d89d6baaac0dd551b74528f9ab66c82a8717bea069f09ad0472df7a8dca9c3e2

Sharing

Copy URL Twitter E-mail

General

Target

d89d6baaac0dd551b74528f9ab66c82a8717bea069f09ad0472df7a8dca9c3e2
Size

6.8MB
MD5

bbb6c17b5412df1003825be613b20a38
SHA1

d04ff796d8a2804ef5f1234e2a4be9c010a95f0e
SHA256

d89d6baaac0dd551b74528f9ab66c82a8717bea069f09ad0472df7a8dca9c3e2
SHA512

040b8c750001b4ccdb1c7cd50d56eead0fcbf74ad40b2c7d08dbe6b173505e9aee9f5ad67e20bd9c52ef813e4c8b75dce48c002b471e9bd88f75ed352e056c3e
SSDEEP

49152:K7QRAZZg7T5xdrZrmcOorDW1E0gSQZPK55Y98o5AHpPtzW6WCKrljyb9n5AbJbGv:dC4R4QlGQeheQqN+/eX2nQVLQ/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d89d6baaac0dd551b74528f9ab66c82a8717bea069f09ad0472df7a8dca9c3e2

Files

d89d6baaac0dd551b74528f9ab66c82a8717bea069f09ad0472df7a8dca9c3e2
.exe windows:6 windows x64 arch:x64

43b745fa596380571b4bee03351c6260

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

penguin.pdb

Imports

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle
WaitOnAddress
WakeByAddressAll

bcrypt

BCryptGenRandom

ntdll

RtlVirtualUnwind
NtCancelIoFileEx
RtlNtStatusToDosError
NtDeviceIoControlFile
NtWriteFile
NtCreateFile
RtlCaptureContext
RtlLookupFunctionEntry
NtReadFile

ws2_32

send
recv
shutdown
getsockopt
WSASend
ioctlsocket
connect
bind
WSASocketW
getsockname
recvfrom
accept
getpeername
sendto
setsockopt
WSAIoctl
closesocket
socket
WSAGetLastError
WSAStartup
WSACleanup
freeaddrinfo
getaddrinfo
listen

kernel32

GetCurrentProcessId
SetHandleInformation
CreateIoCompletionPort
GetQueuedCompletionStatusEx
PostQueuedCompletionStatus
SetFileCompletionNotificationModes
Sleep
GetModuleHandleA
GetSystemInfo
GetStdHandle
GetFileInformationByHandleEx
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
GetLastError
SetConsoleMode
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCurrentThread
SwitchToThread
WaitForSingleObject
QueryPerformanceCounter
SetLastError
GetCurrentDirectoryW
GetEnvironmentVariableW
GetConsoleMode
GetCommandLineW
SetFileInformationByHandle
GetCurrentProcess
SetFilePointerEx
CreateFileW
TerminateProcess
QueryPerformanceFrequency
GetSystemTimePreciseAsFileTime
HeapFree
CloseHandle
HeapReAlloc
lstrlenW
ReleaseMutex
GetProcessHeap
HeapAlloc
GetFileInformationByHandle
GetFinalPathNameByHandleW
GetCurrentThreadId
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
ExitProcess
MultiByteToWideChar
WriteConsoleW
WideCharToMultiByte
ReadConsoleW
CreateThread
GetFullPathNameW
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetProcAddress
IsProcessorFeaturePresent

crypt32

CertCloseStore
CertGetEnhancedKeyUsage
CertOpenStore
CertFreeCertificateContext
CertDuplicateCertificateContext
CertEnumCertificatesInStore

advapi32

SystemFunction036

vcruntime140

memcpy
memcmp
__C_specific_handler
__current_exception_context
__CxxFrameHandler3
__current_exception
_CxxThrowException
memset
memmove

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

_set_app_type
_crt_atexit
_configure_narrow_argv
terminate
_get_initial_narrow_environment
_initterm
_seh_filter_exe
exit
_exit
_register_onexit_function
_initialize_onexit_table
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_initterm_e
_initialize_narrow_environment

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode

Sections

.text
Size: 4.7MB - Virtual size: 4.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 17KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 261KB - Virtual size: 260KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 29KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

43b745fa596380571b4bee03351c6260

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

bcryptprimitives

api-ms-win-core-synch-l1-2-0

bcrypt

ntdll

ws2_32

kernel32

crypt32

advapi32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 4.7MB - Virtual size: 4.7MB

.rdata Size: 1.8MB - Virtual size: 1.8MB

.data Size: 17KB - Virtual size: 20KB

.pdata Size: 261KB - Virtual size: 260KB

.reloc Size: 29KB - Virtual size: 28KB

.text
Size: 4.7MB - Virtual size: 4.7MB

.rdata
Size: 1.8MB - Virtual size: 1.8MB

.data
Size: 17KB - Virtual size: 20KB

.pdata
Size: 261KB - Virtual size: 260KB

.reloc
Size: 29KB - Virtual size: 28KB