8b15be00ec7b3dc325bce3cc3547a6e0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

8b15be00ec7b3dc325bce3cc3547a6e0N.exe
Size

1.5MB
MD5

8b15be00ec7b3dc325bce3cc3547a6e0
SHA1

9cd6cb4ded59412dc45ba7366cd48143ac1db38a
SHA256

9e27333b70d62127b9ce5606764f2b723fad86d2f419b777b29219a0020f0f66
SHA512

ceae80cd26437b5ea14c21190f9e78faf37437bb9f564c16925535b7f40ebca09ff7c35e207fbbe33a96e1fd0ddc8a6ed34bfb381a8b58e1db75c481d790ea36
SSDEEP

24576:OCUApvPDv4Ex1hfe7i8WVq2lIGU8lrtGUJLPuwv4b/TwSfVcYG3K/cJHlnFR+IGe:OCUAPTY+8Wg2lIL8lrIUJLWwKLNiXico

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8b15be00ec7b3dc325bce3cc3547a6e0N.exe

Files

8b15be00ec7b3dc325bce3cc3547a6e0N.exe
.exe windows:10 windows x64 arch:x64

88ed9deb0748ffa45468fead24c294f6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

WMPNetwk.pdb

Imports

advapi32

EventRegister
EventUnregister
TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
EventWriteTransfer
OpenSCManagerW
OpenServiceW
CloseServiceHandle
RegCloseKey
CreateServiceW
RegOpenKeyExW
ChangeServiceConfig2W
QueryServiceStatusEx
ControlService
DeleteService
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerExW
SetServiceStatus
CopySid
GetLengthSid
IsValidSid
InitializeAcl
AddAce
GetAclInformation
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSecurityDescriptorToStringSecurityDescriptorW
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
GetSecurityDescriptorDacl
SetSecurityDescriptorDacl
GetSecurityDescriptorSacl
GetSecurityDescriptorControl
MakeAbsoluteSD
InitializeSecurityDescriptor
GetNamedSecurityInfoW
RegQueryValueExW
RegDeleteValueW
RegSetValueExW
RegNotifyChangeKeyValue
ConvertStringSidToSidW
RegCreateKeyExW
RegSetKeySecurity
RegEnumKeyExW
RegGetValueW
EventWriteEx
SetSecurityInfo
GetSecurityInfo
SetSecurityDescriptorControl
GetAce
EqualSid
StartServiceW
ChangeServiceConfigW
LookupAccountSidW

kernel32

GetCurrentProcess
EnterCriticalSection
LeaveCriticalSection
CompareStringOrdinal
SetProcessWorkingSetSize
ResetEvent
IsWow64Process
lstrcmpW
GetModuleFileNameW
CompareStringW
DeleteTimerQueueEx
CreateTimerQueue
ChangeTimerQueueTimer
CreateTimerQueueTimer
FindResourceW
CompareStringA
GetFullPathNameW
MultiByteToWideChar
MulDiv
RegisterWaitForSingleObject
UnregisterWaitEx
FormatMessageW
GetProcessHeap
HeapFree
CreateThread
WaitForMultipleObjects
GetStringTypeExW
lstrcmpiW
GetComputerNameW
PowerClearRequest
FileTimeToLocalFileTime
FileTimeToSystemTime
GetFileAttributesExW
TzSpecificLocalTimeToSystemTime
GetCurrentThreadId
FindCloseChangeNotification
FindFirstChangeNotificationW
FindNextChangeNotification
WideCharToMultiByte
RegQueryInfoKeyW
RegGetKeySecurity
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
PowerSetRequest
GetTickCount64
WaitForSingleObject
CreateEventW
InitializeSListHead
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
HeapDestroy
HeapAlloc
HeapReAlloc
HeapSize
GetProcAddress
FreeLibrary
LoadLibraryExW
LocalFree
GetTickCount
Sleep
PowerCreateRequest
SetLastError
GetLastError
SetEvent
GetDynamicTimeZoneInformation
FindResourceExW
LoadResource
LockResource
SizeofResource
HeapSetInformation
DeleteCriticalSection
InitializeCriticalSection
CloseHandle
RaiseException
OpenEventW
DeleteTimerQueueTimer
ResolveDelayLoadedAPI
DelayLoadFailureHook
LoadLibraryW

