwbXZq6C7Y/5kWrZVoe/1LH3v

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b539242e2246946facbe58110467b5b0N.exe

Files

b539242e2246946facbe58110467b5b0N.exe
.exe windows:10 windows x64 arch:x64

d5fa2d054e222e86f0d3d8efcffe5047

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

SecureBootEncodeUEFI.pdb

Imports

api-ms-win-crt-string-l1-1-0

wcsnlen
memset
strcspn

api-ms-win-crt-locale-l1-1-0

_unlock_locales
_lock_locales

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback
_initterm_e
_initterm
_c_exit

api-ms-win-crt-private-l1-1-0

_o__callnewh
_o__calloc_base
_o__cexit
_o__configthreadlocale
_o__configure_wide_argv
_o__crt_atexit
_o__errno
_o__exit
_o__get_initial_wide_environment
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__purecall
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_new_mode
memmove
_o__wcsdup
_o_abort
_o_calloc
_o_exit
_o_free
_o_frexp
_o_localeconv
_o_malloc
_o_qsort
_o_setlocale
_o_terminate
__uncaught_exception
__C_specific_handler
_CxxThrowException
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf_s
_o___stdio_common_vsnprintf_s
memcmp
memcpy
_o___std_exception_destroy
_o___std_exception_copy
_o___pctype_func
_o___p__commode
_o___p___wargv
_o___p___argc
_o____mb_cur_max_func
_o____lc_locale_name_func
_o____lc_codepage_func
__CxxFrameHandler3
_o__set_fmode

ntdll

RtlCaptureContext
NtQuerySystemEnvironmentValueEx
RtlInitUnicodeString
RtlVirtualUnwind
RtlLookupFunctionEntry

kernel32

LocalFree
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
LCMapStringEx
DecodePointer
EncodePointer
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
GetStringTypeW
WideCharToMultiByte
GetLastError
InitOnceExecuteOnce
MultiByteToWideChar
IsDebuggerPresent
DebugBreak
GetModuleHandleW
GetProcessHeap
GetProcAddress
HeapAlloc
OutputDebugStringW
FormatMessageW
GetCurrentThreadId
GetModuleHandleExW
HeapFree
GetModuleFileNameA
GetCurrentThread
CloseHandle
LocalAlloc

advapi32

OpenThreadToken
SetThreadToken
OpenProcessToken
EventWriteTransfer
EventRegister
EventSetInformation
EventUnregister
AdjustTokenPrivileges
LookupPrivilegeValueW
DuplicateTokenEx

bcrypt

BCryptHashData
BCryptCloseAlgorithmProvider
BCryptDestroyHash
BCryptCreateHash
BCryptOpenAlgorithmProvider
BCryptFinishHash

Sections

.text
Size: 42KB - Virtual size: 42KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 34KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 568KB - Virtual size: 572KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

d5fa2d054e222e86f0d3d8efcffe5047

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

ntdll

kernel32

advapi32

bcrypt

Sections

.text Size: 42KB - Virtual size: 42KB

.rdata Size: 34KB - Virtual size: 34KB

.data Size: 1KB - Virtual size: 3KB

.pdata Size: 3KB - Virtual size: 2KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 568KB - Virtual size: 572KB

.text
Size: 42KB - Virtual size: 42KB

.rdata
Size: 34KB - Virtual size: 34KB

.data
Size: 1KB - Virtual size: 3KB

.pdata
Size: 3KB - Virtual size: 2KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 568KB - Virtual size: 572KB