b345fd80b32c38d6cf03f6bae5f254793800aa27fc6176364ecbb2bbd57c4d88

Sharing

Copy URL Twitter E-mail

General

Target

b345fd80b32c38d6cf03f6bae5f254793800aa27fc6176364ecbb2bbd57c4d88
Size

556KB
MD5

21ff3bfb4514c23e9c33b3b05eb77640
SHA1

7688c743ac6804e8eaaba25b144a500baab157c0
SHA256

b345fd80b32c38d6cf03f6bae5f254793800aa27fc6176364ecbb2bbd57c4d88
SHA512

5ae149a372a52faa45bcc160c22ce8a9c72ebe762a6b652ffdcfaa5272269468a9cc1370f74fc1fcfe095f849722dacee5706391b337496b03bcb97842d5a0ee
SSDEEP

12288:6SlzZzWHi898TBy/TRl9+IVd09JbBpigno+BoZR4mG3:6SlzZzWH78mRUbBpign/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b345fd80b32c38d6cf03f6bae5f254793800aa27fc6176364ecbb2bbd57c4d88

Files

b345fd80b32c38d6cf03f6bae5f254793800aa27fc6176364ecbb2bbd57c4d88
.exe windows:6 windows x64 arch:x64

f8b6dcdaf3f046fba65baa23e3026230

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\ben\code\net\SdCalcu64\x64\Release\SdCalcu64.pdb

Imports

kernel32

GetCurrentProcessId
InitializeCriticalSection
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GlobalReAlloc
GlobalHandle
LocalAlloc
LocalReAlloc
GetPrivateProfileIntW
GetPrivateProfileStringW
WritePrivateProfileStringW
GetLocaleInfoW
GetSystemDefaultUILanguage
GetUserDefaultUILanguage
GlobalFlags
VirtualProtect
GetUserDefaultLCID
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
SystemTimeToTzSpecificLocalTime
InitializeSListHead
LoadLibraryExA
WriteConsoleW
ReadConsoleW
GetConsoleMode
GetConsoleOutputCP
SetFilePointerEx
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetOEMCP
IsValidCodePage
FindNextFileW
FindFirstFileExW
GetTimeZoneInformation
EnumSystemLocalesW
IsValidLocale
LCMapStringW
GetFileType
ExitProcess
HeapQueryInformation
GetCommandLineA
RtlPcToFileHeader
RtlUnwindEx
GetCPInfo
LCMapStringEx
GetStringTypeW
GetFileTime
GetFileSizeEx
CompareStringW
GlobalFindAtomW
GlobalAddAtomW
GetSystemDirectoryW
EncodePointer
GlobalFree
GlobalUnlock
SetErrorMode
lstrcmpW
GlobalDeleteAtom
GlobalLock
GlobalAlloc
FreeLibrary
GetVersionExW
GetCurrentThreadId
GetCurrentThread
lstrcmpA
LoadLibraryExW
GetProcAddress
DuplicateHandle
WriteFile
UnlockFile
SetFilePointer
SetEndOfFile
ReadFile
LockFile
GetVolumeInformationW
GetFullPathNameW
GetFileSize
FlushFileBuffers
FindFirstFileW
FindClose
DeleteFileW
CreateFileW
QueryActCtxW
FindActCtxSectionStringW
DeactivateActCtx
ActivateActCtx
CreateActCtxW
LoadLibraryW
GetModuleHandleExW
GetModuleFileNameW
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
SetLastError
GetACP
WideCharToMultiByte
MultiByteToWideChar
VirtualQuery
VirtualAlloc
VirtualFree
FindResourceW
LoadResource
LockResource
SizeofResource
OutputDebugStringA
GetSystemInfo
CreateEventW
GetModuleHandleW
SetConsoleCtrlHandler
Sleep
MapViewOfFile
GetCommandLineW
SetConsoleWindowInfo
SetConsoleTextAttribute
SetConsoleTitleW
GetStdHandle
GetStartupInfoW
CloseHandle
UnmapViewOfFile
GetCurrentProcess
GetProcessTimes
WaitForSingleObject
SetEvent
GetFileAttributesW
ResetEvent
FileTimeToSystemTime
FileTimeToLocalFileTime
GetFileAttributesExW
GetLocalTime
LocalFree
FormatMessageW
GetTickCount
GetProcessHeap
DeleteCriticalSection
RtlUnwind
DecodePointer
HeapAlloc
RaiseException
HeapReAlloc
GetLastError
HeapSize
InitializeCriticalSectionEx
HeapFree
GetSystemTimeAsFileTime
OutputDebugStringW

