aeddfb713ffa2e81c910bb88aed1f5209982537ab0d301c2ad729fde854be28b

Sharing

Copy URL

Twitter E-mail

General

Target

aeddfb713ffa2e81c910bb88aed1f5209982537ab0d301c2ad729fde854be28b
Size

401KB
MD5

e1071d70c7894b8dd7b18f322414378b
SHA1

69162821ea623e9ca3d8aabee6902830e2c1c10a
SHA256

aeddfb713ffa2e81c910bb88aed1f5209982537ab0d301c2ad729fde854be28b
SHA512

84dd51977966f432467104c08f28a94cdc6b492ea1e3921967a774839e2e30aed10429881232a3d4916adaafa27aaca06cd8adba1eb7855a5081a3fae6280fa2
SSDEEP

6144:piLAT7L9rYwjzOAOLjrPeQ8kt4VvWTJpx/AueMQHJ7sDXlOMG:hTHqa4PeZ7VO7DX5

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aeddfb713ffa2e81c910bb88aed1f5209982537ab0d301c2ad729fde854be28b

Files

aeddfb713ffa2e81c910bb88aed1f5209982537ab0d301c2ad729fde854be28b
.exe windows:6 windows x64 arch:x64

6d08d709a87c8bb8f109ee4bf0ceac94

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

F:\vcpkg\buildtrees\libe57\x64-windows-rel\las2e57.pdb

Imports

xerces-c_3_2

?notationDecl@DefaultHandler@xercesc_3_2@@UEAAXQEB_S00@Z
?resetErrors@DefaultHandler@xercesc_3_2@@UEAAXXZ
?resetDocument@DefaultHandler@xercesc_3_2@@UEAAXXZ
?resetDocType@DefaultHandler@xercesc_3_2@@UEAAXXZ
?resolveEntity@DefaultHandler@xercesc_3_2@@UEAAPEAVInputSource@2@QEB_S0@Z
?unparsedEntityDecl@DefaultHandler@xercesc_3_2@@UEAAXQEB_S000@Z
?setDocumentLocator@DefaultHandler@xercesc_3_2@@UEAAXQEBVLocator@2@@Z
?startPrefixMapping@DefaultHandler@xercesc_3_2@@UEAAXQEB_S0@Z
?endPrefixMapping@DefaultHandler@xercesc_3_2@@UEAAXQEB_S@Z
?skippedEntity@DefaultHandler@xercesc_3_2@@UEAAXQEB_S@Z
?comment@DefaultHandler@xercesc_3_2@@UEAAXQEB_S_K@Z
?endCDATA@DefaultHandler@xercesc_3_2@@UEAAXXZ
?endDTD@DefaultHandler@xercesc_3_2@@UEAAXXZ
?endEntity@DefaultHandler@xercesc_3_2@@UEAAXQEB_S@Z
?startCDATA@DefaultHandler@xercesc_3_2@@UEAAXXZ
?startDTD@DefaultHandler@xercesc_3_2@@UEAAXQEB_S00@Z
?startEntity@DefaultHandler@xercesc_3_2@@UEAAXQEB_S@Z
?attributeDecl@DefaultHandler@xercesc_3_2@@UEAAXQEB_S0000@Z
?elementDecl@DefaultHandler@xercesc_3_2@@UEAAXQEB_S0@Z
?externalEntityDecl@DefaultHandler@xercesc_3_2@@UEAAXQEB_S00@Z
?internalEntityDecl@DefaultHandler@xercesc_3_2@@UEAAXQEB_S0@Z
?getEncoding@InputSource@xercesc_3_2@@UEBAPEB_SXZ
?getPublicId@InputSource@xercesc_3_2@@UEBAPEB_SXZ
?getSystemId@InputSource@xercesc_3_2@@UEBAPEB_SXZ
?getIssueFatalErrorIfNotFound@InputSource@xercesc_3_2@@UEBA_NXZ
?setIssueFatalErrorIfNotFound@InputSource@xercesc_3_2@@UEAAX_N@Z
?getEncoding@BinInputStream@xercesc_3_2@@UEBAPEB_SXZ
?setEncoding@InputSource@xercesc_3_2@@UEAAXQEB_S@Z
?setPublicId@InputSource@xercesc_3_2@@UEAAXQEB_S@Z
?setSystemId@InputSource@xercesc_3_2@@UEAAXQEB_S@Z
?fgXercesDynamic@XMLUni@xercesc_3_2@@2QB_SB
?fgXercesSchema@XMLUni@xercesc_3_2@@2QB_SB
?fgXercesSchemaFullChecking@XMLUni@xercesc_3_2@@2QB_SB
?fgSAX2CoreValidation@XMLUni@xercesc_3_2@@2QB_SB
?fgSAX2CoreNameSpaces@XMLUni@xercesc_3_2@@2QB_SB
?fgSAX2CoreNameSpacePrefixes@XMLUni@xercesc_3_2@@2QB_SB
?fgXercescDefaultLocale@XMLUni@xercesc_3_2@@2QBDB
?fgMemoryManager@XMLPlatformUtils@xercesc_3_2@@2PEAVMemoryManager@2@EA
??3XMemory@xercesc_3_2@@SAXPEAX@Z
?ignorableWhitespace@DefaultHandler@xercesc_3_2@@UEAAXQEB_S_K@Z
??0BinInputStream@xercesc_3_2@@IEAA@XZ
??1BinInputStream@xercesc_3_2@@UEAA@XZ
??0InputSource@xercesc_3_2@@IEAA@QEBDQEAVMemoryManager@1@@Z
??1InputSource@xercesc_3_2@@UEAA@XZ
??1TranscodeToStr@xercesc_3_2@@QEAA@XZ
??0TranscodeToStr@xercesc_3_2@@QEAA@PEB_SPEBDPEAVMemoryManager@1@@Z
??1DefaultHandler@xercesc_3_2@@UEAA@XZ
??0DefaultHandler@xercesc_3_2@@QEAA@XZ
?getSystemId@SAXParseException@xercesc_3_2@@QEBAPEB_SXZ
?getLineNumber@SAXParseException@xercesc_3_2@@QEBA_KXZ
?getColumnNumber@SAXParseException@xercesc_3_2@@QEBA_KXZ
?createXMLReader@XMLReaderFactory@xercesc_3_2@@SAPEAVSAX2XMLReader@2@QEAVMemoryManager@2@QEAVXMLGrammarPool@2@@Z
?get@?$ArrayJanitor@E@xercesc_3_2@@QEBAPEAEXZ
?transcode@XMLString@xercesc_3_2@@SAPEADQEB_SQEAVMemoryManager@2@@Z
?Terminate@XMLPlatformUtils@xercesc_3_2@@SAXXZ
?Initialize@XMLPlatformUtils@xercesc_3_2@@SAXQEBD0QEAVPanicHandler@2@QEAVMemoryManager@2@@Z
?getMessage@XMLException@xercesc_3_2@@QEBAPEB_SXZ
??2XMemory@xercesc_3_2@@SAPEAX_K@Z

