3ea6b965e22319cf8c743ca02da1e2c0N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

3ea6b965e22319cf8c743ca02da1e2c0N.exe
Size

1.2MB
MD5

3ea6b965e22319cf8c743ca02da1e2c0
SHA1

fc4664452b7ecb8e6ee88ffd21d8bd4caeeb3035
SHA256

6eb9f85daba0c78a1acc91803b14a83cdb2c82e2868e60bc2dfa4a205db113f5
SHA512

a3bb65efa0d7015efef6c68ad5f746545660a5edad3aa84184779cafc296547420483fffcd3655a15fd017ffa993c44edd931b99e754ccab92354b153c936ba1
SSDEEP

24576:+o+SCbWm3kFQsU684Qr4D/ZQTFue+eAg/KrnjIERFS:bdCam3kFZ+Jr4D/Z+thA4EnlRFS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3ea6b965e22319cf8c743ca02da1e2c0N.exe

Files

3ea6b965e22319cf8c743ca02da1e2c0N.exe
.exe windows:10 windows x64 arch:x64

82f8100005dad7bf0c33dc1d377c0d16

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

FXSSVC.pdb

Imports

advapi32

TraceMessage
ConvertStringSecurityDescriptorToSecurityDescriptorW
ConvertSidToStringSidW
ConvertStringSidToSidW
RegCloseKey
RegDeleteValueW
EqualSid
RegOpenKeyExW
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
StartServiceCtrlDispatcherW
DestroyPrivateObjectSecurity
RegisterServiceCtrlHandlerW
SetServiceStatus
GetLengthSid
IsValidSid
LogonUserW
DuplicateToken
MapGenericMask
AccessCheckAndAuditAlarmW
RegCreateKeyExW
IsValidSecurityDescriptor
GetSecurityDescriptorControl
GetSecurityDescriptorLength
RegSetValueExW
MakeSelfRelativeSD
OpenProcessToken
CreatePrivateObjectSecurity
RegQueryValueExW
OpenThreadToken
GetTokenInformation
SetPrivateObjectSecurity
GetPrivateObjectSecurity
RegQueryInfoKeyW
RegEnumKeyExW
RegDeleteKeyW
RegisterEventSourceW
DeregisterEventSource
CheckTokenMembership
PerfStopProvider
PerfStartProviderEx
PerfCreateInstance
PerfSetCounterSetInfo
PerfSetCounterRefValue
RegDeleteKeyExW
RevertToSelf
ImpersonateLoggedOnUser
GetSecurityDescriptorDacl
ControlService
RegNotifyChangeKeyValue
FreeSid
SetEntriesInAclW
GetSecurityDescriptorOwner
SetSecurityDescriptorOwner
AllocateAndInitializeSid
QueryServiceStatus
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
OpenServiceW
SetSecurityDescriptorGroup
EnumDependentServicesW
OpenSCManagerW
CloseServiceHandle
RegEnumKeyW
AdjustTokenPrivileges
LookupAccountSidW
LookupPrivilegeValueW
LookupAccountNameW
CopySid
ReportEventW

kernel32

DelayLoadFailureHook
ResolveDelayLoadedAPI
LoadLibraryExW
lstrlenA
MulDiv
GetModuleFileNameW
OpenEventW
EnumUILanguagesW
GetLocaleInfoEx
GetTimeFormatW
GetStringTypeExW
OutputDebugStringW
GetSystemDirectoryW
GetFileInformationByHandle
GetFileType
GetTempPathW
CreateFileW
GetTempFileNameW
ExpandEnvironmentStringsW
MultiByteToWideChar
CompareStringW
WideCharToMultiByte
GetDateFormatW
GetVersionExW
InitializeCriticalSectionAndSpinCount
HeapDestroy
SetWaitableTimer
CancelWaitableTimer
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
OutputDebugStringA
TerminateProcess
UnhandledExceptionFilter
GetStartupInfoW
GetLastError
LoadLibraryW
GetProcessHeap
HeapCreate
lstrcmpiW
GetProcAddress
SetLastError
FileTimeToSystemTime
UnmapViewOfFile
CloseHandle
FindFirstFileW
FindClose
LocalFree
GetSystemTimeAsFileTime
DeleteFileW
FindNextFileW
EnterCriticalSection
LeaveCriticalSection
SetEvent
WaitForMultipleObjects
WaitForSingleObject
CreateEventW
GetFileAttributesW
RemoveDirectoryW
CreateDirectoryW
CopyFileW
Sleep
VirtualFree
GetFileSize
WriteFile
ReadFile
PostQueuedCompletionStatus
LocalAlloc
CreateSemaphoreW
InitializeCriticalSection
HeapSetInformation
GetVersion
DeleteCriticalSection
SetErrorMode
SetUnhandledExceptionFilter
CreateThread
GetComputerNameW
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime
GetFileSizeEx
FileTimeToLocalFileTime
lstrcmpW
ResetEvent
GetSystemTimeAdjustment
GetModuleHandleW
CreateWaitableTimerW
GetExitCodeThread
GetCurrentThread
HeapFree
GetCurrentProcess
HeapAlloc
ReleaseSemaphore
GetFullPathNameW
SetFilePointer
GetFileTime
GetSystemTime
MoveFileW
SystemTimeToFileTime
SetFileTime
FormatMessageW
GetLocalTime
SetThreadExecutionState
GetQueuedCompletionStatus
CreateIoCompletionPort
FreeLibrary

