Godaddy-Auctions-windows-x86_64[.]zip

Sharing

Copy URL Twitter E-mail

General

Target

Godaddy-Auctions-windows-x86_64.zip
Size

1.3MB
MD5

473509671a5deebc3b7e7d8c3531301e
SHA1

92681007e8f002125945677b80c05a05f0795b04
SHA256

e54ca74fdca4bb1e94c7995e8a10e73c051dd704ff247bdcff6f2160ef34ed3f
SHA512

b1c2c6512001eb4c811d8ad9a2761ca02182113b9fa19bb7a1ec692026f484a23fea0337c93e46cbc07b15469b234aa89aac5e5f095900e01668ca975c5d8cb4
SSDEEP

24576:4GrHJa3Ovr5mZrZxAhnSue+qfy15RG+bBJFFF5pI3bEoqxN:4GLJakmui+H7E+bB1pIIxxN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/Godaddy-Auctions.exe

Files

Godaddy-Auctions-windows-x86_64.zip
.zip
Godaddy-Auctions.exe
.exe windows:6 windows x64 arch:x64

2d3f9ab5ad7f8bd8955bd0e5adb27232

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

Godaddy_Auctions.pdb

Imports

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressAll
WaitOnAddress
WakeByAddressSingle

kernel32

CreateIoCompletionPort
GetQueuedCompletionStatusEx
GetLastError
PostQueuedCompletionStatus
HeapFree
HeapAlloc
GetProcessHeap
SetFileCompletionNotificationModes
GetCurrentThreadId
FormatMessageW
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCurrentThread
SwitchToThread
WaitForSingleObject
QueryPerformanceCounter
GetSystemInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetLastError
GetCurrentDirectoryW
GetEnvironmentVariableW
IsProcessorFeaturePresent
SetHandleInformation
SetFileInformationByHandle
GetCurrentProcess
GetStdHandle
GetCurrentProcessId
QueryPerformanceFrequency
GetSystemTimePreciseAsFileTime
GetSystemTimeAsFileTime
HeapReAlloc
lstrlenW
ReleaseMutex
CreateFileW
GetFinalPathNameByHandleW
InitializeSListHead
IsDebuggerPresent
GetConsoleMode
UnhandledExceptionFilter
GetModuleHandleW
MultiByteToWideChar
WriteConsoleW
WideCharToMultiByte
CreateThread
GetFullPathNameW
GetModuleHandleA
GetProcAddress
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
SetUnhandledExceptionFilter
CloseHandle

secur32

DecryptMessage
FreeContextBuffer
InitializeSecurityContextW
AcceptSecurityContext
AcquireCredentialsHandleA
ApplyControlToken
EncryptMessage
DeleteSecurityContext
QueryContextAttributesW
FreeCredentialsHandle

ws2_32

send
shutdown
getsockopt
ioctlsocket
connect
bind
WSASocketW
getsockname
getpeername
setsockopt
WSAIoctl
WSAGetLastError
WSAStartup
WSACleanup
freeaddrinfo
getaddrinfo
closesocket
WSASend
recv

crypt32

CertFreeCertificateChain
CertDuplicateCertificateChain
CertGetCertificateChain
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertOpenStore
CertCloseStore
CertVerifyCertificateChainPolicy
CertDuplicateStore
CertDuplicateCertificateContext
CertFreeCertificateContext

advapi32

RegOpenKeyExW
RegQueryValueExW
RegCloseKey

ntdll

NtCancelIoFileEx
NtDeviceIoControlFile
RtlNtStatusToDosError
NtCreateFile
NtWriteFile

vcruntime140

__current_exception
__C_specific_handler
_CxxThrowException
memcmp
memset
__CxxFrameHandler3
memcpy
memmove
__current_exception_context

api-ms-win-crt-math-l1-1-0

round
__setusermatherr
pow
log

api-ms-win-crt-runtime-l1-1-0

_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
exit
_exit
_set_app_type
__p___argc
__p___argv
_cexit
_seh_filter_exe
_register_thread_local_exe_atexit_callback
_initterm_e
_initterm
_c_exit
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode

Sections

.text
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 97KB - Virtual size: 97KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2d3f9ab5ad7f8bd8955bd0e5adb27232

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

bcryptprimitives

api-ms-win-core-synch-l1-2-0

kernel32

secur32

ws2_32

crypt32

advapi32

ntdll

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 1.8MB - Virtual size: 1.8MB

.rdata Size: 1.1MB - Virtual size: 1.1MB

.data Size: 9KB - Virtual size: 9KB

.pdata Size: 97KB - Virtual size: 97KB

.reloc Size: 17KB - Virtual size: 16KB

.text
Size: 1.8MB - Virtual size: 1.8MB

.rdata
Size: 1.1MB - Virtual size: 1.1MB

.data
Size: 9KB - Virtual size: 9KB

.pdata
Size: 97KB - Virtual size: 97KB

.reloc
Size: 17KB - Virtual size: 16KB