fbe900e580e2a7eca0d3b562fbc04a60N

Sharing

Copy URL Twitter E-mail

General

Target

fbe900e580e2a7eca0d3b562fbc04a60N
Size

1.0MB
MD5

fbe900e580e2a7eca0d3b562fbc04a60
SHA1

7e14793aeb6bf6ae16abebc25c885025a056d4ff
SHA256

9e6557b2fd3023f367f99f1115cadc2d976e3e15eac518013e3ad86145d2f15a
SHA512

b2e3dc5ba8bec9a9a74638418a82057a0bb13fda90f4be0455d3d56f9caa917f9ba02270bdec7140f918ef799904051c182674af4297c76e14bfa1728f33f8bb
SSDEEP

12288:bpbNiKznNm/2FR4fIxAFYNgTjEtrMFpK2/2fSpQnJ19OqLkmZO:bJNiKznvFyfIxAFBEMw6y19OqL7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fbe900e580e2a7eca0d3b562fbc04a60N

Files

fbe900e580e2a7eca0d3b562fbc04a60N
.dll windows:4 windows x64 arch:x64

0a97406f33cf9b526246084d56afe718

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

AddVectoredExceptionHandler
CloseHandle
CreateEventA
CreateSemaphoreA
DeleteCriticalSection
DuplicateHandle
EnterCriticalSection
FormatMessageA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetHandleInformation
GetLastError
GetProcessAffinityMask
GetSystemTimeAsFileTime
GetThreadContext
GetThreadPriority
GetTickCount64
InitializeCriticalSection
IsDebuggerPresent
LeaveCriticalSection
LocalFree
MultiByteToWideChar
OpenProcess
OutputDebugStringA
RaiseException
ReleaseSemaphore
RemoveVectoredExceptionHandler
ResetEvent
ResumeThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlUnwindEx
RtlVirtualUnwind
SetEvent
SetLastError
SetProcessAffinityMask
SetThreadContext
SetThreadPriority
Sleep
SuspendThread
TlsAlloc
TlsGetValue
TlsSetValue
TryEnterCriticalSection
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WideCharToMultiByte
__C_specific_handler

api-ms-win-crt-convert-l1-1-0

_ultoa
mbrtowc
wcrtomb

api-ms-win-crt-environment-l1-1-0

__p__environ
__p__wenviron

api-ms-win-crt-filesystem-l1-1-0

_fstat64

api-ms-win-crt-heap-l1-1-0

_set_new_mode
calloc
free
malloc
realloc

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func
___mb_cur_max_func
localeconv
setlocale

api-ms-win-crt-math-l1-1-0

_fdopen

api-ms-win-crt-private-l1-1-0

__intrinsic_setjmpex
longjmp
memchr
memcmp
memcpy
memmove

api-ms-win-crt-runtime-l1-1-0

__p___argc
__p___argv
__p___wargv
_beginthreadex
_configure_narrow_argv
_configure_wide_argv
_crt_at_quick_exit
_crt_atexit
_endthreadex
_errno
_execute_onexit_table
_initialize_narrow_environment
_initialize_onexit_table
_initialize_wide_environment
_initterm
_register_onexit_function
abort
exit
signal
strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__stdio_common_vfprintf
__stdio_common_vfwprintf
__stdio_common_vsprintf
_fseeki64
_ftelli64
_lseeki64
_wfopen
fclose
fflush
fopen
fputc
fputs
fread
fwrite
getc
getwc
putc
putwc
setvbuf
ungetc
ungetwc
_write
_read
_fileno

api-ms-win-crt-string-l1-1-0

iswctype
memset
strcmp
strcoll
strlen
strncmp
strxfrm
towlower
towupper
wcscoll
wcslen
wcsxfrm
_strdup

api-ms-win-crt-time-l1-1-0

__daylight
__timezone
__tzname
_tzset
strftime
wcsftime

api-ms-win-crt-utility-l1-1-0

rand_s

r

CAR
CDR
INTEGER
REprintf
R_BaseEnv
R_ClassSymbol
R_ContinueUnwind
R_FlushConsole
R_GetCCallable
R_GlobalEnv
R_MakeUnwindCont
R_NamesSymbol
R_NilValue
R_PreserveObject
R_ReleaseObject
R_UnwindProtect
R_registerRoutines
R_useDynamicSymbols
Rf_ScalarInteger
Rf_allocVector
Rf_coerceVector
Rf_error
Rf_eval
Rf_findFun
Rf_inherits
Rf_install
Rf_isEnvironment
Rf_isFunction
Rf_lang1
Rf_lang2
Rf_length
Rf_mkChar
Rf_mkString
Rf_nthcdr
Rf_onintr
Rf_protect
Rf_setAttrib
Rf_type2char
Rf_unprotect
Rf_warning
Rf_xlength
Rprintf
SETCADR
SET_STRING_ELT
SET_VECTOR_ELT
TYPEOF
VECTOR_ELT

