dacc5a81735c02a070633b2696988d712472fde2ab3619dcbeb57903fcf80e47

Sharing

Copy URL Twitter E-mail

General

Target

dacc5a81735c02a070633b2696988d712472fde2ab3619dcbeb57903fcf80e47
Size

2.0MB
MD5

3319bf937be3fa088c12f4536b6c55d9
SHA1

86e106d0a5b508c58b9f0b934f5672cc24b38eb0
SHA256

dacc5a81735c02a070633b2696988d712472fde2ab3619dcbeb57903fcf80e47
SHA512

7476e05928259cec777971968696359c5a2b2d8a465fc1e9eeb766bb8d5273ffe3ef7d1c3ca1e52e82e29d7451d85cfb57af70a58755709550596ca5f71057d3
SSDEEP

49152:l+NPhf2YQCaOgmMgW++jGW/oaSQDrDNL2aXfvn:kEPWaSQDvxXfvn

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dacc5a81735c02a070633b2696988d712472fde2ab3619dcbeb57903fcf80e47

Files

dacc5a81735c02a070633b2696988d712472fde2ab3619dcbeb57903fcf80e47
.exe windows:6 windows x64 arch:x64

600c01c30288feeb9106a4b072258ca6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\michallispashidis\_git\t1c-packagers\rust\tools\launcher\target\x86_64-pc-windows-msvc\release\deps\trust1team_launch.pdb

Imports

secur32

LsaEnumerateLogonSessions
LsaGetLogonSessionData
LsaFreeReturnBuffer

kernel32

UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsDebuggerPresent
CloseHandle
AttachConsole
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockShared
CreateFileW
GetConsoleMode
GetLastError
lstrlenW
GetProcAddress
GetCurrentProcessId
GetTickCount64
GlobalMemoryStatusEx
GetDiskFreeSpaceExW
GetProcessTimes
GetExitCodeProcess
GetProcessHeap
HeapFree
HeapAlloc
OpenProcess
LocalAlloc
LocalFree
GetSystemTimes
GetProcessIoCounters
VirtualQueryEx
ReadProcessMemory
GetSystemInfo
GetLogicalDrives
GetDriveTypeW
GetVolumeInformationW
DeviceIoControl
SleepConditionVariableSRW
TryAcquireSRWLockExclusive
GetStdHandle
GetFileInformationByHandleEx
FreeEnvironmentStringsW
ReleaseMutex
FindClose
CompareStringOrdinal
AddVectoredExceptionHandler
SetThreadStackGuarantee
SwitchToThread
Sleep
GetCurrentProcess
GetCurrentThread
RtlCaptureContext
RtlLookupFunctionEntry
SetLastError
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
GetCommandLineW
SetFileInformationByHandle
DuplicateHandle
SetFilePointerEx
WriteFileEx
SleepEx
ReadFileEx
WaitForSingleObject
TerminateProcess
GetProcessId
WakeAllConditionVariable
WakeConditionVariable
QueryPerformanceCounter
QueryPerformanceFrequency
HeapReAlloc
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetModuleHandleA
GetFileInformationByHandle
CreateDirectoryW
FindFirstFileW
DeleteFileW
CopyFileExW
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
ExitProcess
GetFullPathNameW
CreateNamedPipeW
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
MultiByteToWideChar
WriteConsoleW
WideCharToMultiByte
ReadConsoleW
CreateThread
GetSystemTimeAsFileTime
IsProcessorFeaturePresent
InitializeSListHead
GetCurrentThreadId
RtlVirtualUnwind

shell32

SHGetKnownFolderPath
CommandLineToArgvW

ole32

CoInitializeEx
CoCreateInstance
CoTaskMemFree
CoInitializeSecurity
CoSetProxyBlanket
CoUninitialize

advapi32

OpenProcessToken
GetTokenInformation
SystemFunction036
GetUserNameW
LookupAccountSidW
CopySid
GetLengthSid
IsValidSid

pdh

PdhCloseQuery
PdhOpenQueryA
PdhGetFormattedCounterValue
PdhRemoveCounter
PdhAddEnglishCounterW
PdhCollectQueryData

powrprof

CallNtPowerInformation

iphlpapi

FreeMibTable
GetIfEntry2
GetAdaptersAddresses
GetIfTable2

psapi

GetProcessMemoryInfo
GetModuleFileNameExW
GetPerformanceInfo

ntdll

NtCreateFile
RtlNtStatusToDosError
NtReadFile
RtlGetVersion
NtQueryInformationProcess
NtWriteFile
NtQuerySystemInformation

oleaut32

SysFreeString
SysAllocString
VariantClear

netapi32

NetUserGetInfo
NetUserGetLocalGroups
NetUserEnum
NetApiBufferFree

bcrypt

BCryptGenRandom

vcruntime140

__CxxFrameHandler3
memcpy
memset
memcmp
_CxxThrowException
__C_specific_handler
__current_exception
memmove
__current_exception_context

api-ms-win-crt-string-l1-1-0

strlen
wcslen

api-ms-win-crt-heap-l1-1-0

free
malloc
_set_new_mode
realloc

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment
_get_initial_narrow_environment
_initterm_e
exit
_configure_narrow_argv
_seh_filter_exe
_set_app_type
_exit
_c_exit
_cexit
_initterm
__p___argc
terminate
_crt_atexit
_register_onexit_function
_initialize_onexit_table
__p___argv
_register_thread_local_exe_atexit_callback

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 421KB - Virtual size: 420KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 60KB - Virtual size: 59KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

600c01c30288feeb9106a4b072258ca6

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

secur32

kernel32

shell32

ole32

advapi32

pdh

powrprof

iphlpapi

psapi

ntdll

oleaut32

netapi32

bcrypt

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 421KB - Virtual size: 420KB

.data Size: 5KB - Virtual size: 9KB

.pdata Size: 60KB - Virtual size: 59KB

.reloc Size: 7KB - Virtual size: 7KB

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 421KB - Virtual size: 420KB

.data
Size: 5KB - Virtual size: 9KB

.pdata
Size: 60KB - Virtual size: 59KB

.reloc
Size: 7KB - Virtual size: 7KB