f834fe5eca9f6875a1b6d36f42e2d9043b5eb344a21dc0b55f7d56001b2007c5

Sharing

Copy URL Twitter E-mail

General

Target

f834fe5eca9f6875a1b6d36f42e2d9043b5eb344a21dc0b55f7d56001b2007c5
Size

1.4MB
MD5

287018c889a9592933cb27080a157fce
SHA1

5d4db8959ff85cda5406106008bbe46efad82b7c
SHA256

f834fe5eca9f6875a1b6d36f42e2d9043b5eb344a21dc0b55f7d56001b2007c5
SHA512

0c4468b8103789d439b7a60df5d3e4d6ededb083b32022fe953a6ae97f3faf6eff6ad29b3ea8f58a58e8487934e159026aad12a199773bd5876c93d8eae603ca
SSDEEP

24576:7rgk3IjyrN70cmVQ1ruOmiLP5GQn65dsSwYl0J:7rgk3IjyrN70cmVQ1ruOm0P5N/m

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f834fe5eca9f6875a1b6d36f42e2d9043b5eb344a21dc0b55f7d56001b2007c5

Files

f834fe5eca9f6875a1b6d36f42e2d9043b5eb344a21dc0b55f7d56001b2007c5
.exe windows:6 windows x64 arch:x64

6c85be73ea519cb644ba70356d4d276f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

rs_loader.pdb

Imports

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressAll
WaitOnAddress
WakeByAddressSingle

ws2_32

recv
freeaddrinfo
WSASocketW
getaddrinfo
send
WSAStartup
WSAGetLastError
connect
closesocket
WSACleanup

kernel32

GetDiskFreeSpaceExW
CreateFileW
GetLogicalDrives
GetDriveTypeW
GetVolumeInformationW
DeviceIoControl
VirtualQueryEx
GetCurrentThreadId
GetProcessTimes
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
CloseHandle
HeapFree
HeapAlloc
GetProcessHeap
AddVectoredExceptionHandler
SetThreadStackGuarantee
SwitchToThread
CreateWaitableTimerExW
SetWaitableTimer
WaitForSingleObject
Sleep
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetLastError
GetCurrentDirectoryW
GetEnvironmentVariableW
OpenProcess
SetFileInformationByHandle
GetCurrentProcess
ReadProcessMemory
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GlobalMemoryStatusEx
GetTickCount64
LocalFree
GetSystemTimes
GetProcessIoCounters
GetCurrentProcessId
GetSystemInfo
GetStdHandle
GetCurrentThread
VirtualProtect
SetHandleInformation
QueryPerformanceFrequency
GetSystemTimePreciseAsFileTime
VirtualAlloc
HeapReAlloc
lstrlenW
ReleaseMutex
FindClose
GetFileInformationByHandle
GetFileInformationByHandleEx
GetProcAddress
GetLastError
FindFirstFileW
LoadLibraryA
GetConsoleMode
CreateMutexA
GetModuleHandleW
FormatMessageW
ExitProcess
MultiByteToWideChar
WriteConsoleW
WideCharToMultiByte
CreateThread
GetFullPathNameW
GetModuleHandleA
WaitForSingleObjectEx
IsProcessorFeaturePresent

iphlpapi

GetAdaptersAddresses
FreeMibTable
GetIfEntry2
GetIfTable2

advapi32

OpenProcessToken
GetTokenInformation
IsValidSid
GetLengthSid
CopySid
LookupAccountSidW

psapi

GetPerformanceInfo
GetModuleFileNameExW

ntdll

RtlGetVersion
NtWriteFile
RtlNtStatusToDosError
NtQueryInformationProcess
NtQuerySystemInformation

shell32

CommandLineToArgvW

ole32

CoInitializeSecurity
CoCreateInstance
CoSetProxyBlanket
CoInitializeEx
CoUninitialize

oleaut32

SysFreeString
VariantClear
SysAllocString

pdh

PdhGetFormattedCounterValue
PdhCollectQueryData
PdhCloseQuery
PdhRemoveCounter
PdhAddEnglishCounterW
PdhOpenQueryA

powrprof

CallNtPowerInformation

netapi32

NetApiBufferFree
NetUserGetInfo
NetUserGetLocalGroups
NetUserEnum

secur32

LsaFreeReturnBuffer
LsaGetLogonSessionData
LsaEnumerateLogonSessions

vcruntime140

memset
__current_exception_context
__current_exception
__C_specific_handler
_CxxThrowException
__CxxFrameHandler3
memcpy
memmove
memcmp

api-ms-win-crt-string-l1-1-0

wcslen

api-ms-win-crt-heap-l1-1-0

_set_new_mode
realloc
free

api-ms-win-crt-runtime-l1-1-0

_initterm
_set_app_type
_seh_filter_exe
_register_onexit_function
_initterm_e
_get_initial_narrow_environment
_exit
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_configure_narrow_argv
exit
_initialize_onexit_table
_initialize_narrow_environment
_crt_atexit
__p___argc
terminate

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 938KB - Virtual size: 938KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 451KB - Virtual size: 451KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 904B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6c85be73ea519cb644ba70356d4d276f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

bcryptprimitives

api-ms-win-core-synch-l1-2-0

ws2_32

kernel32

iphlpapi

advapi32

psapi

ntdll

shell32

ole32

oleaut32

pdh

powrprof

netapi32

secur32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 938KB - Virtual size: 938KB

.rdata Size: 451KB - Virtual size: 451KB

.data Size: 512B - Virtual size: 904B

.pdata Size: 73KB - Virtual size: 73KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 938KB - Virtual size: 938KB

.rdata
Size: 451KB - Virtual size: 451KB

.data
Size: 512B - Virtual size: 904B

.pdata
Size: 73KB - Virtual size: 73KB

.reloc
Size: 3KB - Virtual size: 3KB