6c75b7adcb34144de6b255826e8102b4fbba11bfd009b045b2300c6e05db665c

Sharing

Copy URL Twitter E-mail

General

Target

6c75b7adcb34144de6b255826e8102b4fbba11bfd009b045b2300c6e05db665c
Size

1.4MB
MD5

5fd8322b5d8849d175444aeb5ce44818
SHA1

f7ccb9f5d1cad5cbb6fb9ee2faf3aee665f47467
SHA256

6c75b7adcb34144de6b255826e8102b4fbba11bfd009b045b2300c6e05db665c
SHA512

830725e435e867084d1aebb581490a1971a580d70b6d506a2bb2d22599829e1bf484f18503c412496e9179bf402dc4f0205c09e772c5da03b3a1297f55ff181b
SSDEEP

24576:Vyl+8nqHM08xAUBUE6oZTGszByiY8gGa:kl+8nqHM08xAUBxTGsC8g

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6c75b7adcb34144de6b255826e8102b4fbba11bfd009b045b2300c6e05db665c

Files

6c75b7adcb34144de6b255826e8102b4fbba11bfd009b045b2300c6e05db665c
.exe windows:10 windows x64 arch:x64

aaf1bb7f8aa2be386b685f74984e134c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_BIND
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

S:\tcaddin\Output\install\arm64\tcdiag.pdb

Imports

kernel32

ActivateActCtx
AddIntegrityLabelToBoundaryDescriptor
AddSIDToBoundaryDescriptor
AreFileApisANSI
CancelIo
ClosePrivateNamespace
CompareStringEx
CompareStringOrdinal
CompareStringW
ConnectNamedPipe
ContinueDebugEvent
CreateActCtxW
CreateBoundaryDescriptorW
CreateFileMappingW
CreateNamedPipeW
CreatePrivateNamespaceW
CreateProcessW
CreateThread
DeactivateActCtx
DeleteBoundaryDescriptor
DeviceIoControl
EnumSystemLocalesW
ExitProcess
ExpandEnvironmentStringsW
FindActCtxSectionStringW
FindResourceW
FlsAlloc
FlsFree
FlsGetValue
FlsSetValue
FlushInstructionCache
FormatMessageA
FormatMessageW
FreeEnvironmentStringsW
FreeLibrary
FreeLibraryAndExitThread
GetACP
GetCPInfo
GetCommandLineA
GetCommandLineW
GetCurrentDirectoryW
GetCurrentThread
GetCurrentThreadId
GetDateFormatW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetExitCodeProcess
GetExitCodeThread
GetLastError
GetLocaleInfoEx
GetLocaleInfoW
GetLongPathNameW
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetOEMCP
GetOverlappedResult
GetProcAddress
GetProcessHeap
GetStartupInfoW
GetStdHandle
GetStringTypeW
GetSystemDirectoryW
GetSystemInfo
GetSystemTimeAsFileTime
GetThreadContext
GetThreadPriority
GetTickCount
GetTimeFormatW
GetTimeZoneInformation
GetUserDefaultLCID
GetUserPreferredUILanguages
GetVersionExW
HeapFree
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
IsValidLocale
K32EnumProcessModules
K32EnumProcesses
K32GetMappedFileNameW
LCMapStringEx
LCMapStringW
LoadLibraryExA
LoadLibraryExW
LoadLibraryW
LoadResource
LocalAlloc
LocalFree
LockResource
MapViewOfFile
MoveFileExW
MoveFileW
MultiByteToWideChar
OpenPrivateNamespaceW
OpenProcess
OutputDebugStringA
OutputDebugStringW
PeekNamedPipe
QueryActCtxW
QueryFullProcessImageNameW
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
RtlLookupFunctionEntry
RtlPcToFileHeader
RtlUnwind
RtlUnwindEx
RtlVirtualUnwind
SetEnvironmentVariableW
SetLastError
SetStdHandle
SetThreadPriority
SetUnhandledExceptionFilter
SizeofResource
Sleep
SystemTimeToTzSpecificLocalTime
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
UnhandledExceptionFilter
UnmapViewOfFile
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForDebugEvent
WideCharToMultiByte
AcquireSRWLockExclusive
CloseHandle
CreateDirectoryW
CreateEventExW
CreateEventW
CreateFileW
CreateMutexExW
DecodePointer
DeleteCriticalSection
DeleteFileW
DeleteProcThreadAttributeList
DuplicateHandle
EncodePointer
EnterCriticalSection
ExitThread
FileTimeToSystemTime
FindClose
FindFirstFileExW
FindNextFileW
FlushFileBuffers
GetConsoleMode
GetConsoleOutputCP
GetCurrentProcess
GetCurrentProcessId
GetDriveTypeW
GetFileAttributesW
GetFileInformationByHandle
GetFileSizeEx
GetFileType
GetFullPathNameW
GetTempPathW
GetVolumeInformationW
GetVolumePathNameW
HeapAlloc
HeapReAlloc
HeapSize
InitializeConditionVariable
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
InitializeProcThreadAttributeList
InitializeSListHead
InitializeSRWLock
InterlockedPopEntrySList
InterlockedPushEntrySList
LeaveCriticalSection
MulDiv
OpenMutexW
ReadConsoleW
ReadFile
ReleaseSRWLockExclusive
RemoveDirectoryW
ResetEvent
RtlCaptureContext
RtlIsEcCode
SetEndOfFile
SetEvent
SetFileAttributesW
SetFileInformationByHandle
SetFilePointerEx
SleepConditionVariableCS
SleepConditionVariableSRW
TryEnterCriticalSection
UpdateProcThreadAttribute
VerSetConditionMask
WaitForMultipleObjects
WaitForSingleObject
WaitForSingleObjectEx
WakeAllConditionVariable
WakeConditionVariable
WriteConsoleW
WriteFile