user32

SetMenuItemInfoW
GetMenuCheckMarkDimensions
SetMenuItemBitmaps
EnableMenuItem
CheckMenuItem
GetWindowThreadProcessId
SetWindowTextW
IsWindowEnabled
ShowWindow
GetMonitorInfoW
MonitorFromWindow
WinHelpW
LoadIconW
CallNextHookEx
UnhookWindowsHookEx
SetWindowsHookExW
GetLastActivePopup
GetTopWindow
GetClassNameW
GetClassLongPtrW
SetWindowLongPtrW
GetWindowLongPtrW
SetWindowLongW
PtInRect
CopyRect
GetSysColor
MapWindowPoints
ScreenToClient
MessageBoxW
LoadBitmapW
GetWindowRect
RemovePropW
GetPropW
SetPropW
RedrawWindow
ValidateRect
EndPaint
BeginPaint
SetForegroundWindow
GetForegroundWindow
KillTimer
SetMenu
GetMenu
EnableWindow
GetCapture
GetClientRect
SetRectEmpty
GetKeyState
GetFocus
GetDlgCtrlID
GetDlgItem
IsIconic
IsWindowVisible
EndDeferWindowPos
DeferWindowPos
BeginDeferWindowPos
SetWindowPos
DestroyWindow
IsMenu
IsWindow
CreateWindowExW
GetClassInfoExW
GetMessageW
TranslateMessage
GetActiveWindow
GetCursorPos
SetCursor
ClientToScreen
RealChildWindowFromPoint
AdjustWindowRectEx
SetTimer
OffsetRect
GetParent
CharUpperW
GetSystemMetrics
PostMessageW
PostQuitMessage
GetSubMenu
GetMenuItemID
GetMenuItemCount
SendMessageW
GetScrollPos
GetWindowTextW
GetWindowLongW
GetWindow
RegisterWindowMessageW
DispatchMessageW
PeekMessageW
GetMessagePos
GetMessageTime
DefWindowProcW
CallWindowProcW
RegisterClassW
GetClassInfoW
InvalidateRect
DrawTextW
DrawTextExW
TabbedTextOutW
GetDC
ReleaseDC
GetSysColorBrush
LoadCursorW
DestroyMenu
UpdateWindow
GrayStringW

gdi32

GetClipBox
GetStockObject
PtVisible
RectVisible
RestoreDC
SaveDC
SelectObject
SetMapMode
TextOutW
ExtTextOutW
SetViewportExtEx
SetViewportOrgEx
SetWindowExtEx
OffsetViewportOrgEx
ScaleViewportExtEx
ScaleWindowExtEx
Escape
DeleteObject
CreateBitmap
SetTextColor
SetBkColor
GetDeviceCaps
DeleteDC

winspool.drv

DocumentPropertiesW
OpenPrinterW
ClosePrinter

advapi32

RegEnumValueW
RegQueryValueW
RegEnumKeyW
RegSetValueExW
RegDeleteValueW
RegDeleteKeyW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
RegCloseKey
ReportEventW
CloseEventLog
OpenEventLogW

shell32

ShellExecuteW

shlwapi

PathStripToRootW
PathFindExtensionW
PathFindFileNameW
PathIsUNCW

ole32

CoTaskMemFree
CoCreateGuid
CoUninitialize
CoCreateInstance
CoInitialize

oleaut32

VariantChangeType
VariantClear
VariantInit
SysAllocString
SysFreeString

oleacc

CreateStdAccessibleObject
LresultFromObject

Sections

.text
Size: 361KB - Virtual size: 360KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 137KB - Virtual size: 136KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 10KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 21KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 19KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f8b6dcdaf3f046fba65baa23e3026230

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

shlwapi

ole32

oleaut32

oleacc

Sections

.text Size: 361KB - Virtual size: 360KB

.rdata Size: 137KB - Virtual size: 136KB

.data Size: 10KB - Virtual size: 37KB

.pdata Size: 21KB - Virtual size: 20KB

_RDATA Size: 512B - Virtual size: 244B

.rsrc Size: 19KB - Virtual size: 19KB

.reloc Size: 5KB - Virtual size: 5KB

.text
Size: 361KB - Virtual size: 360KB

.rdata
Size: 137KB - Virtual size: 136KB

.data
Size: 10KB - Virtual size: 37KB

.pdata
Size: 21KB - Virtual size: 20KB

_RDATA
Size: 512B - Virtual size: 244B

.rsrc
Size: 19KB - Virtual size: 19KB

.reloc
Size: 5KB - Virtual size: 5KB