c784c552a13eadfb32f62382ddc31e80N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

c784c552a13eadfb32f62382ddc31e80N.exe
Size

6.8MB
MD5

c784c552a13eadfb32f62382ddc31e80
SHA1

af28942d22274f34e0f5253ecc67c8ea2fc26b11
SHA256

e7cd9943c74fd0f8955d50744cf2d474a9fe8edf8c90923b71f2ad732cbb6fa5
SHA512

f08c51d0fce224a113108d42f44fbc815063f9b60c78320ce56b629f3286ee99d9f4b613f13305e3d7e636bd022644d513b252f47d24e388a5ea1eaeb5a3be89
SSDEEP

49152:kBTM4oMvwpFSYOBqK6mzWVSoSYjuGwid1ZRS43Yiybifdb61szj4DFVXFvefN8o+:g8jp1eUCHo2mc/ln1

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c784c552a13eadfb32f62382ddc31e80N.exe

Files

c784c552a13eadfb32f62382ddc31e80N.exe
.dll windows:6 windows x64 arch:x64

7dff6c12e491a4a7f757c498bef45678

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

c:\core-yapd\std\20230120_ver31690_release\src\driver\capsdb\capsdb\objfre_wlh_amd64\amd64\ricazzcd.pdb

Imports

msvcrt

_stat
strncpy
exit
toupper
_isnan
_fpclass
vfprintf
_vsnprintf
fprintf
realloc
fwrite
_iob
_snprintf
memmove
wcscpy_s
?terminate@@YAXXZ
??1type_info@@UEAA@XZ
_onexit
_lock
__dllonexit
_unlock
__C_specific_handler
_amsg_exit
_initterm
_XcptFilter
isalnum
isdigit
abort
islower
tolower
__crtGetStringTypeW
memcpy
__crtLCMapStringA
fflush
__pctype_func
__crtLCMapStringW
__uncaught_exception
setlocale
isspace
___lc_handle_func
___lc_codepage_func
___mb_cur_max_func
_errno
_callnewh
malloc
??0exception@@QEAA@AEBQEBDH@Z
__CxxFrameHandler3
_CxxThrowException
_ltow
iswdigit
iswascii
iswalpha
iswcntrl
_wtol
_wtoi
strcspn
??0bad_cast@@QEAA@AEBV0@@Z
??0bad_cast@@QEAA@PEBD@Z
??1bad_cast@@UEAA@XZ
localeconv
memchr
_strtoi64
_strtoui64
free
sprintf_s
getenv
??8type_info@@QEBAHAEBV0@@Z
?_set_se_translator@@YAP6AXIPEAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z
_resetstkoflw
_wtof
_purecall
??0exception@@QEAA@XZ
memcpy_s
_wfopen
_wstat
fopen
fread
_getcwd
fclose
sscanf
fseek
ftell
ferror
__mb_cur_max
??0exception@@QEAA@AEBV0@@Z
??0exception@@QEAA@AEBQEBD@Z
isupper
??1exception@@UEAA@XZ
?what@exception@@UEBAPEBDXZ
fmod
floor
log10
memcmp
pow
memmove_s
memset
ceil

kernel32

CloseHandle
GetFileTime
CreateFileW
CreateFileA
GetLastError
LoadLibraryW
GetUserDefaultUILanguage
GetCurrentThread
DeleteFileW
FindClose
ReadFile
GetVersionExW
GetLocaleInfoA
GetLocalTime
WideCharToMultiByte
MultiByteToWideChar
Sleep
InitializeCriticalSection
DeleteCriticalSection
EnterCriticalSection
LeaveCriticalSection
OutputDebugStringA
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
CopyFileW
WriteFile
CreateDirectoryW
SetFilePointer
FindFirstFileW
CreateMutexW
GetPrivateProfileStringW
OutputDebugStringW
GetLocaleInfoW
GetUserDefaultLCID
lstrlenA
GetProcAddress
LoadLibraryExW
FreeLibrary
TlsFree
TlsAlloc
ReleaseMutex
CreateMutexA
TlsSetValue
WaitForSingleObject
TlsGetValue
GetModuleFileNameW

advapi32

AddAce
RegQueryValueExW
RegQueryInfoKeyW
RegEnumValueW
RegOpenKeyExW
RevertToSelf
ImpersonateLoggedOnUser
LookupAccountSidW
GetTokenInformation
OpenThreadToken
OpenProcessToken
GetSecurityDescriptorDacl
GetLengthSid
FreeSid
IsValidSid
AllocateAndInitializeSid
InitializeAcl
SetSecurityDescriptorDacl
LookupAccountNameW
InitializeSecurityDescriptor
CopySid
RegCloseKey

user32

wsprintfW

winspool.drv

OpenPrinterW
GetPrinterDataW
XcvDataW
GetPrinterW
ClosePrinter

shell32

SHGetSpecialFolderPathW

shlwapi

PathIsDirectoryW

ole32

PropVariantClear
CoUninitialize
CoCreateInstance
CoInitializeEx

Exports

Exports

CDB_CreateObject
CDB_DoUpdateNow
CDB_GetAttributeNameList
CDB_GetDataItemList
CDB_GetDisplayString
CDB_GetExtendDLLFileNameList
CDB_GetFeatureNameList
CDB_GetItem
CDB_GetItemCurrentValue
CDB_GetItemStaticInfo
CDB_GetModelName
CDB_GetOptionNameList
CDB_ReleaseList
CDB_ReleaseObject
CDB_ReleaseStream
CDB_ResetItemCurrentValue
CDB_ResetMultiItemCurrentValue
CDB_SetItemCurrentValue
CDB_SetMultiItemCurrentValue
CDB_UpdateExtPSZ
CDB_UpdateSSD

Sections

.text
Size: 5.1MB - Virtual size: 5.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1.2MB - Virtual size: 1.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 470KB - Virtual size: 470KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 784B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 24KB - Virtual size: 24KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7dff6c12e491a4a7f757c498bef45678

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

kernel32

advapi32

user32

winspool.drv

shell32

shlwapi

ole32

Exports

Exports

Sections

.text Size: 5.1MB - Virtual size: 5.1MB

.data Size: 1.2MB - Virtual size: 1.2MB

.pdata Size: 470KB - Virtual size: 470KB

.rsrc Size: 1024B - Virtual size: 784B

.reloc Size: 24KB - Virtual size: 24KB

.text
Size: 5.1MB - Virtual size: 5.1MB

.data
Size: 1.2MB - Virtual size: 1.2MB

.pdata
Size: 470KB - Virtual size: 470KB

.rsrc
Size: 1024B - Virtual size: 784B

.reloc
Size: 24KB - Virtual size: 24KB