dae2f756a7c6606be028f1e96bf39510N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

dae2f756a7c6606be028f1e96bf39510N.exe
Size

1.4MB
MD5

dae2f756a7c6606be028f1e96bf39510
SHA1

6e41a8591842ee4b10b0fa078a193e6d934a55c4
SHA256

6d6d551ca1a87675707481b537917ec4808b7f048c081e55cfa75af86bd7f640
SHA512

cc06c9111f6887db10116c90621040357751c8e7b1ce001edb814cc52c32416ad8045b1359c31deacc6baeb1f91490c1845df63a3be0522dd6116516b2ea6280
SSDEEP

24576:rY7gJrPul2YTOTi2vffKSLaoqPYPwbXZq6C7Y/5kWrZVoe/1LH3bDn:rY7G1W23fKsazYPyXZU7Y1D1z3bD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dae2f756a7c6606be028f1e96bf39510N.exe

Files

dae2f756a7c6606be028f1e96bf39510N.exe
.exe windows:10 windows x64 arch:x64

c399754881779489cbd0f5d180c41465

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

winlogon.pdb

Imports

msvcrt

wcspbrk
iswspace
wcstok
wcsrchr
sprintf_s
wcscpy_s
wcsstr
_vsnprintf_s
free
malloc
memmove
rand
_local_unwind
memcpy
_CxxThrowException
_XcptFilter
_amsg_exit
__getmainargs
__set_app_type
exit
_exit
_cexit
_ismbblead
__setusermatherr
_initterm
_acmdln
_fmode
_commode
_lock
_unlock
__dllonexit
_vsnwprintf
_onexit
__CxxFrameHandler3
?terminate@@YAXXZ
memset
memcmp
wcschr
_callnewh
??1type_info@@UEAA@XZ
toupper
_get_errno
_set_errno
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@XZ
??1exception@@UEAA@XZ
_tolower
_wcsicmp
_wtoi
_wcsnicmp
_ultow
__C_specific_handler
memmove_s
_purecall
memcpy_s
_vscwprintf
wcscmp

api-ms-win-core-libraryloader-l1-2-0

GetProcAddress
LoadStringW
GetModuleFileNameW
LockResource
LoadResource
FindResourceExW
GetModuleHandleW
LoadLibraryExW
FreeLibrary
GetModuleHandleExW
GetModuleFileNameA

api-ms-win-core-synch-l1-2-0

Sleep
WakeAllConditionVariable
InitOnceComplete
InitOnceBeginInitialize
SleepConditionVariableSRW
InitOnceExecuteOnce

api-ms-win-core-synch-l1-1-0

EnterCriticalSection
ReleaseSRWLockExclusive
ReleaseSemaphore
ResetEvent
SleepEx
AcquireSRWLockExclusive
CreateSemaphoreExW
InitializeCriticalSection
WaitForSingleObject
OpenSemaphoreW
OpenEventW
TryEnterCriticalSection
SetEvent
WaitForSingleObjectEx
DeleteCriticalSection
CreateEventW
LeaveCriticalSection
ReleaseSRWLockShared
InitializeCriticalSectionEx
ReleaseMutex
CreateMutexW
AcquireSRWLockShared
CreateMutexExW
TryAcquireSRWLockExclusive

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapSetInformation
HeapFree
HeapSize
HeapAlloc

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
RaiseException
SetLastError
SetErrorMode
SetUnhandledExceptionFilter

api-ms-win-core-threadpool-l1-2-0

TrySubmitThreadpoolCallback
SetThreadpoolThreadMinimum
WaitForThreadpoolTimerCallbacks
CreateThreadpoolCleanupGroup
CloseThreadpoolCleanupGroup
SetThreadpoolThreadMaximum
SetThreadpoolTimer
CreateThreadpool
CloseThreadpoolWork
CreateThreadpoolTimer
CloseThreadpoolCleanupGroupMembers
CloseThreadpool
CreateThreadpoolWork
SubmitThreadpoolWork
CloseThreadpoolTimer

api-ms-win-core-processthreads-l1-1-0

CreateProcessW
UpdateProcThreadAttribute
DeleteProcThreadAttributeList
GetCurrentThread
OpenProcessToken
InitializeProcThreadAttributeList
SetThreadToken
ResumeThread
GetExitCodeProcess
GetCurrentProcess
SetPriorityClass
SetThreadPriority
CreateProcessAsUserW
GetCurrentThreadId
CreateThread
GetCurrentProcessId
CreateRemoteThread
GetProcessId
TerminateProcess
GetStartupInfoW

api-ms-win-core-localization-l1-2-0

GetThreadUILanguage
FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-registry-l1-1-0

