6fbfc66bad5cbb1836315189aa623c45400edc888e0af3c3a928e30484d107c8

Sharing

Copy URL Twitter E-mail

General

Target

6fbfc66bad5cbb1836315189aa623c45400edc888e0af3c3a928e30484d107c8
Size

11KB
MD5

854e72c51e11db53256d1b0938de09bd
SHA1

17d6b57383bfebf4ae2dd626bdaaad446ae52fc9
SHA256

6fbfc66bad5cbb1836315189aa623c45400edc888e0af3c3a928e30484d107c8
SHA512

f8cae4853f6cc1e1767a5cdc574735e7f83bdc4506e35f7165f2a895e5902160bb27f4c4ee57fe0df0c4e14bd169c275b5f79bf503ce5563656221ad79979cb8
SSDEEP

192:KhosrqFSC/6yEfelQog0kO3EifBBSU7YZZVu5pz623Rl:srqFSdmlPg0kO3EipM8YZZVcl

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6fbfc66bad5cbb1836315189aa623c45400edc888e0af3c3a928e30484d107c8

Files

6fbfc66bad5cbb1836315189aa623c45400edc888e0af3c3a928e30484d107c8
.exe windows:6 windows x86 arch:x86

961d79f62077f4d389118234397adcd7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\assemblage\Builds\8073529056296853174pqkoupwjwa\file_operate_by_winapi-master\jigsaw_fucking_file\assemblage_outdir_bin\jigsaw_fucking_file.pdb

Imports

kernel32

HeapFree
lstrlenW
GetStdHandle
CreateToolhelp32Snapshot
GetLastError
Process32NextW
lstrcatW
Process32FirstW
CloseHandle
HeapAlloc
WriteConsoleW
GetProcessHeap
lstrcpyW
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
UnhandledExceptionFilter
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetModuleHandleW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime

user32

MessageBoxW

shell32

ShellExecuteW

vcruntime140

memset
_except_handler4_common
memcpy

api-ms-win-crt-stdio-l1-1-0

__p__commode
__stdio_common_vswprintf
_set_fmode

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_seh_filter_exe
_crt_atexit
_controlfp_s
terminate
_set_app_type
_register_thread_local_exe_atexit_callback
_c_exit
_register_onexit_function
__p___argc
_cexit
_exit
exit
_initterm_e
_initterm
_get_initial_wide_environment
_initialize_wide_environment
_configure_wide_argv
__p___wargv

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

Sections

.text
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 32B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 412B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

961d79f62077f4d389118234397adcd7

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

shell32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 4KB - Virtual size: 4KB

.rdata Size: 3KB - Virtual size: 3KB

.data Size: 512B - Virtual size: 912B

.gfids Size: 512B - Virtual size: 32B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 512B - Virtual size: 412B

.text
Size: 4KB - Virtual size: 4KB

.rdata
Size: 3KB - Virtual size: 3KB

.data
Size: 512B - Virtual size: 912B

.gfids
Size: 512B - Virtual size: 32B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 512B - Virtual size: 412B