d5aaa1ad4f0c8837e9e3d418adee664f06ae4aac4b01cc9ec0369a12a4bbed2e

Sharing

Copy URL Twitter E-mail

General

Target

d5aaa1ad4f0c8837e9e3d418adee664f06ae4aac4b01cc9ec0369a12a4bbed2e
Size

164KB
MD5

505877e4db1ad3f78f55f5ee109a928a
SHA1

b07f0a0ea2ee71895c8a1de5766c3e8a71da393c
SHA256

d5aaa1ad4f0c8837e9e3d418adee664f06ae4aac4b01cc9ec0369a12a4bbed2e
SHA512

bf1ca594b3759aa2a35572c7ce4b8bc4a58d158f8f4f521756e5f41dfa5ebded596a8cef0beb12480915404ebd2b592dbb4ee8c8e59f7fe817fb43dde0b699cb
SSDEEP

1536:8o3GKFM2AOd+4yAXDShiTQnxWsjPUL/cxnWBJbsI9zw:B3G6+4yAXDShiTQnxW/LcWBJo4w

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d5aaa1ad4f0c8837e9e3d418adee664f06ae4aac4b01cc9ec0369a12a4bbed2e

Files

d5aaa1ad4f0c8837e9e3d418adee664f06ae4aac4b01cc9ec0369a12a4bbed2e
.exe windows:6 windows x64 arch:x64

5f31231d568456dbb2210201933e257b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

F:\vcpkg\buildtrees\gmp\x64-windows-dbg\gen-bases.pdb

Imports

kernel32

IsDebuggerPresent
RaiseException
MultiByteToWideChar
WideCharToMultiByte
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
GetStartupInfoW
GetModuleHandleW
GetLastError
HeapAlloc
HeapFree
GetProcessHeap
VirtualQuery
FreeLibrary
GetProcAddress

vcruntime140d

__C_specific_handler
__C_specific_handler_noexcept
__std_type_info_destroy_list
__current_exception
__current_exception_context
__vcrt_GetModuleFileNameW
__vcrt_GetModuleHandleW
__vcrt_LoadLibraryExW
memcpy

ucrtbased

__acrt_iob_func
fwrite
puts
__stdio_common_vfprintf
isspace
_wassert
malloc
realloc
exit
abort
atoi
strcmp
strlen
_CrtDbgReport
_CrtDbgReportW
_seh_filter_exe
_set_app_type
__setusermatherr
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_initterm_e
_exit
_set_fmode
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_configthreadlocale
_set_new_mode
__p__commode
strcpy_s
strcat_s
__stdio_common_vsprintf_s
_seh_filter_dll
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
terminate
_wmakepath_s
_wsplitpath_s
wcscpy_s
free

Sections

.text
Size: 109KB - Virtual size: 109KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 23KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 373B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 966B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5f31231d568456dbb2210201933e257b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

vcruntime140d

ucrtbased

Sections

.text Size: 109KB - Virtual size: 109KB

.rdata Size: 20KB - Virtual size: 19KB

.data Size: 23KB - Virtual size: 25KB

.pdata Size: 4KB - Virtual size: 4KB

.idata Size: 4KB - Virtual size: 4KB

.00cfg Size: 512B - Virtual size: 373B

.reloc Size: 1024B - Virtual size: 966B

.text
Size: 109KB - Virtual size: 109KB

.rdata
Size: 20KB - Virtual size: 19KB

.data
Size: 23KB - Virtual size: 25KB

.pdata
Size: 4KB - Virtual size: 4KB

.idata
Size: 4KB - Virtual size: 4KB

.00cfg
Size: 512B - Virtual size: 373B

.reloc
Size: 1024B - Virtual size: 966B