0c690d6ec1801da1e5ab358694e8c5c7ac1a7a44dc602cd708fc9221dedc7f5a

Sharing

Copy URL Twitter E-mail

General

Target

0c690d6ec1801da1e5ab358694e8c5c7ac1a7a44dc602cd708fc9221dedc7f5a
Size

742KB
MD5

84d28e4411fafe529413be1e7af39c1e
SHA1

876f765356e0ea9133d3f53c41c01cc4fb23d318
SHA256

0c690d6ec1801da1e5ab358694e8c5c7ac1a7a44dc602cd708fc9221dedc7f5a
SHA512

5e6f87627066345da9263d83946c615b62be2988dbf7a610840ff70536d8b88340a53832f2d2ec49268a0c9c6b3a7425ba61259c2069a2579d575402680ef824
SSDEEP

12288:F9NtpRTA3qvfI2OzYbfbJ6myCNAmii6sZwFI42Cc/wdE7JOgmAcnOKSr0TDvsrm+:F9NtpRTsqvfI2OzYbfbJ6fCNAmii6smU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0c690d6ec1801da1e5ab358694e8c5c7ac1a7a44dc602cd708fc9221dedc7f5a

Files

0c690d6ec1801da1e5ab358694e8c5c7ac1a7a44dc602cd708fc9221dedc7f5a
.dll windows:6 windows x64 arch:x64

627793765a5d8a525d00d5d881dc094c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Users\Administrator\Documents\vcpkg\buildtrees\pcre2\x64-od-windows-rel\pcre2-16.pdb

Imports

kernel32

CloseHandle
ReleaseMutex
WaitForSingleObject
CreateMutexA
GetSystemInfo
VirtualAlloc
VirtualFree
IsDebuggerPresent
InitializeSListHead
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

vcruntime140

memcmp
memmove
strchr
__C_specific_handler
__std_type_info_destroy_list
memset

api-ms-win-crt-string-l1-1-0

ispunct
tolower
isspace
islower
isupper
toupper
iscntrl
isgraph
isprint
isalnum
isxdigit
isdigit
isalpha

api-ms-win-crt-heap-l1-1-0

free
malloc

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_execute_onexit_table
_cexit
_seh_filter_dll
_configure_narrow_argv
_initterm_e
_initialize_narrow_environment
_initterm

Exports

Exports

pcre2_callout_enumerate_16
pcre2_code_copy_16
pcre2_code_copy_with_tables_16
pcre2_code_free_16
pcre2_compile_16
pcre2_compile_context_copy_16
pcre2_compile_context_create_16
pcre2_compile_context_free_16
pcre2_config_16
pcre2_convert_context_copy_16
pcre2_convert_context_create_16
pcre2_convert_context_free_16
pcre2_converted_pattern_free_16
pcre2_dfa_match_16
pcre2_general_context_copy_16
pcre2_general_context_create_16
pcre2_general_context_free_16
pcre2_get_error_message_16
pcre2_get_mark_16
pcre2_get_match_data_heapframes_size_16
pcre2_get_match_data_size_16
pcre2_get_ovector_count_16
pcre2_get_ovector_pointer_16
pcre2_get_startchar_16
pcre2_jit_compile_16
pcre2_jit_free_unused_memory_16
pcre2_jit_match_16
pcre2_jit_stack_assign_16
pcre2_jit_stack_create_16
pcre2_jit_stack_free_16
pcre2_maketables_16
pcre2_maketables_free_16
pcre2_match_16
pcre2_match_context_copy_16
pcre2_match_context_create_16
pcre2_match_context_free_16
pcre2_match_data_create_16
pcre2_match_data_create_from_pattern_16
pcre2_match_data_free_16
pcre2_pattern_convert_16
pcre2_pattern_info_16
pcre2_serialize_decode_16
pcre2_serialize_encode_16
pcre2_serialize_free_16
pcre2_serialize_get_number_of_codes_16
pcre2_set_bsr_16
pcre2_set_callout_16
pcre2_set_character_tables_16
pcre2_set_compile_extra_options_16
pcre2_set_compile_recursion_guard_16
pcre2_set_depth_limit_16
pcre2_set_glob_escape_16
pcre2_set_glob_separator_16
pcre2_set_heap_limit_16
pcre2_set_match_limit_16
pcre2_set_max_pattern_length_16
pcre2_set_max_varlookbehind_16
pcre2_set_newline_16
pcre2_set_offset_limit_16
pcre2_set_parens_nest_limit_16
pcre2_set_recursion_limit_16
pcre2_set_recursion_memory_management_16
pcre2_set_substitute_callout_16
pcre2_substitute_16
pcre2_substring_copy_byname_16
pcre2_substring_copy_bynumber_16
pcre2_substring_free_16
pcre2_substring_get_byname_16
pcre2_substring_get_bynumber_16
pcre2_substring_length_byname_16
pcre2_substring_length_bynumber_16
pcre2_substring_list_free_16
pcre2_substring_list_get_16
pcre2_substring_nametable_scan_16
pcre2_substring_number_from_name_16

Sections

.text
Size: 595KB - Virtual size: 594KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 139KB - Virtual size: 139KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 128B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

627793765a5d8a525d00d5d881dc094c

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

Exports

Exports

Sections

.text Size: 595KB - Virtual size: 594KB

.rdata Size: 139KB - Virtual size: 139KB

.data Size: 1024B - Virtual size: 2KB

.pdata Size: 4KB - Virtual size: 4KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 512B - Virtual size: 128B

.text
Size: 595KB - Virtual size: 594KB

.rdata
Size: 139KB - Virtual size: 139KB

.data
Size: 1024B - Virtual size: 2KB

.pdata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 512B - Virtual size: 128B