d2cec33d5d1b4e33f899511c1b0547af1c311dddb36d3dfaa9658774c1ea47a9

Sharing

Copy URL Twitter E-mail

General

Target

d2cec33d5d1b4e33f899511c1b0547af1c311dddb36d3dfaa9658774c1ea47a9
Size

280KB
MD5

61ca9f3108749bfe3d2bf73f16e5fd66
SHA1

7374c8bfc48856ea93ee7aeed92bcf5bde4d4aaa
SHA256

d2cec33d5d1b4e33f899511c1b0547af1c311dddb36d3dfaa9658774c1ea47a9
SHA512

73ec09e135c44357a4cbead6eb3784698a01b84f6be3f6e990c50ed44b126811d3d8a5f79814836602733eda5b5f491f86545e23d9cc961abd25ab569058b51d
SSDEEP

6144:lBgd1Z5swoX60M0nt+c83lY+pxGeUVl9VVrKD6vHt4gG0:lBW1Z5s7X6St+aeUVl9V1Y6/60

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d2cec33d5d1b4e33f899511c1b0547af1c311dddb36d3dfaa9658774c1ea47a9

Files

d2cec33d5d1b4e33f899511c1b0547af1c311dddb36d3dfaa9658774c1ea47a9
.exe windows:6 windows x64 arch:x64

39af2ae8ef860406705ad0d0e90a48a0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

Zngziyi.pdb

Imports

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle
WakeByAddressAll
WaitOnAddress

advapi32

GetTokenInformation
CopySid
OpenProcessToken
IsValidSid
GetLengthSid

kernel32

RtlVirtualUnwind
OpenProcess
ReleaseMutex
GetSystemTimes
GetProcessIoCounters
InitializeSListHead
GetSystemTimeAsFileTime
ReadProcessMemory
GetCurrentThreadId
LocalFree
VirtualQueryEx
QueryPerformanceCounter
CreateMutexA
IsProcessorFeaturePresent
GetCurrentProcessId
GetCurrentProcess
GlobalMemoryStatusEx
K32GetPerformanceInfo
LoadLibraryA
WaitForSingleObjectEx
RtlLookupFunctionEntry
GetSystemTimePreciseAsFileTime
RtlCaptureContext
GetCurrentDirectoryW
GetProcessHeap
HeapAlloc
ExitProcess
UnhandledExceptionFilter
GetEnvironmentVariableW
lstrlenW
FormatMessageW
GetModuleHandleW
GetProcAddress
GetModuleHandleA
WriteConsoleW
MultiByteToWideChar
SetUnhandledExceptionFilter
WaitForSingleObject
GetConsoleMode
GetStdHandle
CreateThread
GetSystemInfo
SwitchToThread
HeapReAlloc
HeapFree
GetCurrentThread
SetThreadStackGuarantee
AddVectoredExceptionHandler
CloseHandle
VirtualAlloc
SetFilePointerEx
GetFileInformationByHandleEx
GetFileInformationByHandle
CreateFileW
GetLastError
GetFullPathNameW
SetLastError
IsDebuggerPresent
WideCharToMultiByte
GetProcessTimes

ntdll

RtlNtStatusToDosError
NtReadFile
NtQueryInformationProcess
RtlGetVersion
NtWriteFile
NtQuerySystemInformation

psapi

GetModuleFileNameExW

shell32

CommandLineToArgvW

pdh

PdhOpenQueryA
PdhCollectQueryData
PdhAddEnglishCounterW
PdhGetFormattedCounterValue
PdhRemoveCounter
PdhCloseQuery

powrprof

CallNtPowerInformation

oleaut32

GetErrorInfo

vcruntime140

_CxxThrowException
__C_specific_handler
__current_exception
__current_exception_context
memcmp
__CxxFrameHandler3
memcpy
memset
memmove

api-ms-win-crt-string-l1-1-0

wcslen

api-ms-win-crt-runtime-l1-1-0

_set_app_type
_initterm
_initterm_e
exit
_exit
_get_initial_narrow_environment
_initialize_narrow_environment
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_configure_narrow_argv
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
_seh_filter_exe

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode
free

Sections

.text
Size: 193KB - Virtual size: 193KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 73KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 824B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

39af2ae8ef860406705ad0d0e90a48a0

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

bcryptprimitives

api-ms-win-core-synch-l1-2-0

advapi32

kernel32

ntdll

psapi

shell32

pdh

powrprof

oleaut32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 193KB - Virtual size: 193KB

.rdata Size: 73KB - Virtual size: 72KB

.data Size: 512B - Virtual size: 824B

.pdata Size: 10KB - Virtual size: 10KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 193KB - Virtual size: 193KB

.rdata
Size: 73KB - Virtual size: 72KB

.data
Size: 512B - Virtual size: 824B

.pdata
Size: 10KB - Virtual size: 10KB

.reloc
Size: 1KB - Virtual size: 1KB