RegEnumKeyExW
RegFlushKey
RegCloseKey
RegGetValueA
RegDeleteValueW
RegCreateKeyExW
RegDeleteKeyExW
RegOpenKeyExW
RegDeleteTreeW
RegSetKeySecurity
RegQueryValueExW
RegSetValueExW
RegNotifyChangeKeyValue
RegQueryInfoKeyW
RegEnumValueW
RegGetValueW

api-ms-win-core-processthreads-l1-1-1

GetProcessMitigationPolicy
OpenProcess

api-ms-win-eventing-controller-l1-1-0

ControlTraceW
StartTraceW
EnableTraceEx2

api-ms-win-core-heap-l2-1-0

LocalReAlloc
LocalFree
LocalAlloc

api-ms-win-core-file-l2-1-0

MoveFileExW

api-ms-win-core-memory-l1-1-0

VirtualFree
VirtualAlloc

api-ms-win-core-memory-l1-1-1

VirtualUnlock
VirtualLock
SetProcessWorkingSetSizeEx
GetProcessWorkingSetSizeEx

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW
SetEnvironmentVariableW
SearchPathW
GetCommandLineW

api-ms-win-core-sysinfo-l1-1-0

GetTickCount
GetSystemTime
GetSystemTimeAsFileTime
GetSystemWindowsDirectoryW
GetTickCount64
GetLocalTime
GetVersionExW

api-ms-win-security-base-l1-1-0

GetLengthSid
FreeSid
GetSidIdentifierAuthority
DuplicateToken
CheckTokenMembership
IsValidSid
EqualSid
ImpersonateLoggedOnUser
SetTokenInformation
AdjustTokenPrivileges
CreateRestrictedToken
GetTokenInformation
GetSecurityDescriptorDacl
AllocateAndInitializeSid
CopySid
CreateWellKnownSid
AllocateLocallyUniqueId
DuplicateTokenEx
RevertToSelf

rpcrt4

RpcMgmtIsServerListening
RpcAsyncInitializeHandle
RpcBindingCopy
RpcStringFreeW
Ndr64AsyncClientCall
RpcExceptionFilter
I_RpcMapWin32Status
RpcAsyncAbortCall
RpcBindingSetAuthInfoExW
RpcBindingFromStringBindingW
RpcAsyncCancelCall
RpcStringBindingComposeW
UuidToStringW
UuidCreate
I_RpcBindingInqLocalClientPID
RpcImpersonateClient
RpcRevertToSelf
RpcBindingCreateW
UuidFromStringW
RpcBindingBind
RpcServerInqCallAttributesW
RpcServerTestCancel
RpcServerUseProtseqEpW
NdrServerCall2
Ndr64AsyncServerCallAll
NdrServerCallAll
NdrAsyncServerCall
RpcRaiseException
RpcServerInqBindings
RpcEpRegisterW
RpcEpUnregister
RpcServerListen
RpcServerRegisterIfEx
RpcServerUnregisterIf
RpcServerUseProtseqW
I_RpcBindingIsClientLocal
RpcBindingVectorFree
RpcServerUnsubscribeForNotification
RpcServerSubscribeForNotification
I_RpcExceptionFilter
NdrClientCall3
RpcBindingUnbind
RpcBindingFree
RpcAsyncCompleteCall

api-ms-win-core-com-l1-1-0

CoInitializeEx
CoUninitialize
CoCreateInstance
CoTaskMemAlloc
CoTaskMemRealloc
CoGetMalloc
CoTaskMemFree

