4273526b35f9ea94c433a68ea08f3c90N[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

4273526b35f9ea94c433a68ea08f3c90N.exe
Size

1.7MB
MD5

4273526b35f9ea94c433a68ea08f3c90
SHA1

da30ac5c2d1e66ea4bb7ab1124797d60f521f22c
SHA256

04b24bf46d926afcee574593c069360812e77fbc32efd0cdab14658fe7b33c31
SHA512

6caf56e2634e6e78add55b86f03ed9a179d263485394543b003b5ff3e0711625555652d44af09804780db9f17dc4487c77b1bb582970a789dd5ae94bcd669c04
SSDEEP

49152:YZ6zY8/7WDaDvfd5iQ8zoBTdoj9kQ/qoLEw:xzY8zWDaDHiQ8QTdojdqo4w

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4273526b35f9ea94c433a68ea08f3c90N.exe

Files

4273526b35f9ea94c433a68ea08f3c90N.exe
.exe windows:6 windows x64 arch:x64

585c0d2a2ed83e36ad594176df80a326

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\jenkins\workspace\CR-CLIENT-12.0.0\CR-MetaBuild-Win\cr-win-client\dist\msvs_win32\Release\x64\sym\CRWindowsClientService\CRProcessMonitor\Adobe Crash Processor.pdb

Imports

kernel32

HeapAlloc
HeapDestroy
DeleteCriticalSection
GetProcessHeap
WideCharToMultiByte
SizeofResource
LockResource
FindResourceExW
LoadResource
FindResourceW
MultiByteToWideChar
FindFirstFileW
FindNextFileW
HeapReAlloc
FindClose
CreateFileW
GetVersionExW
GetFileAttributesExW
DeleteFileW
LoadLibraryW
GetProcAddress
FreeLibrary
CloseHandle
K32GetModuleBaseNameW
GetLastError
Sleep
HeapSize
OpenProcess
WaitForSingleObject
InitializeCriticalSectionEx
CreateMutexW
GetCommandLineW
GetDiskFreeSpaceW
HeapFree
InitializeSListHead
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
FlushFileBuffers
GetTickCount
QueryPerformanceCounter
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
GetSystemTimeAsFileTime
SystemTimeToFileTime
GetCurrentProcessId
GetFileSize
LockFileEx
LocalFree
UnlockFile
HeapCompact
GetSystemInfo
DeleteFileA
WaitForSingleObjectEx
LoadLibraryA
CreateFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesA
GetDiskFreeSpaceA
FormatMessageW
GetTempPathA
HeapValidate
UnmapViewOfFile
GetFileAttributesW
GetTempPathW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
WriteFile
GetFullPathNameW
HeapCreate
ReadFile
AreFileApisANSI
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
GetCurrentThreadId
GetModuleHandleW
IsDebuggerPresent
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
GetCurrentProcess

shell32

SHCreateDirectoryExW
CommandLineToArgvW
SHGetKnownFolderPath

shlwapi

PathFileExistsW
PathIsDirectoryW
PathAppendW

wininet

InternetOpenW
HttpOpenRequestW
InternetConnectW
InternetCloseHandle
HttpSendRequestW
HttpQueryInfoW

msvcp140

?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
_Xtime_get_ticks
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
_Mtx_unlock
_Mtx_init_in_situ
_Mtx_lock
_Mtx_destroy_in_situ
?_Throw_C_error@std@@YAXH@Z
?_Xbad_alloc@std@@YAXXZ
_Thrd_join
_Thrd_id
_Cnd_do_broadcast_at_thread_exit
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Throw_Cpp_error@std@@YAXH@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException
memchr
memcmp
strrchr
__std_terminate
__std_exception_copy
__current_exception
__std_exception_destroy
memset
memmove
__current_exception_context
__C_specific_handler
memcpy

api-ms-win-crt-runtime-l1-1-0

_set_app_type
_configure_wide_argv
_initialize_wide_environment
_get_wide_winmain_command_line
_initterm
_initterm_e
exit
_exit
_seh_filter_exe
_c_exit
_register_thread_local_exe_atexit_callback
_beginthreadex
terminate
_errno
_cexit
_invalid_parameter_noinfo_noreturn
_endthreadex
_initialize_onexit_table
_invalid_parameter_noinfo
_crt_atexit
_register_onexit_function

api-ms-win-crt-convert-l1-1-0

strtoul
atoi

api-ms-win-crt-heap-l1-1-0

calloc
realloc
free
_set_new_mode
malloc
_callnewh
_msize
_recalloc

api-ms-win-crt-string-l1-1-0

wcsnlen
strcspn
strncmp
strcmp
wmemcpy_s

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s
__stdio_common_vswprintf
__p__commode
_set_fmode
__stdio_common_vswprintf_s

api-ms-win-crt-time-l1-1-0

strftime
_localtime64_s
_gmtime64_s

api-ms-win-crt-math-l1-1-0

__setusermatherr
ceilf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

ole32

CoTaskMemFree

Sections

.text
Size: 936KB - Virtual size: 936KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 130KB - Virtual size: 129KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 38KB - Virtual size: 37KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 568KB - Virtual size: 572KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

585c0d2a2ed83e36ad594176df80a326

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

shell32

shlwapi

wininet

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

ole32

Sections

.text Size: 936KB - Virtual size: 936KB

.rdata Size: 130KB - Virtual size: 129KB

.data Size: 14KB - Virtual size: 17KB

.pdata Size: 38KB - Virtual size: 37KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 568KB - Virtual size: 572KB

.text
Size: 936KB - Virtual size: 936KB

.rdata
Size: 130KB - Virtual size: 129KB

.data
Size: 14KB - Virtual size: 17KB

.pdata
Size: 38KB - Virtual size: 37KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 568KB - Virtual size: 572KB