e697fe62525e6c7f62341d8b2c2eb0fa70dc642a59fc47b766378194ec4df81f

Sharing

Copy URL

Twitter E-mail

General

Target

e697fe62525e6c7f62341d8b2c2eb0fa70dc642a59fc47b766378194ec4df81f
Size

661KB
MD5

fdbcbb68b63aa8a6a3cd71aca2ebb351
SHA1

91ddc754894063966b6d28fcc93727ed45da68e4
SHA256

e697fe62525e6c7f62341d8b2c2eb0fa70dc642a59fc47b766378194ec4df81f
SHA512

37d3df9b07fb31192d9bcd27adeab45546ea399e54ea4754c955e8bdec7f714f278fb738b6e7de063e82d774456cb299ee5f8d7690cb60c857cf934b20b35c01
SSDEEP

12288:K3WQHmXaTylFv7IUpB2QVma/Nsb5yZpo8FtTXJU7IcI+W2dHyoWSss2mVL:yWQHmXaTyvv77pIQVmaFg5yZC6TXJU7X

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e697fe62525e6c7f62341d8b2c2eb0fa70dc642a59fc47b766378194ec4df81f

Files

e697fe62525e6c7f62341d8b2c2eb0fa70dc642a59fc47b766378194ec4df81f
.exe windows:6 windows x64 arch:x64

163bbd36ccc7271784ad1032f497e762

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\Service_V6\x64\Release\MiniDprServiceEM05CN.pdb

Imports

libcrypto-1_1-x64

ERR_error_string
OPENSSL_die
EVP_CipherInit_ex
EVP_CipherFinal_ex
EVP_CIPHER_CTX_iv_length
EVP_CipherUpdate
EVP_CIPHER_CTX_new
EVP_CIPHER_CTX_key_length
EVP_aes_256_cbc
EVP_CIPHER_CTX_reset
ERR_get_error

api-ms-win-core-string-obsolete-l1-1-0

lstrlenW
lstrcmpiW
lstrcpyW

api-ms-win-core-heap-l2-1-0

LocalFree

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte
CompareStringW

api-ms-win-core-errorhandling-l1-1-0

RaiseException
SetUnhandledExceptionFilter
GetLastError
SetLastError

api-ms-win-core-synch-l1-1-0

ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
WaitForSingleObject
CreateEventW

api-ms-win-core-util-l1-1-0

DecodePointer

api-ms-win-core-file-l1-1-0

SetFileTime
ReadFile
SetEndOfFile
FindFirstFileExW
DeleteFileA
SetFilePointer
GetFileAttributesW
DeleteFileW
LocalFileTimeToFileTime
SetFileAttributesW
FindFirstFileW
CreateDirectoryW
GetFileAttributesA
GetFileSizeEx
SetFilePointerEx
WriteFile
GetFileType
FindClose
FindNextFileW
FileTimeToLocalFileTime
CreateFileW
FlushFileBuffers
RemoveDirectoryW
FindFirstFileA
FindNextFileA

api-ms-win-core-registry-l1-1-0

RegCloseKey
RegOpenKeyExA
RegEnumKeyExA
RegQueryValueExA

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree
HeapSize
HeapReAlloc

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
LoadLibraryExW
FreeLibraryAndExitThread
FreeLibrary
GetProcAddress
GetModuleFileNameW
GetModuleFileNameA

api-ms-win-core-processthreads-l1-1-0

CreateThread
GetCurrentThreadId
GetCurrentProcessId
ExitProcess
TlsAlloc
TlsGetValue
TlsSetValue
GetCurrentProcess
ExitThread
TlsFree

api-ms-win-core-synch-l1-2-0

Sleep

iphlpapi

GetAdaptersAddresses

oleaut32

SysAllocString
SysFreeString
SetErrorInfo
SysStringLen
GetErrorInfo
VariantClear

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-com-l1-1-0

CoCreateGuid
CoCreateFreeThreadedMarshaler

api-ms-win-core-errorhandling-l1-1-3

FatalAppExitW

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryW

api-ms-win-core-timezone-l1-1-0

GetDynamicTimeZoneInformation
FileTimeToSystemTime
SystemTimeToFileTime
GetTimeZoneInformation

api-ms-win-core-version-l1-1-1

GetFileVersionInfoW

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-service-core-l1-1-0

RegisterServiceCtrlHandlerExW

api-ms-win-core-console-l2-1-0

GetConsoleScreenBufferInfo
SetConsoleTextAttribute

api-ms-win-core-processenvironment-l1-1-0

GetCurrentDirectoryW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetStdHandle
GetCommandLineW
SetStdHandle
GetCommandLineA
GetEnvironmentStringsW

api-ms-win-core-console-l1-1-0

WriteConsoleA
ReadConsoleW
GetConsoleOutputCP
WriteConsoleW
GetConsoleMode

api-ms-win-core-localization-l1-2-0

FormatMessageW
IsValidCodePage
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
LCMapStringW
GetACP
EnumSystemLocalesW
GetOEMCP

api-ms-win-core-sysinfo-l1-2-0

GetSystemFirmwareTable

user32

RegisterSuspendResumeNotification
RegisterPowerSettingNotification
wsprintfW
RegisterDeviceNotificationW

kernel32

OutputDebugStringW
InitializeSListHead
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
GetCPInfo
GetStringTypeW
EncodePointer
WaitForSingleObjectEx
GetSystemTimeAsFileTime
QueryPerformanceFrequency
QueryPerformanceCounter
SleepConditionVariableSRW
GetModuleHandleW
SleepConditionVariableCS
WakeAllConditionVariable
WakeConditionVariable
GetExitCodeThread
InitializeConditionVariable
TryEnterCriticalSection
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
InitializeSRWLock

advapi32

CloseEventLog
SetServiceStatus
StartServiceCtrlDispatcherW
ReadEventLogW
OpenEventLogW

wtsapi32

WTSEnumerateSessionsW

setupapi

SetupDiOpenClassRegKeyExW

dbghelp

MiniDumpWriteDump

version

GetFileVersionInfoSizeW

api-ms-win-core-rtlsupport-l1-1-0

RtlPcToFileHeader
RtlUnwindEx
RtlUnwind

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList

api-ms-win-core-datetime-l1-1-0

GetDateFormatW
GetTimeFormatW

api-ms-win-core-file-l2-1-0

MoveFileExW

Sections

.text
Size: 452KB - Virtual size: 452KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 158KB - Virtual size: 158KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 21KB - Virtual size: 29KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 21KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

163bbd36ccc7271784ad1032f497e762

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

libcrypto-1_1-x64

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-synch-l1-2-0

iphlpapi

oleaut32

api-ms-win-core-handle-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-errorhandling-l1-1-3

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-version-l1-1-1

api-ms-win-core-version-l1-1-0

api-ms-win-service-core-l1-1-0

api-ms-win-core-console-l2-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-sysinfo-l1-2-0

user32

kernel32

advapi32

wtsapi32

setupapi

dbghelp

version

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-file-l2-1-0

Sections

.text Size: 452KB - Virtual size: 452KB

.rdata Size: 158KB - Virtual size: 158KB

.data Size: 21KB - Virtual size: 29KB

.pdata Size: 21KB - Virtual size: 21KB

_RDATA Size: 512B - Virtual size: 244B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 4KB

.text
Size: 452KB - Virtual size: 452KB

.rdata
Size: 158KB - Virtual size: 158KB

.data
Size: 21KB - Virtual size: 29KB

.pdata
Size: 21KB - Virtual size: 21KB

_RDATA
Size: 512B - Virtual size: 244B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 4KB