api-ms-win-core-string-l1-1-0

CompareStringOrdinal
WideCharToMultiByte
CompareStringW

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-sysinfo-l1-2-0

GetProductInfo

api-ms-win-power-base-l1-1-0

PowerDeterminePlatformRoleEx

api-ms-win-core-file-l1-1-0

CreateFileW
GetFileAttributesW
GetShortPathNameW
CompareFileTime

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToTzSpecificLocalTime

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW
GetDateFormatW

api-ms-win-power-setting-l1-1-0

PowerSettingRegisterNotification
PowerSettingUnregisterNotification

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-shutdown-l1-1-1

InitiateShutdownW

api-ms-win-service-management-l1-1-0

OpenSCManagerW
StartServiceW
OpenServiceW
CloseServiceHandle

api-ms-win-service-management-l2-1-0

QueryServiceStatusEx
NotifyServiceStatusChangeW
QueryServiceConfigW

api-ms-win-core-registry-l1-1-1

RegDeleteKeyValueW
RegSetKeyValueW

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry
RtlCaptureContext
RtlVirtualUnwind
RtlCompareMemory

api-ms-win-eventing-classicprovider-l1-1-0

UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceEnableLevel
GetTraceEnableFlags
GetTraceLoggerHandle

api-ms-win-security-credentials-l1-1-0

CredFree
CredUnmarshalCredentialW

api-ms-win-security-lsalookup-l2-1-0

LookupAccountNameW
LookupAccountSidW

api-ms-win-core-version-l1-1-0

GetFileVersionInfoSizeExW
VerQueryValueW
GetFileVersionInfoExW

api-ms-win-eventing-provider-l1-1-0

EventRegister
EventProviderEnabled
EventWriteTransfer
EventSetInformation
EventUnregister

api-ms-win-service-winsvc-l1-1-0

QueryServiceStatus

api-ms-win-core-job-l2-1-0

QueryInformationJobObject
TerminateJobObject
SetInformationJobObject
AssignProcessToJobObject
CreateJobObjectW

api-ms-win-security-lsapolicy-l1-1-0

LsaStorePrivateData
LsaFreeMemory
LsaOpenPolicy
LsaQueryInformationPolicy
LsaClose

api-ms-win-core-appcompat-l1-1-0

BaseInitAppcompatCacheSupport

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-security-credentials-l2-1-0