user32

CallWindowProcW
CharUpperBuffW
CreateWindowExW
DefWindowProcW
DispatchMessageW
DrawFrameControl
EnableWindow
EnumWindows
GetClassInfoExW
GetClientRect
GetDC
GetDlgItem
GetKeyState
GetMessagePos
GetMessageW
GetParent
GetSystemMetrics
GetWindowLongPtrW
GetWindowLongW
GetWindowRect
GetWindowTextLengthW
GetWindowTextW
IsWindow
IsWindowVisible
LoadCursorW
MapDialogRect
MapWindowPoints
MessageBoxW
MonitorFromWindow
PeekMessageW
PostMessageW
PostQuitMessage
RegisterClassExW
RegisterWindowMessageW
ReleaseDC
SendMessageW
SetDlgItemTextW
SetTimer
SetWindowLongPtrW
SetWindowLongW
SystemParametersInfoW
TranslateMessage
UnregisterClassW
DestroyWindow
GetGuiResources
InvalidateRect
KillTimer
RedrawWindow
SetWindowPos
ShowWindow

gdi32

CreateCompatibleDC
CreateFontIndirectW
CreateRectRgn
CreateRectRgnIndirect
DeleteDC
DeleteObject
GetClipRgn
GetDeviceCaps
GetTextExtentPoint32W
SelectClipRgn
SelectObject
SetBkColor
SetBkMode
SetTextColor
GetTextFaceW

advapi32

CreateProcessAsUserW
CreateRestrictedToken
CreateWellKnownSid
GetSidSubAuthority
GetSidSubAuthorityCount
GetTokenInformation
InitializeAcl
InitializeSecurityDescriptor
OpenProcessToken
RegCloseKey
RegDeleteTreeW
RegDeleteValueW
RegEnumKeyExW
RegEnumValueW
RegOpenKeyExW
RegQueryInfoKeyW
RegQueryValueExW
RegSetValueExW
SetEntriesInAclW
SetSecurityDescriptorControl
SetSecurityDescriptorDacl
SetSecurityDescriptorSacl
AddMandatoryAce

shell32

CommandLineToArgvW
SHGetKnownFolderPath
ShellExecuteExW

ole32

CoInitializeEx
CoTaskMemFree
CoUninitialize

oleaut32

SysFreeString
SysStringLen
GetErrorInfo
SetErrorInfo

comctl32

ord413

ws2_32

WSAStartup
WSACleanup

Sections

.text
Size: 978KB - Virtual size: 977KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.hexpthk
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 306KB - Virtual size: 306KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 34KB - Virtual size: 50KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 35KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

tcreport
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.a64xrm
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

aaf1bb7f8aa2be386b685f74984e134c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

comctl32

ws2_32

Sections

.text Size: 978KB - Virtual size: 977KB

.hexpthk Size: 512B - Virtual size: 16B

.rdata Size: 306KB - Virtual size: 306KB

.data Size: 34KB - Virtual size: 50KB

.pdata Size: 35KB - Virtual size: 34KB

tcreport Size: 27KB - Virtual size: 27KB

.data Size: 512B - Virtual size: 32B

.a64xrm Size: 512B - Virtual size: 16B

.rsrc Size: 15KB - Virtual size: 14KB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 978KB - Virtual size: 977KB

.hexpthk
Size: 512B - Virtual size: 16B

.rdata
Size: 306KB - Virtual size: 306KB

.data
Size: 34KB - Virtual size: 50KB

.pdata
Size: 35KB - Virtual size: 34KB

tcreport
Size: 27KB - Virtual size: 27KB

.data
Size: 512B - Virtual size: 32B

.a64xrm
Size: 512B - Virtual size: 16B

.rsrc
Size: 15KB - Virtual size: 14KB

.reloc
Size: 8KB - Virtual size: 7KB