api-ms-win-crt-string-l1-1-0

wcscmp
strncmp
wcsncmp
memset

api-ms-win-crt-runtime-l1-1-0

_initterm_e
_register_thread_local_exe_atexit_callback
_c_exit
_initterm

api-ms-win-crt-private-l1-1-0

_o__errno
_o__exit
_o__get_wide_winmain_command_line
_o__i64tow_s
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__ltow_s
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__set_new_mode
_o__strlwr_s
_o__ui64tow_s
_o__ultoa_s
_o__ultow_s
_o__wcsicmp
_o__wcslwr_s
_o__wcsnicmp
_o__wcstoui64
_o__wputenv
_o__wtoi
_o__wtol
_o_calloc
_o_ceil
_o_exit
_o_floor
_o_free
_o_iswdigit
_o_malloc
_o_pow
_o_qsort_s
_o_terminate
_o_towupper
_o_wcscpy_s
_o_wcstol
_o_wcstoul
_o_wmemcpy_s
__current_exception
__current_exception_context
__CxxFrameHandler3
_CxxThrowException
wcsrchr
_o__crt_atexit
_o__configure_wide_argv
_o__configthreadlocale
_o__cexit
_o__callnewh
strchr
_o___std_exception_destroy
_o___std_exception_copy
_o___p__commode
_o___stdio_common_vswscanf
_o___stdio_common_vswprintf
wcsstr
__C_specific_handler
__std_terminate
__CxxFrameHandler4
__C_specific_handler_noexcept
memcmp
memcpy
memmove

user32

UnregisterPowerSettingNotification
RegisterPowerSettingNotification
PeekMessageW
DispatchMessageW
MsgWaitForMultipleObjectsEx
CharUpperW
CharUpperBuffW
wvsprintfW
UnregisterClassA

oleaut32

LoadTypeLi
LoadRegTypeLi
SysAllocStringLen
UnRegisterTypeLi
RegisterTypeLi
SysAllocString
SysFreeString
SysStringLen
VariantClear
SafeArrayDestroy
SafeArrayCreate
SafeArrayCopy
CreateErrorInfo
SetErrorInfo
SafeArrayLock
SafeArrayPtrOfIndex
SafeArrayUnlock
VariantTimeToSystemTime
SystemTimeToVariantTime
VariantInit

ole32

CoInitializeEx
CoUninitialize
CoCreateInstance
PropVariantClear
CreateStreamOnHGlobal
CoMarshalInterface
CoReleaseMarshalData
CoUnmarshalInterface
CoTaskMemFree
CoTaskMemAlloc
CLSIDFromProgID
CoCreateGuid
StringFromGUID2
CoSetProxyBlanket
IIDFromString
CoInitializeSecurity

wsock32

WSAGetLastError

iphlpapi

NotifyAddrChange
CancelIPChangeNotify
GetIpNetEntry2
SendARP
ResolveIpNetEntry2
GetBestInterfaceEx
GetAdaptersAddresses
NotifyIpInterfaceChange
CancelMibChangeNotify2
GetIpAddrTable

shlwapi

StrChrW
PathCreateFromUrlW
PathFindExtensionW
PathFindFileNameW
ord168
ord219
PathRemoveExtensionW

ntdll

RtlVirtualUnwind
RtlCaptureContext
RtlLookupFunctionEntry

userenv

RegisterGPNotification
UnregisterGPNotification

netapi32

NetApiBufferFree
NetShareGetInfo

propsys

PSGetPropertyKeyFromName
InitPropVariantFromCLSID
PSGetPropertyDescriptionByName
PropVariantToString
PropVariantToStringAlloc

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

Sections

.text
Size: 692KB - Virtual size: 688KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 112KB - Virtual size: 111KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 16KB - Virtual size: 22KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 4KB - Virtual size: 264B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 72KB - Virtual size: 70KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 572KB - Virtual size: 576KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

88ed9deb0748ffa45468fead24c294f6

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

user32

oleaut32

ole32

wsock32

iphlpapi

shlwapi

ntdll

userenv

netapi32

propsys

api-ms-win-core-apiquery-l1-1-0

Sections

.text Size: 692KB - Virtual size: 688KB

.rdata Size: 112KB - Virtual size: 111KB

.data Size: 16KB - Virtual size: 22KB

.pdata Size: 20KB - Virtual size: 19KB

.didat Size: 4KB - Virtual size: 264B

.rsrc Size: 72KB - Virtual size: 70KB

.reloc Size: 572KB - Virtual size: 576KB

.text
Size: 692KB - Virtual size: 688KB

.rdata
Size: 112KB - Virtual size: 111KB

.data
Size: 16KB - Virtual size: 22KB

.pdata
Size: 20KB - Virtual size: 19KB

.didat
Size: 4KB - Virtual size: 264B

.rsrc
Size: 72KB - Virtual size: 70KB

.reloc
Size: 572KB - Virtual size: 576KB