bb6d338a4bc03c330d95919dda4f0fa0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

bb6d338a4bc03c330d95919dda4f0fa0N.exe
Size

861KB
MD5

bb6d338a4bc03c330d95919dda4f0fa0
SHA1

563e843c35362c4fc477935c8f6291767f82dd7f
SHA256

0d2f28f5295a02862dbd76d5dd24787389786208e328e91bea94366b5d5da4dc
SHA512

0c633515ed5f9c96b213fb9194da8357d4a506f0714659d52e6c6a3a6f8a3205e6b49e00ccbcf256d41c13cfbbcf3be5c60b4d3135526ff11dd19be7251a8249
SSDEEP

24576:5IylAcBPYPwbXZq6C7Y/5kWrZVoe/1LH3bDn:mymcRYPyXZU7Y1D1z3bD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bb6d338a4bc03c330d95919dda4f0fa0N.exe

Files

bb6d338a4bc03c330d95919dda4f0fa0N.exe
.exe windows:10 windows x64 arch:x64

13d632df1acf97f95d3f6cd637a88b47

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

LsaIso.pdb

Imports

msvcrt

_commode
_fmode
_initterm
memset
_onexit
__dllonexit
_unlock
_lock
??1type_info@@UEAA@XZ
__setusermatherr
_cexit
_exit
exit
?terminate@@YAXXZ
__set_app_type
__wgetmainargs
memcmp
wcscmp
_amsg_exit
_XcptFilter
_wcsicmp
__C_specific_handler
__CxxFrameHandler3
??3@YAXPEAX@Z
_purecall
??1exception@@UEAA@XZ
??0exception@@QEAA@XZ
??0exception@@QEAA@AEBV0@@Z
toupper
malloc
_callnewh
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBQEBDH@Z
?what@exception@@UEBAPEBDXZ
_CxxThrowException
memcpy
memmove

iumcrypt

iumCryptMsgGetParam
iumCryptMsgUpdate
iumCryptMsgOpenToEncode
iumCryptEncodeObjectEx
iumCryptSignAndEncodeCertificate
iumCryptExportPublicKeyInfoFromBCryptKeyHandle

api-ms-win-core-heap-obsolete-l1-1-0

LocalReAlloc
LocalFree
LocalAlloc

api-ms-win-eventing-classicprovider-l1-1-0

UnregisterTraceGuids
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle
TraceMessage

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventProviderEnabled
EventUnregister
EventRegister
EventSetInformation

api-ms-win-eventing-obsolete-l1-1-0

RegisterTraceGuidsA

api-ms-win-core-errorhandling-l1-1-0

SetLastError
UnhandledExceptionFilter
GetLastError
SetUnhandledExceptionFilter

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-libraryloader-l1-2-0

GetModuleFileNameA
GetProcAddress
GetModuleHandleExW
GetModuleHandleW

api-ms-win-core-processthreads-l1-1-0

CreateThread
GetCurrentProcessId
GetCurrentThreadId
GetCurrentProcess
SetThreadStackGuarantee
TerminateProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-synch-l1-1-0

AcquireSRWLockShared
CreateMutexExW
ReleaseSRWLockShared
OpenSemaphoreW
WaitForSingleObjectEx
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ReleaseMutex
ReleaseSemaphore
CreateSemaphoreExW
WaitForSingleObject
InitializeSRWLock

api-ms-win-core-synch-l1-2-0

Sleep
InitOnceExecuteOnce

api-ms-win-core-sysinfo-l1-1-0

GetSystemTime
GetSystemTimeAsFileTime
GetTickCount
GetSystemInfo

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

kerbclientshared

KerbDHGetSharedSecretFromCapiKeyBuffer
KerbDHGetLittleEndianPublicKey
KerbClientTransformStoredCred
KerbClientBuildKeyList
KerbClientBuildFastArmoredKdcRequest
KerbClientSharedInit
KerbPackKdcReplyWithEncryptedSessionKey
KerbClientPackAsn1Buffer
KerbClientDecryptApReply
KerbClientVerifyFastArmoredKerbError
KerbClientBuildEncryptedAuthData
KerbClientPackApReply
KerbClientBuildAsReqAuthenticator
KerbClientSharedCleanup
KerbClientAlloc
KerbClientVerifyFastArmoredTgsReply
KerbClientDecryptPacCredentials
KerbClientFreeStoredCred
KerbClientVerifyFastArmoredKdcReply
KerbClientVerifyEncryptedChallengePaData
KerbClientUnpackKdcReplyBody
KerbClientVerifyChecksum
KerbClientUpdateSharedConfiguration
KerbClientBuildTicketArmorKey
KerbClientFree
KerbClientUnpackAsn1BufferVoid
KerbGetFlagsForKdcReply
KerbClientBuildExplicitArmorKey
KerbClientComputeTgsChecksum
KerbDHCreateBCryptKey
KerbDHGetLegacyDHParameters

ntlmshared

MsvpPutClearOwfsInPrimaryCredential
MsvpLm20GetNtlm3ChallengeResponse
MsvpMakeSecretPasswordNT5
MsvpDecryptDpapiMasterKey
MsvpCompareCredentials
MsvpDeriveSecureCredKey
NtlmSharedInit
MsvpValidateSupplementalCredsBuffer
MsvpCredentialToCachePasswords
MsvpGMSACred
MsvpPasswordValidate
MsvpUpdateSharedConfiguration

