yara-master-2298-win64[.]zip

Sharing

Copy URL

Twitter E-mail

General

Target

yara-master-2298-win64.zip
Size

2.1MB
MD5

f1eaa4e188f79b10475067dc75acf25a
SHA1

831bcdc840b5dbf9e41dc2816d692ab5f0108fc4
SHA256

37878802163bf4429ec2385cceb0f408b500a11bdd3736de64639c41dbe1dca7
SHA512

58b2d3ad5efa38a4928b1522907c2deb24f895c4978e8b046268d063ffe89e8345a211952f250fe13cae439a305ac601ba56a930198a664bd29c80d1e3e07646
SSDEEP

49152:ZmpCO62MzrX4pdsCrxl6sq4nQncCO62CfGlBXnMyPB1KZml:ZDAMvuvlunZAxBXMGusl

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/yara64.exe
unpack001/yarac64.exe

Files

yara-master-2298-win64.zip
.zip
yara64.exe
.exe windows:6 windows x64 arch:x64

5807d0660cefe8819e22d121d86dc769

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

OpenProcessToken
AdjustTokenPrivileges
LookupPrivilegeValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW

ws2_32

recv
send
WSASetLastError
closesocket
WSACleanup
WSAGetLastError

crypt32

CertDuplicateCertificateContext
CertGetCertificateContextProperty
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore

kernel32

IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlLookupFunctionEntry
RtlCaptureContext
ReadConsoleA
SetConsoleMode
GetConsoleMode
LoadLibraryW
LoadLibraryA
FreeLibrary
ConvertFiberToThread
GetSystemTimeAsFileTime
DeleteFiber
ReadConsoleW
WideCharToMultiByte
EnterCriticalSection
ReleaseSemaphore
LeaveCriticalSection
InitializeCriticalSection
WaitForSingleObject
GetLastError
CloseHandle
CreateThread
DeleteCriticalSection
CreateSemaphoreW
ReadFile
FindFirstFileW
FindNextFileW
VirtualAlloc
FindClose
CreateFileW
GetFileAttributesW
GetFileSize
CreateFileA
GetFileSizeEx
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
HeapCreate
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
QueryPerformanceCounter
QueryPerformanceFrequency
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetCurrentProcess
OpenProcess
GetSystemInfo
VirtualQueryEx
ReadProcessMemory
GetStdHandle
GetEnvironmentVariableW
GetFileType
WriteFile
GetModuleHandleW
GetProcAddress
MultiByteToWideChar
SetLastError
GetCurrentProcessId
SwitchToThread
GetModuleHandleA
InitializeCriticalSectionAndSpinCount
GetModuleHandleExW
RtlVirtualUnwind

user32

GetUserObjectInformationW
GetProcessWindowStation
MessageBoxW

bcrypt

BCryptGenRandom

vcruntime140

memmove
longjmp
strstr
strrchr
memchr
__C_specific_handler
memset
strchr
wcsstr
__intrinsic_setjmp
memcpy
memcmp
wcschr

api-ms-win-crt-runtime-l1-1-0

__p___argc
abort
_initterm_e
_initterm
_get_initial_wide_environment
__p___wargv
_configure_wide_argv
_errno
_cexit
_wassert
_set_app_type
_seh_filter_exe
_c_exit
exit
_register_thread_local_exe_atexit_callback
signal
_initialize_onexit_table
_register_onexit_function
_initialize_wide_environment
_exit
raise
_crt_atexit
strerror_s
terminate

api-ms-win-crt-stdio-l1-1-0

_fileno
fgets
fread
_setmode
fopen
fwrite
fputs
fflush
_wfopen
__stdio_common_vswprintf
fseek
__stdio_common_vsscanf
getc
ferror
clearerr
__stdio_common_vfprintf
_set_fmode
ftell
__stdio_common_vfwprintf
fclose
__acrt_iob_func
_sopen_s
_filelength
_close
__p__commode
_read
__stdio_common_vsprintf
feof

api-ms-win-crt-convert-l1-1-0

strtol
wcstol
wcstoll
strtoul
atoi
atof
_strtoi64
strtoll
strtod

api-ms-win-crt-heap-l1-1-0

calloc
malloc
free
_set_new_mode
realloc

api-ms-win-crt-filesystem-l1-1-0

_stat64i32
_waccess_s

api-ms-win-crt-string-l1-1-0

strcspn
wcstok_s
tolower
strspn
isspace
_strdup
isprint
isxdigit
strncpy
strnlen
strcmp
isdigit
_wcsdup
_stricmp
strncmp
_strnicmp

api-ms-win-crt-time-l1-1-0

_gmtime64_s
_time64
_mkgmtime64

api-ms-win-crt-utility-l1-1-0

qsort
rand
srand

api-ms-win-crt-math-l1-1-0

log2
pow
__setusermatherr
_dclass
_isnan

api-ms-win-crt-locale-l1-1-0

_configthreadlocale
localeconv

api-ms-win-crt-environment-l1-1-0

getenv

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 550KB - Virtual size: 549KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 77KB - Virtual size: 93KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 64KB - Virtual size: 64KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
yarac64.exe
.exe windows:6 windows x64 arch:x64

