2f579846dd4815c9a62e66ae2a847430N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

2f579846dd4815c9a62e66ae2a847430N.exe
Size

3.1MB
MD5

2f579846dd4815c9a62e66ae2a847430
SHA1

38afcdbf4b9f640844a4dd9be7bd4ef1bc002f90
SHA256

5597ef0e34b1c77e52bab4613b644a5ebd4effec29d9702182f1f0c7586cf812
SHA512

2007d31b8e768bf228d255afacaacd858308399228e22068008e2a091d8649dfd5b253972f6388a98d4a7d829259cad0007e3d4fa054e6c36f5d04500abaa327
SSDEEP

49152:Okb3E9IQaDDO0extt35Y8HwAX8NgGj6JZkgXbQz0hHkNxnbTz4CsFSbx:hIKqpAf4CsU

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2f579846dd4815c9a62e66ae2a847430N.exe

Files

2f579846dd4815c9a62e66ae2a847430N.exe
.exe windows:6 windows x64 arch:x64

7cf0331ee430b1fc9396833a879cd571

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

crt2.pdb

Imports

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress
WakeByAddressAll
WakeByAddressSingle

ntdll

RtlVirtualUnwind
NtQuerySystemInformation
NtCancelIoFileEx
RtlCaptureContext
RtlLookupFunctionEntry
NtQueryInformationProcess
RtlGetVersion
NtCreateFile
NtWriteFile
NtDeviceIoControlFile
RtlNtStatusToDosError

kernel32

CreateRemoteThread
PostQueuedCompletionStatus
SetFileCompletionNotificationModes
GetLastError
VirtualProtectEx
WriteProcessMemory
GetProcessHeap
HeapAlloc
HeapFree
VirtualAllocEx
GetProcessTimes
CreateIoCompletionPort
GetProcessIoCounters
OpenProcess
VirtualQueryEx
ReadProcessMemory
CloseHandle
GetCurrentThreadId
GetQueuedCompletionStatusEx
GetSystemTimeAsFileTime
CreateMutexA
WaitForSingleObjectEx
GetModuleHandleA
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcessId
GetSystemInfo
CreateThread
WriteConsoleW
MultiByteToWideChar
GetTickCount64
GlobalMemoryStatusEx
GetLogicalDrives
GetDiskFreeSpaceExW
IsProcessorFeaturePresent
GetDriveTypeW
GetVolumeInformationW
CreateFileW
DeviceIoControl
SetHandleInformation
LocalFree
GetSystemTimes
LoadLibraryA
GetProcAddress
FreeLibrary
GetModuleHandleW
WaitForSingleObject
FormatMessageW
GetConsoleMode
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCurrentThread
SwitchToThread
QueryPerformanceCounter
SetLastError
GetCurrentDirectoryW
GetEnvironmentVariableW
GetCurrentProcess
GetFinalPathNameByHandleW
GetStdHandle
QueryPerformanceFrequency
GetSystemTimePreciseAsFileTime
HeapReAlloc
lstrlenW
ReleaseMutex

user32

EnableMouseInPointer

advapi32

CopySid
LookupAccountSidW
IsValidSid
RegCloseKey
GetTokenInformation
OpenProcessToken
GetLengthSid
RegQueryValueExW
RegOpenKeyExW

ws2_32

ioctlsocket
connect
bind
recv
getsockname
WSASend
setsockopt
WSAIoctl
closesocket
getpeername
getsockopt
send
WSAGetLastError
WSAStartup
WSACleanup
shutdown
freeaddrinfo
WSASocketW
getaddrinfo

secur32

LsaEnumerateLogonSessions
DeleteSecurityContext
LsaGetLogonSessionData
LsaFreeReturnBuffer
ApplyControlToken
EncryptMessage
AcceptSecurityContext
InitializeSecurityContextW
FreeContextBuffer
DecryptMessage
AcquireCredentialsHandleA
FreeCredentialsHandle
QueryContextAttributesW

crypt32

CertDuplicateCertificateChain
CertVerifyCertificateChainPolicy
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertOpenStore
CertCloseStore
CertFreeCertificateChain
CertDuplicateStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateChain

psapi

GetPerformanceInfo
GetModuleFileNameExW

shell32

CommandLineToArgvW

ole32

CoCreateInstance
CoInitializeEx
CoUninitialize
CoInitializeSecurity
CoSetProxyBlanket

oleaut32

SysAllocString
GetErrorInfo
SysFreeString
VariantClear
SysStringLen

pdh

PdhCloseQuery
PdhRemoveCounter
PdhCollectQueryData
PdhGetFormattedCounterValue
PdhOpenQueryA
PdhAddEnglishCounterW

powrprof

CallNtPowerInformation

netapi32

NetUserGetInfo
NetUserGetLocalGroups
NetApiBufferFree
NetUserEnum

iphlpapi

GetIfEntry2
FreeMibTable
GetIfTable2
GetAdaptersAddresses

vcruntime140

memset
memmove
memcmp
__C_specific_handler
memcpy
__current_exception
__CxxFrameHandler3
__current_exception_context
_CxxThrowException

api-ms-win-crt-string-l1-1-0

wcslen

api-ms-win-crt-math-l1-1-0

pow
__setusermatherr

api-ms-win-crt-heap-l1-1-0

free
realloc
_set_new_mode

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback
terminate
_initialize_onexit_table
_register_onexit_function
_crt_atexit
_seh_filter_exe
_set_app_type
_c_exit
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_exit
_cexit
__p___argc
__p___argv
_configure_narrow_argv

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 1.9MB - Virtual size: 1.9MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 114KB - Virtual size: 113KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 520B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 19KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7cf0331ee430b1fc9396833a879cd571

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

bcryptprimitives

api-ms-win-core-synch-l1-2-0

ntdll

kernel32

user32

advapi32

ws2_32

secur32

crypt32

psapi

shell32

ole32

oleaut32

pdh

powrprof

netapi32

iphlpapi

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 1.9MB - Virtual size: 1.9MB

.rdata Size: 1.1MB - Virtual size: 1.1MB

.data Size: 12KB - Virtual size: 12KB

.pdata Size: 114KB - Virtual size: 113KB

.rsrc Size: 1024B - Virtual size: 520B

.reloc Size: 19KB - Virtual size: 18KB

.text
Size: 1.9MB - Virtual size: 1.9MB

.rdata
Size: 1.1MB - Virtual size: 1.1MB

.data
Size: 12KB - Virtual size: 12KB

.pdata
Size: 114KB - Virtual size: 113KB

.rsrc
Size: 1024B - Virtual size: 520B

.reloc
Size: 19KB - Virtual size: 18KB