142c786737e43362fb713a3f5458328ba375870863a02da05d1347b823746710

Sharing

Copy URL Twitter E-mail

General

Target

142c786737e43362fb713a3f5458328ba375870863a02da05d1347b823746710
Size

566KB
MD5

b9fd6d1e85aa998c12824a4176eef89b
SHA1

5d2112171697a00467436b4b517b77b743979b68
SHA256

142c786737e43362fb713a3f5458328ba375870863a02da05d1347b823746710
SHA512

a3e90891f82e60820a6d6765177f7d87385c38196bc483f042b94814663a8d74ddb33dd991b6255109d1a3e547bc49a6ca13de585c43e5ff864f717891066d43
SSDEEP

6144:X+vY74WZ9WcGDsQNkopPMJQmKjSbkz5lBOougYnqfuNqr157jjv1Y44LFyMrZ/ry:74SMj6QxSbMPtB2s5rO44xymrWDm

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
142c786737e43362fb713a3f5458328ba375870863a02da05d1347b823746710

Files

142c786737e43362fb713a3f5458328ba375870863a02da05d1347b823746710
.exe windows:6 windows x64 arch:x64

e259f44101070191b4c6467548566de3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

rust_Xor_shellcode.pdb

Imports

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle
WakeByAddressAll
WaitOnAddress

ntdll

NtWriteFile
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlNtStatusToDosError
RtlGetVersion
NtQuerySystemInformation
NtQueryInformationProcess

advapi32

GetTokenInformation
OpenProcessToken
CopySid
GetLengthSid
IsValidSid

kernel32

GetModuleHandleA
IsProcessorFeaturePresent
WideCharToMultiByte
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
CreateThread
HeapCreate
HeapAlloc
CloseHandle
GetSystemInfo
GetCurrentProcessId
GetProcessTimes
VirtualQueryEx
LocalFree
GlobalMemoryStatusEx
K32GetPerformanceInfo
GetProcessHeap
HeapFree
OpenProcess
GetSystemTimes
GetProcessIoCounters
ReadProcessMemory
LoadLibraryExA
GetProcAddress
FreeLibrary
GetLastError
WaitForSingleObject
FormatMessageW
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCurrentThread
SwitchToThread
QueryPerformanceCounter
SetLastError
GetCurrentDirectoryW
GetEnvironmentVariableW
GetCurrentProcess
GetStdHandle
GetSystemTimePreciseAsFileTime
HeapReAlloc
lstrlenW
ReleaseMutex
GetConsoleMode
GetModuleHandleW
MultiByteToWideChar
WriteConsoleW

pdh

PdhAddEnglishCounterW
PdhGetFormattedCounterValue
PdhRemoveCounter
PdhCloseQuery
PdhCollectQueryData
PdhOpenQueryA

powrprof

CallNtPowerInformation

oleaut32

SysFreeString
SysStringLen
GetErrorInfo

psapi

GetProcessMemoryInfo
GetModuleFileNameExW

shell32

CommandLineToArgvW

vcruntime140

memmove
__current_exception
memset
memcmp
memcpy
__C_specific_handler
_CxxThrowException
__CxxFrameHandler3
__current_exception_context

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode

api-ms-win-crt-string-l1-1-0

wcslen

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe
_set_app_type
_initterm_e
exit
_exit
terminate
_crt_atexit
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
__p___argc
_register_onexit_function
_initialize_onexit_table
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_initterm

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 204KB - Virtual size: 203KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 347KB - Virtual size: 346KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e259f44101070191b4c6467548566de3

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

bcryptprimitives

api-ms-win-core-synch-l1-2-0

ntdll

advapi32

kernel32

pdh

powrprof

oleaut32

psapi

shell32

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 204KB - Virtual size: 203KB

.rdata Size: 347KB - Virtual size: 346KB

.data Size: 512B - Virtual size: 912B

.pdata Size: 12KB - Virtual size: 11KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 204KB - Virtual size: 203KB

.rdata
Size: 347KB - Virtual size: 346KB

.data
Size: 512B - Virtual size: 912B

.pdata
Size: 12KB - Virtual size: 11KB

.reloc
Size: 1KB - Virtual size: 1KB