04c0c21742a70d8181c3f4386ea4d4b0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

04c0c21742a70d8181c3f4386ea4d4b0N.exe
Size

401KB
MD5

04c0c21742a70d8181c3f4386ea4d4b0
SHA1

cdd2462095f17c52d75200a1267fd9ef62284520
SHA256

da7b0b8aed65f8d1dc939f017e89de865c6f3ad4e7cde8f5c7545db0755086cb
SHA512

b706a4647cb43584687069eeeeaa4b3f95191509ab86de2c6fbcc6dc0259c045ca0a3ceeea4c6a8ba2af9bc7cfd42455a510ea4f45ea6ee12476be32924ae070
SSDEEP

6144:Y0JVN9Q7kRwSrJWrtEiOLAORtX2YX5LyvnMqqm1Qz376aBnjT6Vv14KBP8G:Y0JV/Q767lGEi+AORtmhnMqfigv1Lp

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
04c0c21742a70d8181c3f4386ea4d4b0N.exe

Files

04c0c21742a70d8181c3f4386ea4d4b0N.exe
.exe windows:6 windows x64 arch:x64

7dad21dfe390563a0d952e9f9e118b59

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

InputPersonalization.pdb

Imports

kernel32

GetSystemTime
SystemTimeToFileTime
GetStringTypeW
CancelIo
GetOverlappedResult
ReadFile
WaitNamedPipeW
GetFileInformationByHandle
CreateFileMappingW
GetTempPathW
MoveFileExW
UnmapViewOfFile
MapViewOfFile
CreateDirectoryW
GetFileAttributesW
CompareFileTime
FindNextFileW
FindClose
FindFirstFileW
SetFileAttributesW
DeleteFileW
RegEnumValueW
SetThreadPriority
CreateFileW
WriteFile
RegDeleteKeyExW
WaitForMultipleObjects
RegQueryValueExW
RegGetValueW
RegNotifyChangeKeyValue
SetLastError
FlushInstructionCache
InitializeCriticalSectionAndSpinCount
LCMapStringW
LockResource
FormatMessageA
DelayLoadFailureHook
LoadLibraryExA
ExpandEnvironmentStringsW
CreateThread
CloseHandle
ReleaseMutex
GetCurrentThreadId
DeleteCriticalSection
HeapSetInformation
lstrcmpiW
CreateEventW
GetProcAddress
GetLastError
RaiseException
lstrlenW
MultiByteToWideChar
GetModuleFileNameW
GetVersionExW
SizeofResource
Sleep
LoadLibraryW
InitializeCriticalSection
GetCurrentThread
GetModuleHandleW
SetEvent
WaitForSingleObject
GetCurrentProcess
LoadLibraryExW
LoadResource
FreeLibrary
FindResourceW
SetPriorityClass
CreateMutexW
GetTempFileNameW
GetCommandLineW

user32

OffsetRect
IsRectEmpty
GetKeyboardLayoutList
DestroyWindow
PostQuitMessage
PeekMessageW
LoadCursorW
GetWindowLongPtrW
GetClassInfoExW
RegisterClassExW
CreateWindowExW
UnregisterPowerSettingNotification
CharNextW
TranslateMessage
CharUpperW
GetSystemMetrics
PostThreadMessageW
DispatchMessageW
PostMessageW
RegisterPowerSettingNotification
SetWindowLongPtrW
SendMessageW
CallWindowProcW
DefWindowProcW
UnregisterClassA
GetMessageW
MsgWaitForMultipleObjects