bcrypt

BCryptGenRandom
BCryptCloseAlgorithmProvider
BCryptOpenAlgorithmProvider

kernel32

GetModuleHandleW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive

msvcp140

??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?fail@ios_base@std@@QEBA_NXZ
?setprecision@std@@YA?AU?$_Smanip@_J@1@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@PEBX@Z
?precision@ios_base@std@@QEAA_J_J@Z
?precision@ios_base@std@@QEBA_JXZ
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@G@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAADD@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
??0_Lockit@std@@QEAA@H@Z
??1_Lockit@std@@QEAA@XZ
?uncaught_exception@std@@YA_NXZ
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
??Bid@locale@std@@QEAA_KXZ
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?always_noconv@codecvt_base@std@@QEBA_NXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?good@ios_base@std@@QEBA_NXZ
?flags@ios_base@std@@QEBAHXZ
?flags@ios_base@std@@QEAAHH@Z
?setf@ios_base@std@@QEAAHHH@Z
?width@ios_base@std@@QEBA_JXZ
?width@ios_base@std@@QEAA_J_J@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?eback@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pbase@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?pptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?egptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?setg@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?epptr@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBAPEADXZ
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Gnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?pbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD0@Z
?setp@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAD00@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Pnavail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEBA_JXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ

vcruntime140

_purecall
__std_terminate
__std_exception_destroy
_CxxThrowException
memcmp
memcpy
memmove
__current_exception_context
__current_exception
__C_specific_handler
memchr
__RTDynamicCast
memset
__std_exception_copy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_register_thread_local_exe_atexit_callback
_initterm
_initterm_e
exit
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_exit
terminate
__p___argc
__p___argv
_cexit
_set_app_type
_c_exit
_invalid_parameter_noinfo_noreturn

api-ms-win-crt-heap-l1-1-0

_callnewh
_set_new_mode
malloc
free

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
_set_fmode
_get_stream_buffer_pointers
fclose
fflush
fgetc
fgetpos
fputc
fread
fsetpos
_fseeki64
fwrite
setvbuf
ungetc
_sopen_s
__stdio_common_vfprintf
__p__commode
_lseeki64
_close
_read
_write

api-ms-win-crt-filesystem-l1-1-0

_lock_file
_unlink
_unlock_file

api-ms-win-crt-math-l1-1-0

fmod
floor
floorf
__setusermatherr

api-ms-win-crt-string-l1-1-0

strcmp
strncmp

api-ms-win-crt-convert-l1-1-0

atof
_atoi64

api-ms-win-crt-time-l1-1-0

_ftime64_s

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 299KB - Virtual size: 299KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 85KB - Virtual size: 85KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6d08d709a87c8bb8f109ee4bf0ceac94

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

xerces-c_3_2

bcrypt

kernel32

msvcp140

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 299KB - Virtual size: 299KB

.rdata Size: 85KB - Virtual size: 85KB

.data Size: 5KB - Virtual size: 7KB

.pdata Size: 8KB - Virtual size: 8KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 299KB - Virtual size: 299KB

.rdata
Size: 85KB - Virtual size: 85KB

.data
Size: 5KB - Virtual size: 7KB

.pdata
Size: 8KB - Virtual size: 8KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 1KB - Virtual size: 1KB