b8b5e4ce17e2fed48bd47deb756a4690N

Sharing

Copy URL

Twitter E-mail

General

Target

b8b5e4ce17e2fed48bd47deb756a4690N
Size

2.1MB
MD5

b8b5e4ce17e2fed48bd47deb756a4690
SHA1

bb8235b3c8c0c95e09d5cc9418f069dd6e2c2232
SHA256

b1ca3d3bb46352ed70c114c8a6522726efdb830e3fc6f79fea3d6b06a57e3cba
SHA512

bfedc5acb6b4cbd454c62e3d4ecebab7a1cfe15fc095094fef7fc96fd55f331d248334bd8e11036d364a921ee61784a4bf719cb34b241fe58327330a5004d3f7
SSDEEP

24576:DJTkaHTzC4gyY6jetyoyvkY6HLoZG9A7GcMZaA9N/7+nYYVmQn6524O0HTKwRO:DJTkaVjetyRvchA71MZaAD7WTtyJThR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b8b5e4ce17e2fed48bd47deb756a4690N

Files

b8b5e4ce17e2fed48bd47deb756a4690N
.exe windows:6 windows x64 arch:x64

9183b5058ce3b32572d8c096cab97c4a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

ULMCXU.pdb

Imports

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle
WaitOnAddress
WakeByAddressAll

kernel32

SetHandleInformation
CreateIoCompletionPort
GetQueuedCompletionStatusEx
PostQueuedCompletionStatus
SetUnhandledExceptionFilter
SetFileCompletionNotificationModes
CreateProcessA
GetCurrentThreadId
WriteProcessMemory
GetProcAddress
lstrlenW
GetCurrentProcess
DuplicateHandle
LoadLibraryA
CloseHandle
GetSystemTimeAsFileTime
GetCurrentThread
InitializeSListHead
CreateFileW
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
IsDebuggerPresent
IsProcessorFeaturePresent
FreeEnvironmentStringsW
DeleteProcThreadAttributeList
CompareStringOrdinal
GetLastError
AddVectoredExceptionHandler
SetThreadStackGuarantee
SwitchToThread
CreateWaitableTimerExW
SetWaitableTimer
WaitForSingleObject
Sleep
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetLastError
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
UnhandledExceptionFilter
SetFileInformationByHandle
MoveFileExW
GetStdHandle
GetCurrentProcessId
WriteFileEx
SleepEx
QueryPerformanceFrequency
HeapFree
HeapReAlloc
ReleaseMutex
GetProcessHeap
HeapAlloc
FindNextFileW
FindClose
FindFirstFileW
DeleteFileW
GetFinalPathNameByHandleW
CreateMutexA
GetConsoleMode
WaitForSingleObjectEx
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
ExitProcess
CreateNamedPipeW
ReadFileEx
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
MultiByteToWideChar
WriteConsoleW
CreateThread
GetFullPathNameW
GetModuleHandleA
GetTempPathW

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey

ntdll

NtWriteFile
NtAllocateVirtualMemory
NtDeviceIoControlFile
NtCreateFile
RtlNtStatusToDosError
NtWaitForSingleObject
NtCreateThreadEx
NtProtectVirtualMemory
NtWriteVirtualMemory
NtReadVirtualMemory
NtCancelIoFileEx

ws2_32

WSASend
send
recv
shutdown
ioctlsocket
connect
WSASocketW
getsockname
getpeername
WSAGetLastError
getsockopt
WSAStartup
freeaddrinfo
bind
getaddrinfo
WSAIoctl
setsockopt
closesocket
WSACleanup

secur32

DecryptMessage
ApplyControlToken
FreeCredentialsHandle
DeleteSecurityContext
QueryContextAttributesW
FreeContextBuffer
InitializeSecurityContextW
AcquireCredentialsHandleA
EncryptMessage
AcceptSecurityContext

crypt32

CertAddCertificateContextToStore
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFreeCertificateContext
CertDuplicateCertificateContext
CertFreeCertificateChain
CertDuplicateCertificateChain
CertVerifyCertificateChainPolicy
CertGetCertificateChain
CertDuplicateStore

shell32

SHGetKnownFolderPath

ole32

CoTaskMemFree

psapi

GetModuleBaseNameW
EnumProcessModulesEx

vcruntime140

__current_exception
memcpy
memmove
memset
memcmp
__CxxFrameHandler3
__C_specific_handler
__current_exception_context

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-runtime-l1-1-0

__p___argc
__p___argv
_cexit
exit
_register_thread_local_exe_atexit_callback
_initterm_e
_initterm
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
_configure_narrow_argv
_get_initial_narrow_environment
_exit
_c_exit
_set_app_type
_seh_filter_exe
_initialize_narrow_environment

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode
free

Sections

.text
Size: 951KB - Virtual size: 950KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 970KB - Virtual size: 969KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 49KB - Virtual size: 48KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 166KB - Virtual size: 165KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9183b5058ce3b32572d8c096cab97c4a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

bcryptprimitives

api-ms-win-core-synch-l1-2-0

kernel32

advapi32

ntdll

ws2_32

secur32

crypt32

shell32

ole32

psapi

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 951KB - Virtual size: 950KB

.rdata Size: 970KB - Virtual size: 969KB

.data Size: 12KB - Virtual size: 12KB

.pdata Size: 49KB - Virtual size: 48KB

.rsrc Size: 166KB - Virtual size: 165KB

.reloc Size: 17KB - Virtual size: 16KB

.text
Size: 951KB - Virtual size: 950KB

.rdata
Size: 970KB - Virtual size: 969KB

.data
Size: 12KB - Virtual size: 12KB

.pdata
Size: 49KB - Virtual size: 48KB

.rsrc
Size: 166KB - Virtual size: 165KB

.reloc
Size: 17KB - Virtual size: 16KB