CredReadByTokenHandle

api-ms-win-base-bootconfig-l1-1-0

NotifyBootConfigStatus

api-ms-win-eventlog-legacy-l1-1-0

DeregisterEventSource
ReportEventW
GetEventLogInformation
RegisterEventSourceW

api-ms-win-core-threadpool-legacy-l1-1-0

QueueUserWorkItem
DeleteTimerQueueTimer
CreateTimerQueueTimer
UnregisterWaitEx

api-ms-win-core-kernel32-legacy-l1-1-0

GetComputerNameW
UnregisterWait
RegisterWaitForSingleObject

api-ms-win-core-registry-l2-1-0

RegOpenKeyW
RegCreateKeyW

api-ms-win-core-heap-obsolete-l1-1-0

LocalSize

api-ms-win-stateseparation-helpers-l1-1-0

GetPersistedRegistryLocationW

kernelbase

CreateProcessInternalW
AppContainerDeriveSidFromMoniker

ntdll

WinSqmIsOptedIn
NtCreateEvent
RtlAddAce
RtlSetDaclSecurityDescriptor
RtlGetDaclSecurityDescriptor
NtAdjustPrivilegesToken
NtDuplicateToken
RtlUnhandledExceptionFilter
NtQueryInformationProcess
NtDeviceIoControlFile
WinSqmEndSession
RtlInitializeResource
RtlAcquireResourceExclusive
RtlReleaseResource
RtlDeleteResource
NtGetCachedSigningLevel
WinSqmSetString
NtOpenEvent
NtSetEvent
RtlGetCurrentServiceSessionId
NtDeleteWnfStateName
NtCreateWnfStateName
RtlQueryResourcePolicy
__isascii
isupper
_vsnprintf
RtlGetNtProductType
RtlSetSystemBootStatus
RtlRemovePrivileges
RtlpVerifyAndCommitUILanguageSettings
NtSetInformationProcess
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
NtShutdownSystem
RtlCompareUnicodeString
RtlCreateEnvironment
TpReleaseTimer
TpWaitForTimer
TpAllocTimer
TpSetTimer
NtOpenThreadToken
NtOpenFile
RtlAppendUnicodeToString
NtOpenDirectoryObject
RtlFreeSid
NtSetSecurityObject
RtlSetSaclSecurityDescriptor
RtlAddMandatoryAce
RtlCreateAcl
RtlCreateSecurityDescriptor
RtlAllocateAndInitializeSid
RtlDestroyEnvironment
RtlCopySid
RtlNtStatusToDosErrorNoTeb
RtlSetEnvironmentVariable
RtlQueryEnvironmentVariable_U
RtlExpandEnvironmentStrings_U
RtlInitUnicodeStringEx
RtlGetAce
NtSetIRTimer
NtCreateIRTimer
NtSetInformationToken
NtCreateToken
RtlSubscribeWnfStateChangeNotification
RtlQueryWnfStateData
TpAllocWait
WinSqmSetDWORD
TpPostWork
TpAllocWork
RtlUnsubscribeWnfNotificationWaitForCompletion
TpReleaseWork
TpWaitForWork
TpReleaseWait
TpWaitForWait
TpSetWait
NtFilterToken
NtInitiatePowerAction
RtlAdjustPrivilege
RtlPublishWnfStateData
RtlLengthSid
EtwEventWriteStartScenario
EtwEventWriteEndScenario
RtlInitUnicodeString
NtAllocateLocallyUniqueId
RtlDeregisterWait
RtlRegisterWait
RtlTimeToSecondsSince1980
WinSqmAddToStream
TpSimpleTryPost
RtlEqualSid
EtwEventEnabled
EtwEventWrite
RtlCopyLuid
NtPowerInformation
EtwEventActivityIdControl
RtlGetActiveConsoleId
RtlInitString
NtQuerySystemInformation
NtSystemDebugControl
NtQueryInformationToken
NtOpenProcessToken
RtlLeaveCriticalSection
RtlEnterCriticalSection
RtlInitializeCriticalSection
RtlDeleteCriticalSection
RtlFreeUnicodeString
RtlNtStatusToDosError
RtlDuplicateUnicodeString
NtClose
RtlOpenCurrentUser
RtlGetDeviceFamilyInfoEnum
EtwTraceMessage
EtwEventRegister
EtwEventUnregister
EtwEventWriteTransfer
EtwEventSetInformation
WinSqmStartSession

api-ms-win-core-winrt-string-l1-1-0

WindowsGetStringRawBuffer
WindowsDeleteString
WindowsCreateStringReference

api-ms-win-core-winrt-l1-1-0

RoActivateInstance

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Sections

.text
Size: 601KB - Virtual size: 601KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 164KB - Virtual size: 164KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 19KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 67KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 572KB - Virtual size: 576KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

c399754881779489cbd0f5d180c41465

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-eventing-controller-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-memory-l1-1-1

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-security-base-l1-1-0

rpcrt4

api-ms-win-core-com-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-power-base-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-power-setting-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-shutdown-l1-1-1

api-ms-win-service-management-l1-1-0

api-ms-win-service-management-l2-1-0

api-ms-win-core-registry-l1-1-1

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-security-credentials-l1-1-0

api-ms-win-security-lsalookup-l2-1-0

api-ms-win-core-version-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-service-winsvc-l1-1-0

api-ms-win-core-job-l2-1-0

api-ms-win-security-lsapolicy-l1-1-0

api-ms-win-core-appcompat-l1-1-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-security-credentials-l2-1-0

api-ms-win-base-bootconfig-l1-1-0

api-ms-win-eventlog-legacy-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-registry-l2-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-stateseparation-helpers-l1-1-0

kernelbase

ntdll

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Sections

.text Size: 601KB - Virtual size: 601KB

.rdata Size: 164KB - Virtual size: 164KB

.data Size: 19KB - Virtual size: 26KB

.pdata Size: 26KB - Virtual size: 26KB

.didat Size: 1KB - Virtual size: 1KB

.rsrc Size: 67KB - Virtual size: 66KB

.reloc Size: 572KB - Virtual size: 576KB

.text
Size: 601KB - Virtual size: 601KB

.rdata
Size: 164KB - Virtual size: 164KB

.data
Size: 19KB - Virtual size: 26KB

.pdata
Size: 26KB - Virtual size: 26KB

.didat
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 67KB - Virtual size: 66KB

.reloc
Size: 572KB - Virtual size: 576KB