msvcrt

??0exception@@QEAA@XZ
memmove
_vsnwprintf
wcsspn
??0exception@@QEAA@AEBQEBD@Z
??1exception@@UEAA@XZ
??0exception@@QEAA@AEBV0@@Z
?what@exception@@UEBAPEBDXZ
_wcsnicmp
swscanf
realloc
wcschr
wcsrchr
iswalpha
memcmp
memcpy
memset
swscanf_s
_wcsicmp
memcpy_s
_wsplitpath_s
memmove_s
_onexit
__dllonexit
_unlock
_lock
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
_commode
_fmode
_wcmdln
__C_specific_handler
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
__CxxFrameHandler3
_CxxThrowException
??0exception@@QEAA@AEBQEBDH@Z
malloc
free
_callnewh
_purecall
qsort
_ltow
wcsstr
_itow
wcsncmp
_wcsnset
wcscmp

version

VerQueryValueW
GetFileVersionInfoSizeW
GetFileVersionInfoW

shlwapi

ord487
SHCopyKeyW

rpcrt4

RpcRevertToSelfEx
RpcBindingToStringBindingW
RpcStringBindingParseW
RpcBindingFree
RpcStringBindingComposeW
RpcBindingFromStringBindingW
RpcStringFreeW
RpcBindingSetAuthInfoExW
NdrClientCall3
NdrServerCallAll
NdrServerCall2
I_RpcBindingIsClientLocal
RpcBindingServerFromClient
RpcBindingSetOption
RpcBindingInqAuthClientW
RpcServerUseProtseqEpW
RpcServerRegisterIfEx
RpcServerRegisterAuthInfoW
RpcServerUnregisterIf
RpcServerListen
RpcMgmtStopServerListening
RpcServerUnregisterIfEx
RpcImpersonateClient
RpcRevertToSelf
RpcMgmtWaitServerListen
I_RpcExceptionFilter

tapi32

lineClose
lineShutdown
lineNegotiateAPIVersion
lineHandoffW
lineDeallocateCall
lineGetLineDevStatus
lineOpenW
lineSetStatusMessages
lineInitializeExW
lineSetAppPriorityW
lineTranslateAddressW
lineGetCountryW
lineGetCallInfoW
lineGetDevCapsW

gdi32

SetWindowOrgEx
EndPage
DeleteEnhMetaFile
LPtoDP
SetWindowExtEx
StartPage
SetTextColor
DeleteDC
CreateFontIndirectW
GetDeviceCaps
GetEnhMetaFileHeader
CreateDCW
SetBkMode
DeleteObject
SelectObject
SelectClipRgn
CreateRectRgnIndirect
PlayEnhMetaFile
SetEnhMetaFileBits
SetMapMode
SaveDC
StartDocW
SetViewportExtEx
RestoreDC
EndDoc
EnableEUDC

winspool.drv

FindFirstPrinterChangeNotification
SetPrinterW
FindNextPrinterChangeNotification
GetPrinterW
EnumPrintersW
FindClosePrinterChangeNotification
DocumentPropertiesW
ClosePrinter
OpenPrinterW

user32

DrawTextW
SendMessageW
FindWindowW
LoadStringW

ole32

IIDFromString
CLSIDFromString
CoUninitialize
CoInitializeEx
CoTaskMemFree
CoCreateInstance
OleRun
StringFromIID
FreePropVariantArray
StgOpenStorageEx
StringFromGUID2

oleaut32

GetErrorInfo
SysFreeString
SysAllocStringByteLen
VariantClear
SysStringLen
SysAllocString
SysStringByteLen

shell32

SHSetLocalizedName
SHGetFolderPathW
SHGetFolderPathAndSubDirW

crypt32

CryptProtectData
CryptUnprotectData
CryptHashMessage

credui

CredUIParseUserNameW

fxstiff

TiffRecoverGoodPages
TiffAddMsTags
MergeTiffFiles
TiffClose
TiffOpen
TiffPostProcessFast
FXSTIFFInitialize
TiffExtractFirstPage
GetMsTagFileTime
GetMsTagDwordLong
GetMsTagString
MemoryMapTiffFile
MmrAddBranding

ntdll

RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
RtlValidRelativeSecurityDescriptor
WinSqmIncrementDWORD
RtlIpv4StringToAddressExW
RtlIpv6StringToAddressExW

Sections

.text
Size: 505KB - Virtual size: 504KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 96KB - Virtual size: 96KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 568KB - Virtual size: 572KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

82f8100005dad7bf0c33dc1d377c0d16

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

msvcrt

version

shlwapi

rpcrt4

tapi32

gdi32

winspool.drv

user32

ole32

oleaut32

shell32

crypt32

credui

fxstiff

ntdll

Sections

.text Size: 505KB - Virtual size: 504KB

.rdata Size: 96KB - Virtual size: 96KB

.data Size: 15KB - Virtual size: 17KB

.pdata Size: 13KB - Virtual size: 12KB

.didat Size: 512B - Virtual size: 16B

.rsrc Size: 3KB - Virtual size: 2KB

.reloc Size: 568KB - Virtual size: 572KB

.text
Size: 505KB - Virtual size: 504KB

.rdata
Size: 96KB - Virtual size: 96KB

.data
Size: 15KB - Virtual size: 17KB

.pdata
Size: 13KB - Virtual size: 12KB

.didat
Size: 512B - Virtual size: 16B

.rsrc
Size: 3KB - Virtual size: 2KB

.reloc
Size: 568KB - Virtual size: 572KB