be5f18f9055e05e8007376eebbc2150f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt
CryptExportKey
CryptGetUserKey
CryptGetProvParam
CryptSetHashParam
CryptDestroyKey
CryptReleaseContext
CryptAcquireContextW

ws2_32

recv
send
WSASetLastError
closesocket
WSACleanup
WSAGetLastError

crypt32

CertDuplicateCertificateContext
CertGetCertificateContextProperty
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore

kernel32

IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlLookupFunctionEntry
RtlCaptureContext
ReadConsoleA
SetConsoleMode
GetConsoleMode
FindNextFileW
FindFirstFileW
FindClose
LoadLibraryW
LoadLibraryA
FreeLibrary
ConvertFiberToThread
ReadConsoleW
WideCharToMultiByte
CloseHandle
HeapCreate
HeapDestroy
HeapAlloc
HeapReAlloc
HeapFree
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetCurrentProcess
QueryPerformanceCounter
GetStdHandle
GetEnvironmentVariableW
GetFileType
WriteFile
GetLastError
GetModuleHandleW
GetProcAddress
MultiByteToWideChar
SetLastError
GetCurrentProcessId
SwitchToThread
GetModuleHandleA
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetModuleHandleExW
RtlVirtualUnwind
DeleteFiber
GetSystemTimeAsFileTime

user32

GetUserObjectInformationW
GetProcessWindowStation
MessageBoxW

bcrypt

BCryptGenRandom

vcruntime140

memmove
strstr
strrchr
memcmp
memchr
memcpy
memset
strchr
wcsstr
__intrinsic_setjmp
__C_specific_handler
longjmp
wcschr

api-ms-win-crt-runtime-l1-1-0

_get_initial_wide_environment
abort
exit
_errno
_initterm
_initterm_e
__p___argc
__p___wargv
_seh_filter_exe
_set_app_type
_cexit
_initialize_wide_environment
_register_onexit_function
signal
_exit
raise
_initialize_onexit_table
_c_exit
strerror_s
_wassert
_crt_atexit
_register_thread_local_exe_atexit_callback
_configure_wide_argv
terminate

api-ms-win-crt-stdio-l1-1-0

_read
_setmode
_fileno
fgets
fflush
feof
fputs
__stdio_common_vsscanf
getc
ferror
clearerr
__stdio_common_vswprintf
__stdio_common_vfwprintf
_sopen_s
_filelength
_set_fmode
_close
__stdio_common_vsprintf
ftell
fseek
__acrt_iob_func
fread
fopen
__p__commode
fwrite
_wfopen
__stdio_common_vfprintf
fclose

api-ms-win-crt-convert-l1-1-0

_strtoi64
strtod
strtoll
atoi
atof
strtol
strtoul
wcstoll
wcstol

api-ms-win-crt-heap-l1-1-0

free
realloc
malloc
_set_new_mode
calloc

api-ms-win-crt-filesystem-l1-1-0

_stat64i32
_waccess_s

api-ms-win-crt-string-l1-1-0

strcspn
isdigit
strspn
isspace
_strdup
tolower
isxdigit
strncpy
strncmp
_stricmp
strnlen
_strnicmp
strcmp
isprint

api-ms-win-crt-utility-l1-1-0

qsort
srand

api-ms-win-crt-time-l1-1-0

_gmtime64_s
_time64
_mkgmtime64

api-ms-win-crt-math-l1-1-0

__setusermatherr
pow
log2
_isnan
_dclass

api-ms-win-crt-locale-l1-1-0

localeconv
_configthreadlocale

api-ms-win-crt-environment-l1-1-0

getenv

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 541KB - Virtual size: 540KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 75KB - Virtual size: 90KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 63KB - Virtual size: 62KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gfids
Size: 512B - Virtual size: 28B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5807d0660cefe8819e22d121d86dc769

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

ws2_32

crypt32

kernel32

user32

bcrypt

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-environment-l1-1-0

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 550KB - Virtual size: 549KB

.data Size: 77KB - Virtual size: 93KB

.pdata Size: 64KB - Virtual size: 64KB

.gfids Size: 512B - Virtual size: 28B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 20KB - Virtual size: 19KB

be5f18f9055e05e8007376eebbc2150f

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

ws2_32

crypt32

kernel32

user32

bcrypt

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-environment-l1-1-0

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 541KB - Virtual size: 540KB

.data Size: 75KB - Virtual size: 90KB

.pdata Size: 63KB - Virtual size: 62KB

.gfids Size: 512B - Virtual size: 28B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 20KB - Virtual size: 19KB

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 550KB - Virtual size: 549KB

.data
Size: 77KB - Virtual size: 93KB

.pdata
Size: 64KB - Virtual size: 64KB

.gfids
Size: 512B - Virtual size: 28B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 20KB - Virtual size: 19KB

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 541KB - Virtual size: 540KB

.data
Size: 75KB - Virtual size: 90KB

.pdata
Size: 63KB - Virtual size: 62KB

.gfids
Size: 512B - Virtual size: 28B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 20KB - Virtual size: 19KB