4088ba291a52e656dbdded97faa8246a5f07f061b8bd27d4b6d2f396e71da5e9

Sharing

Copy URL

Twitter E-mail

General

Target

4088ba291a52e656dbdded97faa8246a5f07f061b8bd27d4b6d2f396e71da5e9
Size

249KB
MD5

798951ada2392cfeb99fe94ac8baec7d
SHA1

7f77a9324f536ee6765504c4b7d9e45489b6644d
SHA256

4088ba291a52e656dbdded97faa8246a5f07f061b8bd27d4b6d2f396e71da5e9
SHA512

65727bfc30ac67d05ad7e67aea604e7b88074e54ef571cfd2890ae8423119bae4b79e30700e50f6d17c04375b9c5524894ac850c6d7201370b68ffeeee09b329
SSDEEP

6144:n06OZQLY+XQZdynWd+uNpwMvLx1BA8pmP8ac:e4TXQ/ynWIMvLDBAcC8ac

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4088ba291a52e656dbdded97faa8246a5f07f061b8bd27d4b6d2f396e71da5e9

Files

4088ba291a52e656dbdded97faa8246a5f07f061b8bd27d4b6d2f396e71da5e9
.exe windows:6 windows x86 arch:x86

1e750693e1dd5ac0482c057aa6ae06cc

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Gitlab-Runner\builds\p3_obpxJ\0\platform\ngm\ngm\Output\Release\SIG.pdb

Imports

kernel32

GetCurrentThreadId
WaitForSingleObject
SetEvent
GetVolumeInformationW
GetSystemDirectoryW
LoadLibraryW
GetProcAddress
FreeLibrary
VerSetConditionMask
VerifyVersionInfoW
GetNativeSystemInfo
LoadLibraryA
GetCurrentProcess
GlobalMemoryStatus
GetLocaleInfoW
LocalAlloc
LocalFree
Sleep
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
GetModuleFileNameW
CreateFileW
ReadFile
WriteFile
TerminateProcess
CreateDirectoryW
FindNextFileW
FindClose
MapViewOfFile
SetFilePointerEx
GetFileSizeEx
GetLocalTime
LoadLibraryExW
GetModuleHandleExW
GetCommandLineW
GetCurrentProcessId
IsDebuggerPresent
RaiseException
OutputDebugStringW
GetStringTypeW
WriteConsoleW
SetEndOfFile
ReadConsoleW
SetStdHandle
FreeEnvironmentStringsW
CreateFileMappingA
CreateEventA
GetSystemInfo
MultiByteToWideChar
DeleteCriticalSection
DecodePointer
InitializeCriticalSectionEx
FindResourceW
FindResourceExW
LoadResource
LockResource
SizeofResource
GetProcessHeap
HeapAlloc
HeapFree
HeapReAlloc
HeapSize
HeapDestroy
GetTickCount
GetLastError
CreateMutexW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
UnmapViewOfFile
GetACP
IsValidCodePage
FindFirstFileExW
GetConsoleMode
GetConsoleOutputCP
CloseHandle
ReleaseMutex
FlushFileBuffers
LCMapStringW
GetFileType
GetStdHandle
ExitProcess
FreeLibraryAndExitThread
ExitThread
CreateThread
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
SetLastError
RtlUnwind
InitializeSListHead
GetSystemTimeAsFileTime
QueryPerformanceCounter
GetModuleHandleW
GetStartupInfoW
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCPInfo
EncodePointer

user32

GetSystemMetrics
MessageBoxW

advapi32

RegQueryValueExW
RegCloseKey
RegOpenKeyExW
FreeSid
SetSecurityDescriptorSacl
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
SetEntriesInAclW
GetSecurityDescriptorSacl
AllocateAndInitializeSid

shell32

SHGetFolderPathW
SHGetSpecialFolderPathW

ole32

CoCreateInstance
CoInitializeSecurity
CoSetProxyBlanket
CoUninitialize
CoInitialize

oleaut32

VariantClear
SysAllocString
SysFreeString

shlwapi

PathGetDriveNumberW
PathFileExistsW

wininet

InternetOpenUrlW
InternetOpenW
InternetSetCookieW
InternetCloseHandle

version

VerQueryValueW
GetFileVersionInfoW

Sections

.text
Size: 171KB - Virtual size: 171KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 61KB - Virtual size: 60KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

1e750693e1dd5ac0482c057aa6ae06cc

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

wininet

version

Sections

.text Size: 171KB - Virtual size: 171KB

.rdata Size: 61KB - Virtual size: 60KB

.data Size: 3KB - Virtual size: 7KB

.rsrc Size: 5KB - Virtual size: 4KB

.reloc Size: 7KB - Virtual size: 7KB

.text
Size: 171KB - Virtual size: 171KB

.rdata
Size: 61KB - Virtual size: 60KB

.data
Size: 3KB - Virtual size: 7KB

.rsrc
Size: 5KB - Virtual size: 4KB

.reloc
Size: 7KB - Virtual size: 7KB