AlwaysShadow[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

AlwaysShadow.exe
Size

4.2MB
MD5

1d1723e9443a08df1b3eda3b94e653ab
SHA1

98aa71d6213a018cc8369a0cd3748dd60e1dff5a
SHA256

43ad2e1903de35388aa6f316ee2f369de5c64f9321499436d841a701bda8e247
SHA512

bb76e794882f423e17c5d5a1642b65ccad534d6dc884a095a2ef2bf1bea501d325de8b02260069019a77e6d19394ae7a4e573fcf42159389a859e001e710510a
SSDEEP

98304:+BmWat5xca6AlTxnBAUZLGqc2LSTNh+y5gS0lmkv6:K78nVVkzgQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
AlwaysShadow.exe

Files

AlwaysShadow.exe
.exe windows:4 windows x64 arch:x64

49f9bbf8aee4a71d875246b07067018f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

CryptAcquireContextA
CryptCreateHash
CryptDestroyHash
CryptDestroyKey
CryptEncrypt
CryptGetHashParam
CryptHashData
CryptImportKey
CryptReleaseContext
RegCloseKey
RegCreateKeyW
RegDeleteKeyValueW
RegGetValueW
RegOpenKeyExA
RegQueryValueExA
RegSetValueExW

bcrypt

BCryptCloseAlgorithmProvider
BCryptCreateHash
BCryptDecrypt
BCryptDeriveKey
BCryptDestroyHash
BCryptDestroyKey
BCryptDestroySecret
BCryptEncrypt
BCryptExportKey
BCryptFinalizeKeyPair
BCryptFinishHash
BCryptGenRandom
BCryptGenerateKeyPair
BCryptGetProperty
BCryptHashData
BCryptImportKey
BCryptImportKeyPair
BCryptOpenAlgorithmProvider
BCryptSecretAgreement
BCryptSetProperty
BCryptSignHash
BCryptVerifySignature

crypt32

CertAddCertificateContextToStore
CertCloseStore
CertCreateCertificateChainEngine
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFindExtension
CertFreeCertificateChain
CertFreeCertificateChainEngine
CertFreeCertificateContext
CertGetCertificateChain
CertGetNameStringA
CertOpenStore
CryptDecodeObjectEx
CryptQueryObject
CryptStringToBinaryA
PFXImportCertStore

kernel32

AcquireSRWLockExclusive
AddVectoredExceptionHandler
CancelIo
CloseHandle
CreateEventA
CreateEventW
CreateFileA
CreateFileMappingA
CreateSemaphoreA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
EnumResourceLanguagesA
EnumSystemLocalesA
FileTimeToSystemTime
FormatMessageW
FreeLibrary
GetACP
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetEnvironmentVariableA
GetFileSizeEx
GetFileType
GetHandleInformation
GetLastError
GetLocalTime
GetLocaleInfoA
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleW
GetOverlappedResult
GetProcAddress
GetProcessAffinityMask
GetStartupInfoA
GetStdHandle
GetSystemDirectoryA
GetSystemTimeAsFileTime
GetThreadContext
GetThreadLocale
GetThreadPriority
GetTickCount
GetTickCount64
GetTimeZoneInformation
InitializeCriticalSection
InitializeCriticalSectionEx
IsDBCSLeadByteEx
IsDebuggerPresent
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryA
LoadLibraryW
MapViewOfFile
MoveFileExA
MultiByteToWideChar
OpenFileMappingW
OpenProcess
OutputDebugStringA
PeekNamedPipe
QueryPerformanceCounter
QueryPerformanceFrequency
RaiseException
ReadFile
ReleaseSRWLockExclusive
ReleaseSemaphore
RemoveVectoredExceptionHandler
ResetEvent
ResumeThread
SetCurrentDirectoryW
SetEvent
SetHandleInformation
SetLastError
SetProcessAffinityMask
SetThreadContext
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SleepEx
SuspendThread
SystemTimeToFileTime
TerminateProcess
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnmapViewOfFile
VerSetConditionMask
VerifyVersionInfoW
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WaitForSingleObjectEx
WaitNamedPipeA
WideCharToMultiByte
WriteFile

