90d7825c83caf11c7fbbc68e525aad7ddd3cfa9c0e810df2fa707546e225b69c

Sharing

Copy URL

Twitter E-mail

General

Target

90d7825c83caf11c7fbbc68e525aad7ddd3cfa9c0e810df2fa707546e225b69c
Size

582KB
MD5

b2b0283a194711d86c12b383c692ce10
SHA1

97b24db08f5f0da56ad4531ff6ccd38f34ac76fd
SHA256

90d7825c83caf11c7fbbc68e525aad7ddd3cfa9c0e810df2fa707546e225b69c
SHA512

744c0205d67c8498cea095d05ccd551fae763d26da5cc8229bad90734774338c93ea61e2fbd18abe1a044232e2942fc2ee3cc0b37528e7f177759fb410354c0d
SSDEEP

6144:+m4riygWV91MKL/r1FWL1yXtvUT6LtEyxl8VI+LBRqcZMdsS1AJhis:eTV91fy1yBU+LtEyxyJ/q9SJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
90d7825c83caf11c7fbbc68e525aad7ddd3cfa9c0e810df2fa707546e225b69c

Files

90d7825c83caf11c7fbbc68e525aad7ddd3cfa9c0e810df2fa707546e225b69c
.exe windows:6 windows x64 arch:x64

e2a82a2c9623b676c4ef4739d701bb9b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

SpotlightImageSaver.pdb

Imports

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle
WakeByAddressAll
WaitOnAddress

bcryptprimitives

ProcessPrng

kernel32

SetFileInformationByHandle
GetFileInformationByHandle
GetFileInformationByHandleEx
GetCurrentThreadId
GetFullPathNameW
CreateDirectoryW
CreateThread
ExitProcess
QueryPerformanceCounter
MultiByteToWideChar
GetProcessHeap
RtlCaptureContext
RtlLookupFunctionEntry
LoadLibraryA
GetCurrentProcess
GetCurrentProcessId
CreateMutexA
ReleaseMutex
WideCharToMultiByte
RtlVirtualUnwind
GetSystemTimeAsFileTime
GetConsoleMode
GetStdHandle
GetEnvironmentVariableW
PostQueuedCompletionStatus
CreateIoCompletionPort
LoadLibraryExA
FreeLibrary
GetCurrentDirectoryW
GetProcAddress
FormatMessageW
ReadDirectoryChangesW
CreateFileW
CancelIo
WaitForSingleObjectEx
GetFinalPathNameByHandleW
SetLastError
InitializeSListHead
GetQueuedCompletionStatusEx
IsDebuggerPresent
UnhandledExceptionFilter
WaitForSingleObject
SetWaitableTimer
Sleep
CreateWaitableTimerExW
GetCurrentThread
SetThreadStackGuarantee
AddVectoredExceptionHandler
CreateSemaphoreW
CopyFileExW
SetFilePointerEx
GetSystemInfo
FindClose
GetLastError
FindNextFileW
FindFirstFileW
SetUnhandledExceptionFilter
GetModuleHandleW
lstrlenW
HeapReAlloc
SwitchToThread
ReleaseSemaphore
CloseHandle
HeapFree
QueryPerformanceFrequency
GetModuleHandleA
WriteConsoleW
HeapAlloc
IsProcessorFeaturePresent

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree
CoIncrementMTAUsage

ntdll

NtCancelIoFileEx
RtlNtStatusToDosError
NtDeviceIoControlFile
NtWriteFile
NtReadFile
RtlGetVersion

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory

oleaut32

SysStringLen
SysFreeString
GetErrorInfo

vcruntime140

memcmp
__current_exception_context
__current_exception
__C_specific_handler
memmove
__CxxFrameHandler3
memset
memcpy

api-ms-win-crt-math-l1-1-0

pow
__setusermatherr

api-ms-win-crt-runtime-l1-1-0

_get_initial_narrow_environment
_initterm
_initterm_e
exit
_exit
__p___argc
_initialize_narrow_environment
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_set_app_type
_crt_atexit
terminate
__p___argv
_configure_narrow_argv
_initialize_onexit_table
_seh_filter_exe
_register_onexit_function

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode

Sections

.text
Size: 479KB - Virtual size: 479KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 88KB - Virtual size: 88KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

e2a82a2c9623b676c4ef4739d701bb9b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

shell32

ole32

ntdll

api-ms-win-core-winrt-l1-1-0

oleaut32

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 479KB - Virtual size: 479KB

.rdata Size: 88KB - Virtual size: 88KB

.data Size: 512B - Virtual size: 9KB

.pdata Size: 9KB - Virtual size: 9KB

.reloc Size: 3KB - Virtual size: 2KB

.text
Size: 479KB - Virtual size: 479KB

.rdata
Size: 88KB - Virtual size: 88KB

.data
Size: 512B - Virtual size: 9KB

.pdata
Size: 9KB - Virtual size: 9KB

.reloc
Size: 3KB - Virtual size: 2KB