msvcrt

_commode
__setusermatherr
_amsg_exit
_initterm
?terminate@@YAXXZ
exit
_cexit
_exit
_XcptFilter
__wgetmainargs
__C_specific_handler
memset
_callnewh
wcscpy_s
wcscat_s
_fmode
_purecall
_resetstkoflw
malloc
calloc
free
wcsncpy_s
_wcsicmp
memmove_s
_unlock
__dllonexit
_lock
_onexit
realloc
_errno
??1type_info@@UEAA@XZ
memcmp
memcpy_s
__set_app_type
_CxxThrowException
__CxxFrameHandler3
___lc_codepage_func
___lc_handle_func
setlocale
__uncaught_exception
__crtLCMapStringA
__pctype_func
isupper
memcpy
islower
abort
_wcmdln
swprintf_s
_vsnwprintf
wcstoul
_wtoi
wcstol
?what@exception@@UEBAPEBDXZ
??1exception@@UEAA@XZ
??0exception@@QEAA@XZ
??0exception@@QEAA@AEBQEBD@Z
??0exception@@QEAA@AEBV0@@Z
_itow
wcschr
_itow_s
_ui64tow_s
_i64tow_s
_wcstoi64
_wtoi64
wcspbrk
_wcsnicmp
_wfopen
fread
_wstat64
fclose
wcsrchr
iswspace
sprintf_s
memchr
localeconv
strcspn

ntdll

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

api-ms-win-core-debug-l1-1-0

OutputDebugStringA

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapDestroy
HeapAlloc
HeapFree
HeapReAlloc
HeapSize

api-ms-win-core-processthreads-l1-1-0

GetStartupInfoW
GetCurrentProcessId
TerminateProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-synch-l1-1-0

LeaveCriticalSection
EnterCriticalSection

api-ms-win-core-sysinfo-l1-1-0

GetVersionExA
GetSystemTimeAsFileTime
GetTickCount

imm32

ImmDisableTextFrameService
ImmDisableIME

ole32

CoInitializeSecurity
CoTaskMemFree
CoTaskMemAlloc
CoRevokeClassObject
StringFromGUID2
CoTaskMemRealloc
CoUninitialize
CoCreateInstance
CoInitialize
CoRegisterClassObject
CLSIDFromString
CoMarshalInterThreadInterfaceInStream
CoGetInterfaceAndReleaseStream
CoInitializeEx
StringFromCLSID

oleaut32

SafeArrayDestroy
SafeArrayCreateVector
VarBstrCat
VarBstrFromI8
VarBstrCmp
SafeArrayUnaccessData
SafeArrayAccessData
SysStringByteLen
VariantInit
SysAllocStringByteLen
VariantClear
SysAllocStringLen
SysFreeString
RegisterTypeLi
VarUI4FromStr
UnRegisterTypeLi
LoadTypeLi
SysStringLen
SysAllocString

shlwapi

PathAppendW
PathAddBackslashW
PathStripPathW
SHCreateStreamOnFileW

rpcrt4

UuidCreateSequential
UuidHash

xmllite

CreateXmlReader

api-ms-win-core-interlocked-l1-1-0

InterlockedPushEntrySList
InterlockedPopEntrySList

api-ms-win-core-memory-l1-1-0

VirtualFree
VirtualAlloc

Sections

.text
Size: 295KB - Virtual size: 294KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 15KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 57KB - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

gaispyr
Size: - Virtual size: 4KB

IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

7dad21dfe390563a0d952e9f9e118b59

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

msvcrt

ntdll

api-ms-win-core-debug-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

imm32

ole32

oleaut32

shlwapi

rpcrt4

xmllite

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-memory-l1-1-0

Sections

.text Size: 295KB - Virtual size: 294KB

.data Size: 3KB - Virtual size: 7KB

.pdata Size: 15KB - Virtual size: 14KB

.rsrc Size: 57KB - Virtual size: 56KB

.reloc Size: 29KB - Virtual size: 30KB

gaispyr Size: - Virtual size: 4KB

.text
Size: 295KB - Virtual size: 294KB

.data
Size: 3KB - Virtual size: 7KB

.pdata
Size: 15KB - Virtual size: 14KB

.rsrc
Size: 57KB - Virtual size: 56KB

.reloc
Size: 29KB - Virtual size: 30KB

gaispyr
Size: - Virtual size: 4KB