56b3b5451e5428a1255348e7477f4ae0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

56b3b5451e5428a1255348e7477f4ae0N.exe
Size

3.9MB
MD5

56b3b5451e5428a1255348e7477f4ae0
SHA1

474958b9f0ef27ce34911da06a7558bfec2da1a7
SHA256

3c3012dc68e2edcafc1349d6eb47d29d06452a23a66a9c94bda2150e951c7fdf
SHA512

cff614ecd86f461626bbb7cb754458dc431b44f159c29d1e978c9798e82d784aa1194a5a3fc6debdb0e5101d74fabb49c7928d5f83ff8eebd6373e11a280f3b3
SSDEEP

49152:b6L7C8C+2WJsz/KWMfPYClxKuoP4AKqIJdkwujSEQQx2z6mNxEknS6wYKsCu:i20HmG7z/DS6wY3L

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
56b3b5451e5428a1255348e7477f4ae0N.exe

Files

56b3b5451e5428a1255348e7477f4ae0N.exe
.exe windows:6 windows x64 arch:x64

e5d57883afc937799ea0720a3a232ea2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

bcrypt

BCryptGenRandom

advapi32

CryptReleaseContext
SystemFunction036

kernel32

SetFileCompletionNotificationModes
CreateIoCompletionPort
TryAcquireSRWLockExclusive
GetFinalPathNameByHandleW
GetSystemInfo
CreateFileW
CancelIo
ReadDirectoryChangesW
GetModuleHandleA
GetProcAddress
GetQueuedCompletionStatusEx
WideCharToMultiByte
Sleep
GetFileInformationByHandleEx
GetConsoleMode
GetStdHandle
SetThreadStackGuarantee
CreateSemaphoreW
GetCurrentProcessId
GetCurrentThreadId
GetCurrentThread
AddVectoredExceptionHandler
MultiByteToWideChar
WriteConsoleW
GetCurrentDirectoryW
LoadLibraryA
CreateMutexA
GetCurrentProcess
ReleaseMutex
GetEnvironmentVariableW
RtlLookupFunctionEntry
GetModuleHandleW
FormatMessageW
GetFileInformationByHandle
GetFullPathNameW
FindFirstFileW
FindClose
ReadConsoleW
InitializeSListHead
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
CreateThread
ExitProcess
QueryPerformanceCounter
QueryPerformanceFrequency
GetSystemTimeAsFileTime
RtlCaptureContext
GetModuleFileNameW
SetHandleInformation
SetLastError
SetConsoleMode
SetUnhandledExceptionFilter
SetConsoleCtrlHandler
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
ReleaseSemaphore
GetLastError
WaitForSingleObject
PostQueuedCompletionStatus
CloseHandle
SwitchToThread
HeapReAlloc
HeapAlloc
GetProcessHeap
ReleaseSRWLockShared
AcquireSRWLockShared
ReleaseSRWLockExclusive
HeapFree
AcquireSRWLockExclusive
GetCommandLineW
WaitForSingleObjectEx
IsProcessorFeaturePresent

ws2_32

closesocket
WSAIoctl
listen
ioctlsocket
accept
WSASocketW
bind
getaddrinfo
freeaddrinfo
WSAStartup
connect
recv
send
recvfrom
sendto
getsockopt
WSACleanup
WSAGetLastError
shutdown
setsockopt
socket

secur32

ApplyControlToken
AcceptSecurityContext
FreeContextBuffer
InitializeSecurityContextW
AcquireCredentialsHandleA
FreeCredentialsHandle
QueryContextAttributesW
EncryptMessage
DecryptMessage
DeleteSecurityContext

crypt32

CertCloseStore
CertFreeCertificateContext
CertGetCertificateChain
CryptAcquireCertificatePrivateKey
PFXImportCertStore
CertCreateCertificateContext
CryptStringToBinaryA
CertFreeCertificateChain
CertDuplicateStore
CertEnumCertificatesInStore
CertVerifyCertificateChainPolicy
CertOpenStore
CertDuplicateCertificateContext
CertDuplicateCertificateChain
CertAddCertificateContextToStore

ntdll

NtCancelIoFileEx
NtCreateFile
NtWriteFile
NtReadFile
RtlNtStatusToDosError
NtDeviceIoControlFile

ncrypt

NCryptFreeObject

vcruntime140

__current_exception
__C_specific_handler
__CxxFrameHandler3
memset
memmove
memcmp
memcpy
__current_exception_context

api-ms-win-crt-math-l1-1-0

__setusermatherr
pow

api-ms-win-crt-runtime-l1-1-0

_initterm_e
exit
_exit
_initterm
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_seh_filter_exe
_initialize_narrow_environment
_configure_narrow_argv
_register_onexit_function
__p___argc
_set_app_type
terminate
_get_initial_narrow_environment
_initialize_onexit_table
_crt_atexit

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode

Sections

.text
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 847KB - Virtual size: 847KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 27KB - Virtual size: 27KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e5d57883afc937799ea0720a3a232ea2

Headers

DLL Characteristics

File Characteristics

Imports

bcrypt

advapi32

kernel32

ws2_32

secur32

crypt32

ntdll

ncrypt

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 3.0MB - Virtual size: 3.0MB

.rdata Size: 847KB - Virtual size: 847KB

.data Size: 2KB - Virtual size: 5KB

.pdata Size: 40KB - Virtual size: 40KB

.reloc Size: 27KB - Virtual size: 27KB

.text
Size: 3.0MB - Virtual size: 3.0MB

.rdata
Size: 847KB - Virtual size: 847KB

.data
Size: 2KB - Virtual size: 5KB

.pdata
Size: 40KB - Virtual size: 40KB

.reloc
Size: 27KB - Virtual size: 27KB