b222988feb4e5427bf7d0b9e6558e310N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

b222988feb4e5427bf7d0b9e6558e310N.exe
Size

80KB
MD5

b222988feb4e5427bf7d0b9e6558e310
SHA1

677da5aa943d75f6ca651f34d1af79d8e55ed3b3
SHA256

9be21f6dbb82b14ab4f596f80bac5b75c80a5b9885a724aab18d3fa2284220a0
SHA512

5a25b550e289e593e1bfd7a05da6e146dcff5e7bb8a592bc96981f5bf2a44a556b072dd667bf48cc5eb69890f228528e86d743693c7aa663c01d6fa716e76cbf
SSDEEP

1536:odRF+Yl9eyTXQPuUgY01/ifv7VtbDfkyfH6aqm:odRnDnQPuUgY0Mv7VtDfkyv6a

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b222988feb4e5427bf7d0b9e6558e310N.exe

Files

b222988feb4e5427bf7d0b9e6558e310N.exe
.dll windows:10 windows x64 arch:x64

3d3ced0e38d1dabb5e640e16ff84bb35

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

IPxlatCfg.pdb

Imports

msvcp_win

?_Winerror_map@std@@YAHH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Syserror_map@std@@YAPEBDH@Z

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e

api-ms-win-crt-private-l1-1-0

_o__callnewh
_o__cexit
_o__configure_narrow_argv
_o__crt_atexit
_o__execute_onexit_table
_o__initialize_narrow_environment
_o__initialize_onexit_table
_o__invalid_parameter_noinfo_noreturn
_o__register_onexit_function
_o__seh_filter_dll
memmove
_o_free
_o_malloc
__C_specific_handler
_CxxThrowException
_o___std_type_info_destroy_list
_o___std_exception_destroy
_o___std_exception_copy
memcpy
__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

memset

ntdll

RtlInitUnicodeString
RtlNtStatusToDosError
RtlAdjustPrivilege
RtlImpersonateSelf
NtLoadDriver

api-ms-win-core-synch-l1-1-0

WaitForSingleObjectEx
SetEvent
DeleteCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeCriticalSection
SetWaitableTimer
WaitForMultipleObjectsEx
CancelWaitableTimer
WaitForSingleObject
CreateWaitableTimerExW
EnterCriticalSection
ResetEvent
CreateEventW

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetLastError

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventRegister
EventUnregister

api-ms-win-service-core-l1-1-0

RegisterServiceCtrlHandlerExW
SetServiceStatus

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-security-base-l1-1-0

RevertToSelf

api-ms-win-core-processthreads-l1-1-0

CreateThread
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
TerminateProcess

dnsapi

DnsQueryEx
DnsFree

iphlpapi

InitializeIpInterfaceEntry
GetIpInterfaceEntry
SetIpInterfaceEntry
ParseNetworkString

ws2_32

htonl

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegOpenKeyExW
RegGetValueW

api-ms-win-core-synch-l1-2-0

Sleep

rpcrt4

NdrServerCallAll
NdrServerCall2
RpcServerUseProtseqEpW
RpcServerRegisterIfEx
RpcServerUnregisterIf

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-localization-l1-2-0

FormatMessageA

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
GetModuleHandleW
DisableThreadLibraryCalls

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

winnsi

NsiRpcRegisterChangeNotification
NsiDisconnectFromServer
NsiRpcDeregisterChangeNotification
NsiConnectToServer

nsi

NsiAllocateAndGetTable
NsiSetAllParameters
NsiGetAllParameters
NsiFreeTable

Exports

Exports

Disable464xlat
Enable464xlat
ServiceMain

Sections

.text
Size: 36KB - Virtual size: 32KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 224B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

3d3ced0e38d1dabb5e640e16ff84bb35

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcp_win

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

ntdll

api-ms-win-core-synch-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-processthreads-l1-1-0

dnsapi

iphlpapi

ws2_32

api-ms-win-core-registry-l1-1-0

api-ms-win-core-synch-l1-2-0

rpcrt4

api-ms-win-core-heap-l2-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-processthreads-l1-1-1

winnsi

nsi

Exports

Exports

Sections

.text Size: 36KB - Virtual size: 32KB

.rdata Size: 20KB - Virtual size: 18KB

.data Size: 4KB - Virtual size: 2KB

.pdata Size: 4KB - Virtual size: 1KB

.rsrc Size: 8KB - Virtual size: 7KB

.reloc Size: 4KB - Virtual size: 224B

.text
Size: 36KB - Virtual size: 32KB

.rdata
Size: 20KB - Virtual size: 18KB

.data
Size: 4KB - Virtual size: 2KB

.pdata
Size: 4KB - Virtual size: 1KB

.rsrc
Size: 8KB - Virtual size: 7KB

.reloc
Size: 4KB - Virtual size: 224B