Exports

Exports

R_init_plyr
_Z13split_indicesN4Rcpp6VectorILi13ENS_15PreserveStorageEEEi
_Z14make_conditionRKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEP7SEXPRECS8_S8_
_Z19string_to_try_errorRKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEE
_Z31exception_to_condition_templateIN4Rcpp9exceptionEEP7SEXPRECRKT_b
_Z31exception_to_condition_templateISt9exceptionEP7SEXPRECRKT_b
_ZGVZ20rcpp_get_stack_tracevE3fun
_ZGVZ20rcpp_set_stack_traceP7SEXPRECE3fun
_ZGVZ8demangleRKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEE3funB5cxx11
_ZGVZN4Rcpp20Rcpp_precious_removeEP7SEXPRECE3fun
_ZGVZN4Rcpp22Rcpp_precious_preserveEP7SEXPRECE3fun
_ZGVZN4Rcpp8internal12exitRNGScopeEvE3fun
_ZGVZN4Rcpp8internal13enterRNGScopeEvE3fun
_ZN10tinyformat6detail10formatImplERSoPKcPKNS0_9FormatArgEi
_ZN10tinyformat6detail15formatTruncatedIiEEvRSoRKT_i
_ZN10tinyformat6detail15formatTruncatedIxEEvRSoRKT_i
_ZN10tinyformat6detail21streamStateFromFormatERSoRbRiPKcPKNS0_9FormatArgES3_i
_ZN10tinyformat6detail9FormatArg10formatImplIPKcEEvRSoS4_S4_iPKv
_ZN10tinyformat6detail9FormatArg10formatImplIiEEvRSoPKcS5_iPKv
_ZN10tinyformat6detail9FormatArg10formatImplIxEEvRSoPKcS5_iPKv
_ZN10tinyformat6detail9FormatArg9toIntImplIPKcEEiPKv
_ZN10tinyformat6detail9FormatArg9toIntImplIiEEiPKv
_ZN10tinyformat6detail9FormatArg9toIntImplIxEEiPKv
_ZN10tinyformat6formatIJEEENSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEPKcDpRKT_
_ZN10tinyformat6formatIJPKcS2_EEENSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEES2_DpRKT_
_ZN10tinyformat6formatIJiEEENSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEPKcDpRKT_
_ZN10tinyformat6formatIJxxEEENSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEPKcDpRKT_
_ZN4Rcpp10RstreambufILb0EE4syncEv
_ZN4Rcpp10RstreambufILb0EE6xsputnEPKcx
_ZN4Rcpp10RstreambufILb0EE8overflowEi
_ZN4Rcpp10RstreambufILb0EED0Ev
_ZN4Rcpp10RstreambufILb0EED1Ev
_ZN4Rcpp10RstreambufILb1EE4syncEv
_ZN4Rcpp10RstreambufILb1EE6xsputnEPKcx
_ZN4Rcpp10RstreambufILb1EE8overflowEi
_ZN4Rcpp10RstreambufILb1EED0Ev
_ZN4Rcpp10RstreambufILb1EED1Ev
_ZN4Rcpp13unwindProtectEPFP7SEXPRECPvES2_
_ZN4Rcpp14not_compatibleD0Ev
_ZN4Rcpp14not_compatibleD1Ev
_ZN4Rcpp20Rcpp_precious_removeEP7SEXPREC
_ZN4Rcpp4stopERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEE
_ZN4Rcpp4stopIJEEEvPKcDpOT_
_ZN4Rcpp6ShieldIP7SEXPRECED1Ev
_ZN4Rcpp8RostreamILb0EED0Ev
_ZN4Rcpp8RostreamILb0EED1Ev
_ZN4Rcpp8RostreamILb1EED0Ev
_ZN4Rcpp8RostreamILb1EED1Ev
_ZN4Rcpp8internal10basic_castILi13EEEP7SEXPRECS3_
_ZN4Rcpp8internal12primitive_asIiEET_P7SEXPREC
_ZN4Rcpp8internal17is_Rcpp_eval_callEP7SEXPREC
_ZN4Rcpp8internal19Rcpp_protected_evalEPv
_ZN4Rcpp8internal3nthEP7SEXPRECi
_ZN4Rcpp8internal9maybeJumpEPv8Rboolean
_ZN4Rcpp9exceptionC1EPKcb
_ZN4Rcpp9exceptionD0Ev
_ZN4Rcpp9exceptionD1Ev
_ZNK4Rcpp14not_compatible4whatEv
_ZNK4Rcpp9exception21copy_stack_trace_to_rEv
_ZNK4Rcpp9exception4whatEv
_ZNKSt5ctypeIcE8do_widenEc
_ZNSt6vectorIS_IiSaIiEESaIS1_EE17_M_default_appendEy
_ZNSt6vectorIiSaIiEE17_M_realloc_insertIJiEEEvN9__gnu_cxx17__normal_iteratorIPiS1_EEDpOT_
_ZNSt7__cxx1115basic_stringbufIcSt11char_traitsIcESaIcEED1Ev
_ZTCN4Rcpp8RostreamILb0EEE0_So
_ZTCN4Rcpp8RostreamILb1EEE0_So
_ZTIN4Rcpp10RstreambufILb0EEE
_ZTIN4Rcpp10RstreambufILb1EEE
_ZTIN4Rcpp14not_compatibleE
_ZTIN4Rcpp17LongjumpExceptionE
_ZTIN4Rcpp8RostreamILb0EEE
_ZTIN4Rcpp8RostreamILb1EEE
_ZTIN4Rcpp8internal20InterruptedExceptionE
_ZTIN4Rcpp9exceptionE
_ZTISt9exception
_ZTSN4Rcpp10RstreambufILb0EEE
_ZTSN4Rcpp10RstreambufILb1EEE
_ZTSN4Rcpp14not_compatibleE
_ZTSN4Rcpp17LongjumpExceptionE
_ZTSN4Rcpp8RostreamILb0EEE
_ZTSN4Rcpp8RostreamILb1EEE
_ZTSN4Rcpp8internal20InterruptedExceptionE
_ZTSN4Rcpp9exceptionE
_ZTSSt9exception
_ZTTN4Rcpp8RostreamILb0EEE
_ZTTN4Rcpp8RostreamILb1EEE
_ZTVN4Rcpp10RstreambufILb0EEE
_ZTVN4Rcpp10RstreambufILb1EEE
_ZTVN4Rcpp14not_compatibleE
_ZTVN4Rcpp8RostreamILb0EEE
_ZTVN4Rcpp8RostreamILb1EEE
_ZTVN4Rcpp9exceptionE
_ZTv0_n24_N4Rcpp8RostreamILb0EED0Ev
_ZTv0_n24_N4Rcpp8RostreamILb0EED1Ev
_ZTv0_n24_N4Rcpp8RostreamILb1EED0Ev
_ZTv0_n24_N4Rcpp8RostreamILb1EED1Ev
_ZZ20rcpp_get_stack_tracevE3fun
_ZZ20rcpp_set_stack_traceP7SEXPRECE3fun
_ZZ8demangleRKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEE3funB5cxx11
_ZZN4Rcpp20Rcpp_precious_removeEP7SEXPRECE3fun
_ZZN4Rcpp22Rcpp_precious_preserveEP7SEXPRECE3fun
_ZZN4Rcpp8internal12exitRNGScopeEvE3fun
_ZZN4Rcpp8internal13enterRNGScopeEvE3fun
_plyr_split_indices
loop_apply_

