72e227a76be895ab15547c1982a4f4f0N

Sharing

Copy URL Twitter E-mail

General

Target

72e227a76be895ab15547c1982a4f4f0N
Size

297KB
MD5

72e227a76be895ab15547c1982a4f4f0
SHA1

11588625aed21ec8534994620d05e693ecf45f4f
SHA256

32683a3d5fbc4ffb6448a9cb6e8fd76d2d284cd5e7a577f9f6f6cca822925645
SHA512

b90c2a1e852ed040978f3c744239c21cfcf34933e08c81cc45e60f0510361be4e06536d8becc337e6f026b4aace9687e5557edf03d93d39f715d8c09d5e7ffe2
SSDEEP

6144:QILU50cDi8Ar3vLkf049n/m+GGv9uLrmSVqjy00tDxta+7SY:Q9GSOCunmqDBS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
72e227a76be895ab15547c1982a4f4f0N

Files

72e227a76be895ab15547c1982a4f4f0N
.exe windows:6 windows x86 arch:x86

577ccb129f3ff548d539c307d8d0a191

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

mcrmgr.pdb

Imports

advapi32

EventRegister
EventUnregister
EventWrite
RegGetValueW
CryptCreateHash
CryptHashData
CryptReleaseContext
CryptDestroyKey
CryptAcquireContextW
CryptDestroyHash
CryptVerifySignatureW
CryptImportKey

kernel32

CreateProcessW
TerminateProcess
WaitForSingleObject
TerminateThread
ResumeThread
WaitForMultipleObjects
QueryDosDeviceW
QueryFullProcessImageNameW
LoadLibraryW
ResetEvent
K32GetProcessImageFileNameW
CreateFileW
InterlockedCompareExchange
InterlockedIncrement
InterlockedDecrement
GetLastError
LocalFree
ProcessIdToSessionId
OpenProcess
K32EnumProcessModules
K32GetModuleBaseNameW
lstrcmpiW
K32EnumProcesses
CreateEventW
SetEvent
GetModuleHandleW
HeapSetInformation
PowerSetRequest
GetTickCount
Sleep
RaiseException
lstrlenW
SetLastError
GetVersion
GetSystemInfo
VirtualProtect
VirtualFree
VirtualAlloc
ReadFile
GetOverlappedResult
WriteFile
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
GetSystemWindowsDirectoryW
GetProcAddress
UnhandledExceptionFilter
GetCurrentProcess
GetSystemTimeAsFileTime
GetCurrentThreadId
QueryPerformanceCounter
GetModuleHandleA
SetUnhandledExceptionFilter
GetStartupInfoW
InterlockedExchange
GetWindowsDirectoryW
LoadLibraryExW
PowerCreateRequest
FreeLibrary
CreateThread
CloseHandle
LocalAlloc
GetCurrentProcessId

user32

MapVirtualKeyExW
LoadStringW
UnregisterDeviceNotification
PostMessageW
FindWindowW
SetWinEventHook
GetMessageW
IsWindowVisible
IsWindow
EnumWindows
TranslateMessage
DispatchMessageW
RegisterClassW
CreateWindowExW
RegisterDeviceNotificationW
ShowWindow
GetWindowTextW
SendMessageTimeoutW
GetForegroundWindow
SetForegroundWindow
GetWindowThreadProcessId
UnhookWinEvent
DefWindowProcW
GetKeyboardLayout
PostQuitMessage

msvcrt

_exit
_cexit
__wgetmainargs
malloc
_callnewh
free
memcpy
wcschr
??0exception@@QAE@XZ
_wcsnicmp
_CxxThrowException
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
??0exception@@QAE@ABQBD@Z
memcpy_s
memmove_s
_vsnwprintf
memset
__CxxFrameHandler3
_wcsicmp
exit
_wcmdln
_initterm
_amsg_exit
__setusermatherr
__p__commode
__p__fmode
__set_app_type
_purecall
_unlock
_controlfp
__dllonexit
_lock
_onexit
??1type_info@@UAE@XZ
?terminate@@YAXXZ
_except_handler4_common
_XcptFilter

crypt32

CertVerifyCertificateChainPolicy
CertFindCertificateInStore
CertOpenStore
CertCloseStore
CryptHashPublicKeyInfo
CertFreeCertificateChain
CertGetCertificateChain
CryptDecodeObjectEx
CertAddEncodedCertificateToStore
CryptDecodeObject
CertFreeCertificateContext

ntdll

NtOpenProcess
NtQueryVirtualMemory

oleaut32

SysAllocStringLen
SysAllocString
SysFreeString
SysStringLen

qwave

QOSCloseHandle
QOSCreateHandle
QOSStartTrackingClient
QOSStopTrackingClient

secur32

GetUserNameExW

setupapi

SetupDiOpenDeviceInterfaceW
SetupDiEnumDeviceInterfaces
SetupDiGetDevicePropertyW
SetupDiCreateDeviceInfoList
SetupDiDestroyDeviceInfoList
SetupDiGetClassDevsW
SetupDiGetDeviceInterfaceDetailW

shell32

SHGetFolderPathW

shlwapi

PathFindFileNameW

version

GetFileVersionInfoW
GetFileVersionInfoSizeW
VerQueryValueW

winsta

WinStationFreeUserCertificates
WinStationServerPing
WinStationUnRegisterNotificationEvent
WinStationRegisterNotificationEvent
WinStationGetUserCertificates

wintrust

CryptCATAdminAcquireContext
CryptCATAdminCalcHashFromFileHandle
CryptCATAdminEnumCatalogFromHash
CryptCATCatalogInfoFromContext
CryptCATAdminReleaseCatalogContext
CryptCATClose
CryptCATAdminReleaseContext
CryptCATOpen
WTHelperProvDataFromStateData
WTHelperGetProvSignerFromChain
CryptCATGetMemberInfo
WinVerifyTrust

ws2_32

htonl
htons

wtsapi32

WTSRegisterSessionNotification
WTSLogoffSession
WTSQuerySessionInformationW
WTSVirtualChannelClose
WTSVirtualChannelQuery
WTSFreeMemory
WTSVirtualChannelOpen

sqmapi

SqmSet
SqmAddToStreamDWord
SqmAddToStreamString
SqmGetSession

Sections

.text
Size: 222KB - Virtual size: 222KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 46KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

577ccb129f3ff548d539c307d8d0a191

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

user32

msvcrt

crypt32

ntdll

oleaut32

qwave

secur32

setupapi

shell32

shlwapi

version

winsta

wintrust

ws2_32

wtsapi32

sqmapi

Sections

.text Size: 222KB - Virtual size: 222KB

.data Size: 46KB - Virtual size: 46KB

.rsrc Size: 26KB - Virtual size: 26KB

.text
Size: 222KB - Virtual size: 222KB

.data
Size: 46KB - Virtual size: 46KB

.rsrc
Size: 26KB - Virtual size: 26KB