4e378cb2d5ac2544f541d3d07f0f3b10N

Sharing

Copy URL Twitter E-mail

General

Target

4e378cb2d5ac2544f541d3d07f0f3b10N
Size

404KB
MD5

4e378cb2d5ac2544f541d3d07f0f3b10
SHA1

397d5a08f9fb7c52bd0157b31c6fc322c48897af
SHA256

4686141951cb03263c6ad4e5958de9e028e06d9a1e0095c8fe424d59bfce7255
SHA512

68acd4e4582cb3395f1214b516cf50e05370eb13f0bc22eccaab639ec620e57877634e5a0247672a9357570cd7316a61a5fc8d3c3cfdfd86a4fea2e5ab04accc
SSDEEP

12288:x2TTx3/giApFtCNlEBIQfdmtgmCZcOgpcDCNYi:ATRWbtCNlEBIgdmtgmCZcOgpcDC

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4e378cb2d5ac2544f541d3d07f0f3b10N

Files

4e378cb2d5ac2544f541d3d07f0f3b10N
.exe windows:10 windows x64 arch:x64

0fa671e07bc86ba0d63303fcbe0439ff

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

psr.pdb

Imports

advapi32

TraceMessage
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
RegisterTraceGuidsW
UnregisterTraceGuids
EventUnregister
EventRegister
EventSetInformation
EventWriteTransfer
RegGetValueW
RegCloseKey
RegQueryInfoKeyW
RegOpenKeyExW
RegGetValueA

kernel32

DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
GetModuleHandleW
DebugBreak
IsDebuggerPresent
GetFullPathNameW
LocalFree
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
CreateThreadpoolTimer
SetThreadpoolTimer
MultiByteToWideChar
WideCharToMultiByte
AcquireSRWLockShared
ReleaseSRWLockShared
LeaveCriticalSection
EnterCriticalSection
ExpandEnvironmentStringsW
GetFileAttributesW
CreateDirectoryW
CreateEventExW
SetEvent
DeleteFileW
MoveFileExW
Wow64DisableWow64FsRedirection
GetCommandLineW
GetSystemDirectoryW
CreateMutexExW
CreateEventW
CreateMutexW
RegisterWaitForSingleObject
HeapSetInformation
IsWow64Process
GetCurrentProcess
UnregisterWait
RaiseException
InitOnceBeginInitialize
InitializeCriticalSectionEx
InitializeCriticalSection
GetModuleFileNameW
LoadLibraryExW
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
GetSystemTime
SystemTimeToTzSpecificLocalTime
CopyFileW
GlobalUnlock
GlobalLock
GlobalAlloc
MulDiv
lstrcmpW
GetSystemTimeAsFileTime
Sleep
LockResource
LoadResource
FindResourceW
EncodePointer
GetProcAddress
HeapAlloc
CloseHandle
OpenSemaphoreW
WaitForSingleObjectEx
OutputDebugStringW
GetLastError
FormatMessageW
ReleaseMutex
GetCurrentThreadId
OpenEventW
LoadLibraryExA
VirtualAlloc
VirtualFree
lstrcmpiW
lstrcmpiA
GetModuleHandleExW
FlushInstructionCache
InterlockedPushEntrySList
InterlockedPopEntrySList
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
InitializeCriticalSectionAndSpinCount
ResetEvent
QueryPerformanceCounter
InitializeSListHead
GetStartupInfoW
FileTimeToLocalFileTime
CreateFileW
OpenProcess
GetCurrentDirectoryW
SetCurrentDirectoryW
DeleteFileA
GetLocaleInfoEx
TlsAlloc
TlsSetValue
GlobalHandle
WaitForSingleObject
ReleaseSemaphore
SetLastError
HeapFree
CreateSemaphoreExW
GetModuleFileNameA
InitOnceComplete
GlobalFree
TlsFree
TlsGetValue
lstrlenA
CreateFileA
ReadFile
IsDBCSLeadByte
FileTimeToDosDateTime
FindClose
GlobalReAlloc
lstrcmpA
WriteFile
GetFileAttributesExA
ReplaceFileW
SetFilePointer
DecodePointer
GetFileInformationByHandle
SetFileAttributesW
GetFileAttributesExW
GetDriveTypeA
FindFirstFileA
FindNextFileA
LoadLibraryW
FreeLibrary

gdi32

CreateSolidBrush
CreateCompatibleDC
CreateCompatibleBitmap
SelectObject
DeleteObject
BitBlt
DeleteDC
GetStockObject
GetObjectW
GetDeviceCaps

user32

UnregisterClassA
GetDlgItemInt
EndDialog
SetDlgItemTextW
EnableWindow
SetDlgItemInt
SendDlgItemMessageW
SetForegroundWindow
DialogBoxParamW
UnregisterClassW
KillTimer
SetTimer
GetWindowRect
GetTitleBarInfo
GetProcessDefaultLayout
LoadAcceleratorsW
DefWindowProcW
MessageBoxW
CharLowerA
SetLayeredWindowAttributes
GetDpiForWindow
DispatchMessageW
AdjustWindowRectExForDpi
PeekMessageA
DispatchMessageA
CharNextA
OemToCharBuffA
CharToOemBuffA
CharPrevA
CharUpperBuffA
RegisterClassExW
CharUpperW
CharNextW
PostThreadMessageW
GetDlgItemTextW
DestroyIcon
GetMessageW
TranslateMessage
GetWindowLongW
GetWindowLongPtrW
SetWindowLongPtrW
DestroyAcceleratorTable
GetDesktopWindow
ReleaseDC
GetDC
InvalidateRect
CallWindowProcW
InvalidateRgn
GetClientRect
FillRect
ReleaseCapture
SetCapture
MoveWindow
ScreenToClient
SetWindowLongW
PostQuitMessage
MapDialogRect
SetWindowContextHelpId
TranslateAcceleratorW
GetKeyState
LoadIconW
PostMessageW
TrackPopupMenu
EnableMenuItem
DestroyMenu
GetSubMenu
LoadMenuW
LoadCursorW
GetParent
ClientToScreen
CreateAcceleratorTableW
DestroyWindow
CreateWindowExW
GetClassInfoExW
RedrawWindow
SetWindowPos
GetSysColor
GetClassNameW
IsWindow
SendMessageW
GetDlgItem
GetWindow
SetFocus
GetFocus
IsChild
EndPaint
BeginPaint
SetWindowTextW
GetWindowTextW
GetWindowTextLengthW
RegisterWindowMessageW
LoadStringW
GetSystemMetrics
GetSysColorBrush
SystemParametersInfoW
ShowWindow
MapWindowPoints
UpdateWindow