msvcrt

__C_specific_handler
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__initenv
__iob_func
__set_app_type
__setusermatherr
_access
_acmdln
_amsg_exit
_assert
_beginthreadex
_cexit
_close
_commode
_close
_difftime64
_endthreadex
_errno
_fdopen
_fileno
_fmode
_fstat64
_gmtime64
_initterm
_ismbblead
_localtime64
_lock
_lseeki64
_onexit
_open
_read
_setjmp
_snwprintf_s
_stat64
_strdup
_strdup
_stricmp
_strtoi64
_strtoui64
_sys_errlist
_sys_nerr
_time64
_ultoa
_unlink
_unlock
_wcserror
_wfopen_s
_wfsopen
_wgetcwd
_wmkdir
_wopen
_write
abort
atoi
bsearch
calloc
exit
fclose
feof
fflush
fgets
fopen
fprintf
fputc
fread
free
fseek
ftell
fwrite
getc
getenv
isalnum
isalpha
isspace
isupper
iswctype
isxdigit
localeconv
longjmp
malloc
mbstowcs
mbstowcs_s
memchr
memcmp
memcpy
memmove
memset
printf
putc
qsort
rand
realloc
rewind
setlocale
signal
srand
strchr
strcmp
strcpy
strcspn
strerror
strftime
strlen
strncmp
strncpy
strpbrk
strrchr
strspn
strstr
strtol
strtoul
swprintf_s
tolower
towlower
towupper
ungetc
vfprintf
wcschr
wcscmp
wcscpy
wcscpy_s
wcslen
wcsncmp
wcsncpy
wcsstr
wcstombs

ole32

CoCreateInstance
CoInitializeEx
CoInitializeSecurity
CoTaskMemFree
CoUninitialize

oleaut32

SysAllocString
SysFreeString
VariantClear

shell32

SHGetKnownFolderPath
ShellExecuteW
Shell_NotifyIconW

shlwapi

PathRemoveFileSpecW

user32

CreateWindowExW
DefWindowProcW
DestroyMenu
DestroyWindow
DialogBoxParamW
DispatchMessageW
EndDialog
FindWindowA
GetDlgItem
GetMessageW
GetSubMenu
GetSystemMetrics
KillTimer
LoadIconW
LoadMenuW
MessageBoxW
PostQuitMessage
RegisterClassW
SendInput
SendMessageA
SendMessageW
SetForegroundWindow
SetMenuItemInfoW
SetTimer
TrackPopupMenuEx
TranslateMessage
UnregisterClassW

wldap32

ber_free
ldap_bind_s
ldap_err2string
ldap_first_attribute
ldap_first_entry
ldap_get_dn
ldap_get_values_len
ldap_init
ldap_memfree
ldap_msgfree
ldap_next_attribute
ldap_next_entry
ldap_search_s
ldap_set_option
ldap_simple_bind_s
ldap_sslinit
ldap_unbind_s
ldap_value_free_len

ws2_32

WSACleanup
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAGetLastError
WSAIoctl
WSAResetEvent
WSASetEvent
WSASetLastError
WSAStartup
WSAStringToAddressW
WSAWaitForMultipleEvents
__WSAFDIsSet
accept
bind
closesocket
connect
freeaddrinfo
getaddrinfo
gethostname
getpeername
getsockname
getsockopt
htonl
htons
inet_ntop
inet_pton
ioctlsocket
listen
ntohs
recv
recvfrom
select
send
sendto
setsockopt
socket

