f8a9054023ce6e877ec919237231e460N

Sharing

Copy URL Twitter E-mail

General

Target

f8a9054023ce6e877ec919237231e460N
Size

18KB
MD5

f8a9054023ce6e877ec919237231e460
SHA1

78783e7baa2fce045af4e998229b86ff61d9957b
SHA256

6277a2d63ad0d225e7134210ee932ee323a8bee2f7c1dd8205a40838e3f471b1
SHA512

d812fb791f77befc3677d703bd4faf6626a2709fd4ec37ad51cc98241091d8e83fd6959c6860186e024329bd37137cf2c3aad7a69974cd7ce99cb3e49fd748fc
SSDEEP

384:apcXmjKTXGgvxg3j9mmXFASDSmN0IXTe3yRjsw:WcCKGxz5StgTe3yNs

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f8a9054023ce6e877ec919237231e460N

Files

f8a9054023ce6e877ec919237231e460N
.exe windows:6 windows x64 arch:x64

430bfb6bfdf41133e015bbc952a23dab

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

vcruntime140

__C_specific_handler
memset
__current_exception
__current_exception_context
memcpy

api-ms-win-crt-stdio-l1-1-0

fgetc
fputc
__p__commode
_setmode
__stdio_common_vsprintf
getc
fwrite
ferror
__acrt_iob_func
_fileno
fopen
_set_fmode
fputs
freopen
fseek
ftell
fgets
__stdio_common_vfprintf
putc
__p__fmode
ungetc

api-ms-win-crt-heap-l1-1-0

malloc
free
_set_new_mode

api-ms-win-crt-runtime-l1-1-0

terminate
_register_onexit_function
_initialize_onexit_table
exit
_seh_filter_exe
_set_app_type
_crt_atexit
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
_initterm_e
_exit
_register_thread_local_exe_atexit_callback
__p___argc
__p___argv
_cexit
_c_exit

api-ms-win-crt-string-l1-1-0

isprint
isspace
strncmp

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

kernel32

GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlCaptureContext
RtlLookupFunctionEntry
TerminateProcess
GetCurrentProcess
GetModuleHandleW
IsProcessorFeaturePresent
QueryPerformanceCounter
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind

Sections

.text
Size: 9KB - Virtual size: 9KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4.0MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 600B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

430bfb6bfdf41133e015bbc952a23dab

Headers

DLL Characteristics

File Characteristics

Imports

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

kernel32

Sections

.text Size: 9KB - Virtual size: 9KB

.rdata Size: 5KB - Virtual size: 5KB

.data Size: 512B - Virtual size: 4.0MB

.pdata Size: 1024B - Virtual size: 600B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 512B - Virtual size: 48B

.text
Size: 9KB - Virtual size: 9KB

.rdata
Size: 5KB - Virtual size: 5KB

.data
Size: 512B - Virtual size: 4.0MB

.pdata
Size: 1024B - Virtual size: 600B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 512B - Virtual size: 48B