msvcp_win

??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?gbump@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ

api-ms-win-crt-string-l1-1-0

memset
strncmp

api-ms-win-crt-runtime-l1-1-0

_c_exit
_register_thread_local_exe_atexit_callback
_initterm_e
_initterm

api-ms-win-crt-private-l1-1-0

_o__configthreadlocale
_o__configure_wide_argv
_o__crt_atexit
_o__errno
_o__exit
_o__get_wide_winmain_command_line
_o__getdrive
_o__gmtime32
_o__initialize_onexit_table
_o__initialize_wide_environment
_o__invalid_parameter_noinfo
_o__invalid_parameter_noinfo_noreturn
_o__localtime32
_o__mktemp
_o__purecall
_o__recalloc
_o__register_onexit_function
_o__seh_filter_exe
_o__set_app_type
_o__set_fmode
_o__callnewh
_o__set_new_mode
_o__wcsicmp
_o__wtoi
_o_abort
_o_calloc
_o_exit
_o_free
_o_iswspace
_o_malloc
_o_mbstowcs_s
_o_qsort
_o_realloc
_o_terminate
_o_wcscat_s
_o_wcscpy_s
_o_wcsncpy_s
__current_exception
__current_exception_context
__CxxFrameHandler3
_o___stdio_common_vswprintf_s
_o___stdio_common_vswprintf
_o___stdio_common_vsprintf
_o___stdio_common_vsnprintf_s
_o___std_exception_destroy
_o___std_exception_copy
_o___p__commode
__C_specific_handler
__std_terminate
__CxxFrameHandler4
strstr
_CxxThrowException
__C_specific_handler_noexcept
memcmp
memcpy
_o__cexit
memmove

uireng

UirInitializeEngine
UirStopRecordingSession
UirOutCreateOutputFile
UirGetRecordedActionInfo
UirWriteRecordedActionListXml
UirWriteRecordedActionAndCommentListMht
UirWriteUserComments
UirFreeRecordedActionInfo
UirPauseRecordingSession
UirResumeRecordingSession
UirUpdateRecordingSession
UirStartRecordingSession

comctl32

ImageList_Destroy
ImageList_GetIcon
ImageList_ReplaceIcon
InitCommonControlsEx
ImageList_Create
ord381

ntdll

EtwEventWriteNoRegistration
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext

oleaut32

UnRegisterTypeLi
SysAllocString
LoadTypeLi
RegisterTypeLi
SysStringLen
VarBstrCmp
OleCreateFontIndirect
LoadRegTypeLi
SysStringByteLen
VariantClear
VariantInit
SysAllocStringLen
SysFreeString
GetErrorInfo
SetErrorInfo

ole32

CoCreateInstance
CoInitialize
CreateStreamOnHGlobal
OleLockRunning
CoCreateFreeThreadedMarshaler
CLSIDFromProgID
CLSIDFromString
OleInitialize
OleUninitialize
CoTaskMemAlloc
CoUninitialize
CoTaskMemFree
StringFromGUID2
CoCreateGuid
CoGetClassObject
CoInitializeEx

shell32

SHFileOperationW
ShellExecuteExW
ord171
SHCreateItemInKnownFolder
ShellAboutW
CommandLineToArgvW

shlwapi

PathFindExtensionW
PathAppendW
PathGetArgsW
PathRemoveExtensionW
PathFindFileNameW
PathCombineW
PathRemoveFileSpecW
PathFileExistsW
SHAutoComplete
PathFindExtensionA
PathMatchSpecExA
ord216
ord218
PathIsSameRootW

api-ms-win-crt-time-l1-1-0

_time32

Sections

.text
Size: 272KB - Virtual size: 270KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 96KB - Virtual size: 92KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 14KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 908B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

0fa671e07bc86ba0d63303fcbe0439ff

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

gdi32

user32

msvcp_win

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

uireng

comctl32

ntdll

oleaut32

ole32

shell32

shlwapi

api-ms-win-crt-time-l1-1-0

Sections

.text Size: 272KB - Virtual size: 270KB

.rdata Size: 96KB - Virtual size: 92KB

.data Size: 8KB - Virtual size: 14KB

.pdata Size: 16KB - Virtual size: 15KB

.rsrc Size: 4KB - Virtual size: 3KB

.reloc Size: 4KB - Virtual size: 908B

.text
Size: 272KB - Virtual size: 270KB

.rdata
Size: 96KB - Virtual size: 92KB

.data
Size: 8KB - Virtual size: 14KB

.pdata
Size: 16KB - Virtual size: 15KB

.rsrc
Size: 4KB - Virtual size: 3KB

.reloc
Size: 4KB - Virtual size: 908B