c7a994a8f3504e5fd11eee7cbe816340N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

c7a994a8f3504e5fd11eee7cbe816340N.exe
Size

17KB
MD5

c7a994a8f3504e5fd11eee7cbe816340
SHA1

61b9cd85e975716e7c0576eebc843d8ccabbfa65
SHA256

8d7c9c5630b51a95cfae7c1285ae55659b2e01c0e7b9aa0310814fb89648f0d1
SHA512

3e54ec4c0682c62f85cda0ba8c4768fc6d591ab63882459add557993c0678f532b34472042965c51bf9ddf264c5197004156f84e38e2b711c7ab7a4068f70ab8
SSDEEP

384:foVjw3VUztRe1xoDrdxlQIz87HMbg1+FJ9Pjd2S7EyFCrDmGfPAc5H/yw:GIUSezhz87HMO+FThdkP55fP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c7a994a8f3504e5fd11eee7cbe816340N.exe

Files

c7a994a8f3504e5fd11eee7cbe816340N.exe
.exe windows:6 windows x86 arch:x86

2bc8137b6786280ccc1ea5f2db794490

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Source\platform\trunk\dev\bin\HeroG\Bin\HGRNBuilderDiff.pdb

Imports

hgrnutil

NK_UT_GetMapHeader
NK_UT_GetBinFileHeader
?Open@CMemoryMappedFile@@UAEHPB_WPAXKKKKKKK@Z
NK_UT_SetMapFileVersion
NK_UT_ScriptCrypto
?Close@CMemoryMappedFile@@UAEXXZ
NK_UT_SetBinFileVersion
NK_UT_GetCRC
??1CNKMMF@@UAE@XZ
NK_UT_MakeInternalBinFileHeader
??0CNKMMF@@QAE@XZ

hgrnenvmgr

?fnNKEnvMgr@@YAPAVCNKEnvMgr@@XZ
?GetRuntimePath@CNKEnvMgr@@QAE?AV?$CStringT@_WV?$StrTraitMFC_DLL@_WV?$ChTraitsCRT@_W@ATL@@@@@ATL@@PA_WH@Z
?ReleaseInstance@CNKEnvMgr@@SAXXZ

mfc140u

ord8756
ord8712
ord12884
ord4664
ord1046
ord316
ord5111
ord5921
ord285
ord3009
ord1045
ord1525
ord8360
ord1526
ord1523
ord5109
ord296
ord995
ord1472
ord321
ord2396
ord498
ord1142
ord5886
ord4815
ord2304
ord265
ord2885
ord266
ord2408
ord1513

kernel32

OutputDebugStringW
TerminateProcess
GetCurrentProcess
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
CreateEventW
CloseHandle
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
GetLastError
GetModuleHandleW
GetCommandLineW
GetProcAddress
GetCurrentDirectoryW
SetCurrentDirectoryW
InitializeCriticalSectionEx

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey

shell32

ShellExecuteExW

vcruntime140

__CxxFrameHandler3
memcpy
_except_handler4_common
__current_exception
memset
__std_terminate
__current_exception_context

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode
_wfopen_s
fwrite
fclose
__stdio_common_vfwprintf
__acrt_iob_func

api-ms-win-crt-runtime-l1-1-0

_crt_atexit
_register_onexit_function
_initialize_onexit_table
__p___argc
_controlfp_s
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
terminate
_exit
exit
_initterm_e
_initterm
_get_wide_winmain_command_line
_initialize_wide_environment
_configure_wide_argv
__p___argv
_set_app_type
_seh_filter_exe

api-ms-win-crt-heap-l1-1-0

_set_new_mode
free

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 648B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 948B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2bc8137b6786280ccc1ea5f2db794490

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

hgrnutil

hgrnenvmgr

mfc140u

kernel32

advapi32

shell32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 7KB - Virtual size: 7KB

.rdata Size: 6KB - Virtual size: 6KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 1024B - Virtual size: 648B

.reloc Size: 1024B - Virtual size: 948B

.text
Size: 7KB - Virtual size: 7KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 1024B - Virtual size: 648B

.reloc
Size: 1024B - Virtual size: 948B