Sections

.text
Size: 808KB - Virtual size: 807KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 73KB - Virtual size: 73KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 47KB - Virtual size: 47KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 68KB - Virtual size: 67KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 4KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 96B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0a97406f33cf9b526246084d56afe718

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

r

Exports

Exports

Sections

.text Size: 808KB - Virtual size: 807KB

.data Size: 12KB - Virtual size: 12KB

.rdata Size: 73KB - Virtual size: 73KB

.pdata Size: 47KB - Virtual size: 47KB

.xdata Size: 68KB - Virtual size: 67KB

.bss Size: - Virtual size: 4KB

.edata Size: 5KB - Virtual size: 5KB

.idata Size: 7KB - Virtual size: 7KB

.CRT Size: 512B - Virtual size: 96B

.tls Size: 512B - Virtual size: 16B

.reloc Size: 6KB - Virtual size: 6KB

.text
Size: 808KB - Virtual size: 807KB

.data
Size: 12KB - Virtual size: 12KB

.rdata
Size: 73KB - Virtual size: 73KB

.pdata
Size: 47KB - Virtual size: 47KB

.xdata
Size: 68KB - Virtual size: 67KB

.bss
Size: - Virtual size: 4KB

.edata
Size: 5KB - Virtual size: 5KB

.idata
Size: 7KB - Virtual size: 7KB

.CRT
Size: 512B - Virtual size: 96B

.tls
Size: 512B - Virtual size: 16B

.reloc
Size: 6KB - Virtual size: 6KB