Exports

Exports

cJSON_AddArrayToObject
cJSON_AddBoolToObject
cJSON_AddFalseToObject
cJSON_AddItemReferenceToArray
cJSON_AddItemReferenceToObject
cJSON_AddItemToArray
cJSON_AddItemToObject
cJSON_AddItemToObjectCS
cJSON_AddNullToObject
cJSON_AddNumberToObject
cJSON_AddObjectToObject
cJSON_AddRawToObject
cJSON_AddStringToObject
cJSON_AddTrueToObject
cJSON_Compare
cJSON_CreateArray
cJSON_CreateArrayReference
cJSON_CreateBool
cJSON_CreateDoubleArray
cJSON_CreateFalse
cJSON_CreateFloatArray
cJSON_CreateIntArray
cJSON_CreateNull
cJSON_CreateNumber
cJSON_CreateObject
cJSON_CreateObjectReference
cJSON_CreateRaw
cJSON_CreateString
cJSON_CreateStringArray
cJSON_CreateStringReference
cJSON_CreateTrue
cJSON_Delete
cJSON_DeleteItemFromArray
cJSON_DeleteItemFromObject
cJSON_DeleteItemFromObjectCaseSensitive
cJSON_DetachItemFromArray
cJSON_DetachItemFromObject
cJSON_DetachItemFromObjectCaseSensitive
cJSON_DetachItemViaPointer
cJSON_Duplicate
cJSON_GetArrayItem
cJSON_GetArraySize
cJSON_GetErrorPtr
cJSON_GetNumberValue
cJSON_GetObjectItem
cJSON_GetObjectItemCaseSensitive
cJSON_GetStringValue
cJSON_HasObjectItem
cJSON_InitHooks
cJSON_InsertItemInArray
cJSON_IsArray
cJSON_IsBool
cJSON_IsFalse
cJSON_IsInvalid
cJSON_IsNull
cJSON_IsNumber
cJSON_IsObject
cJSON_IsRaw
cJSON_IsString
cJSON_IsTrue
cJSON_Minify
cJSON_Parse
cJSON_ParseWithLength
cJSON_ParseWithLengthOpts
cJSON_ParseWithOpts
cJSON_Print
cJSON_PrintBuffered
cJSON_PrintPreallocated
cJSON_PrintUnformatted
cJSON_ReplaceItemInArray
cJSON_ReplaceItemInObject
cJSON_ReplaceItemInObjectCaseSensitive
cJSON_ReplaceItemViaPointer
cJSON_SetNumberHelper
cJSON_SetValuestring
cJSON_Version
cJSON_free
cJSON_malloc

Sections

.text
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 20KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 6KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 14KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 68KB - Virtual size: 68KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/4
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/19
Size: 267KB - Virtual size: 266KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/31
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/45
Size: 59KB - Virtual size: 58KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/57
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/70
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/81
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/97
Size: 72KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

/113
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

49f9bbf8aee4a71d875246b07067018f

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

bcrypt

crypt32

kernel32

msvcrt

ole32

oleaut32

shell32

shlwapi

user32

wldap32

ws2_32

Exports

Exports

Sections

.text Size: 1.3MB - Virtual size: 1.3MB

.data Size: 20KB - Virtual size: 20KB

.rdata Size: 1.6MB - Virtual size: 1.6MB

.pdata Size: 39KB - Virtual size: 39KB

.xdata Size: 40KB - Virtual size: 39KB

.bss Size: - Virtual size: 6KB

.edata Size: 2KB - Virtual size: 2KB

.idata Size: 14KB - Virtual size: 13KB

.CRT Size: 512B - Virtual size: 104B

.tls Size: 512B - Virtual size: 16B

.rsrc Size: 68KB - Virtual size: 68KB

.reloc Size: 4KB - Virtual size: 4KB

/4 Size: 3KB - Virtual size: 3KB

/19 Size: 267KB - Virtual size: 266KB

/31 Size: 24KB - Virtual size: 24KB

/45 Size: 59KB - Virtual size: 58KB

/57 Size: 10KB - Virtual size: 9KB

/70 Size: 1KB - Virtual size: 1KB

/81 Size: 17KB - Virtual size: 16KB

/97 Size: 72KB - Virtual size: 72KB

/113 Size: 3KB - Virtual size: 2KB

.text
Size: 1.3MB - Virtual size: 1.3MB

.data
Size: 20KB - Virtual size: 20KB

.rdata
Size: 1.6MB - Virtual size: 1.6MB

.pdata
Size: 39KB - Virtual size: 39KB

.xdata
Size: 40KB - Virtual size: 39KB

.bss
Size: - Virtual size: 6KB

.edata
Size: 2KB - Virtual size: 2KB

.idata
Size: 14KB - Virtual size: 13KB

.CRT
Size: 512B - Virtual size: 104B

.tls
Size: 512B - Virtual size: 16B

.rsrc
Size: 68KB - Virtual size: 68KB

.reloc
Size: 4KB - Virtual size: 4KB

/4
Size: 3KB - Virtual size: 3KB

/19
Size: 267KB - Virtual size: 266KB

/31
Size: 24KB - Virtual size: 24KB

/45
Size: 59KB - Virtual size: 58KB

/57
Size: 10KB - Virtual size: 9KB

/70
Size: 1KB - Virtual size: 1KB

/81
Size: 17KB - Virtual size: 16KB

/97
Size: 72KB - Virtual size: 72KB

/113
Size: 3KB - Virtual size: 2KB