msasn1

ASN1BERDecGeneralizedTime
ASN1DEREncGeneralizedTime
ASN1BEREncU32
ASN1DecSetError
ASN1octetstring_free
ASN1BERDecSXVal
ASN1BERDecOpenType2
ASN1_CloseDecoder
ASN1intx_free
ASN1_CreateDecoder
ASN1intx_setuint32
ASN1_Decode
ASN1_CreateEncoder
ASN1_FreeEncoded
ASN1_FreeDecoded
ASN1_Encode
ASN1_CloseEncoder
ASN1BERDecPeekTag
ASN1BERDecOctetString
ASN1BERDecNotEndOfContents
ASN1BEREncExplicitTag
ASN1BERDecEndOfContents
ASN1BERDecBool
ASN1objectidentifier_free
ASN1EncSetError
ASN1BEREncS32
ASN1DEREncCharString
ASN1BEREncEndOfContents
ASN1BEREncBool
ASN1BERDecSkip
ASN1Free
ASN1DecAlloc
ASN1BEREncSX
ASN1BEREncOpenType
ASN1BERDecS32Val
ASN1DEREncOctetString
ASN1charstring_free
ASN1BERDecBitString
ASN1BERDecObjectIdentifier
ASN1BEREncObjectIdentifier
ASN1BERDecZeroCharString
ASN1DEREncBitString
ASN1BERDecU32Val
ASN1_CreateModule
ASN1BERDecCharString
ASN1bitstring_free
ASN1ztcharstring_free
ASN1BERDecExplicitTag

iumbase

GetTaggedDataSize
GetSignedReport
GetSecureIdentitySigningKey
IsSecureProcess
EncryptData
DecryptData
GetTaggedData

ntdll

RtlImageNtHeader
RtlLengthSid
RtlTimeToTimeFields
RtlTimeFieldsToTime
NtOpenEvent
RtlAvlRemoveNode
RtlEqualUnicodeString
RtlAvlInsertNodeEx
RtlNtStatusToDosError
RtlLeaveCriticalSection
RtlInitializeCriticalSection
_vsnprintf_s
RtlEnterCriticalSection
memcpy_s
RtlDeleteCriticalSection
_vsnwprintf
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlFreeHeap
NtSetEvent
NtCreateEvent
RtlSetProcessIsCritical
NtClose
RtlInitUnicodeString
NtQuerySystemInformation
RtlAllocateHeap

rpcrt4

RpcExceptionFilter
NdrMesTypeDecode3
MesDecodeBufferHandleCreate
MesHandleFree
NdrMesTypeEncode3
MesEncodeDynBufferHandleCreate
NdrMesTypeAlignSize3
RpcServerUseProtseqEpW
RpcMgmtWaitServerListen
RpcServerUnregisterIf
RpcServerListen
MesEncodeIncrementalHandleCreate
NdrServerCallAll
I_RpcMapWin32Status
RpcServerRegisterIf
NdrServerCall2
MesDecodeIncrementalHandleCreate
MesIncrementalHandleReset

bcrypt

BCryptCreateHash
BCryptHashData
BCryptDestroyHash
BCryptFinishHash
BCryptHash
BCryptGenerateSymmetricKey
BCryptSecretAgreement
BCryptSetProperty
BCryptSignHash
BCryptDestroySecret
BCryptDeriveKey
BCryptImportKey
BCryptDecrypt
BCryptDuplicateKey
BCryptVerifySignature
BCryptGetProperty
BCryptKeyDerivation
BCryptEncrypt
BCryptGenRandom
BCryptImportKeyPair
BCryptExportKey
BCryptOpenAlgorithmProvider
BCryptGenerateKeyPair
BCryptCloseAlgorithmProvider
BCryptFinalizeKeyPair
BCryptDestroyKey

cryptdll

CDLocateCSystem
CDLocateCheckSum
CDGenerateRandomBits

cryptsp

SystemFunction009
SystemFunction007
SystemFunction011

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapAlloc
HeapFree

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-memory-l1-1-0

VirtualProtect
VirtualAlloc
VirtualQuery

api-ms-win-core-string-l1-1-0

WideCharToMultiByte

Exports

Exports

__ImagePolicyMetadata

Sections

.text
Size: 197KB - Virtual size: 196KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 80KB - Virtual size: 79KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.tPolicy
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 572KB - Virtual size: 576KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

13d632df1acf97f95d3f6cd637a88b47

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

iumcrypt

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-eventing-obsolete-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-timezone-l1-1-0

kerbclientshared

ntlmshared

msasn1

iumbase

ntdll

rpcrt4

bcrypt

cryptdll

cryptsp

api-ms-win-core-debug-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-string-l1-1-0

Exports

Exports

Sections

.text Size: 197KB - Virtual size: 196KB

.rdata Size: 80KB - Virtual size: 79KB

.data Size: 1024B - Virtual size: 5KB

.pdata Size: 7KB - Virtual size: 6KB

.tPolicy Size: 1KB - Virtual size: 1KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 572KB - Virtual size: 576KB

.text
Size: 197KB - Virtual size: 196KB

.rdata
Size: 80KB - Virtual size: 79KB

.data
Size: 1024B - Virtual size: 5KB

.pdata
Size: 7KB - Virtual size: 6KB

.tPolicy
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 572KB - Virtual size: 576KB