349552058ca7f1d7c844c275cb713cdeacbd30d067bdd81361286803e388e11e

Sharing

Copy URL Twitter E-mail

General

Target

349552058ca7f1d7c844c275cb713cdeacbd30d067bdd81361286803e388e11e
Size

6.0MB
MD5

45ef8faae079d103cfd34dd60077d532
SHA1

cedf193b78f3a8d4cb6b524ce262ef257541b7b5
SHA256

349552058ca7f1d7c844c275cb713cdeacbd30d067bdd81361286803e388e11e
SHA512

af417bc1e1070c9511a5c4ca8e157efd86a875229d2cd2f9f9dec861c1af789d19f843da5d69a9abdb925ef8ae5f3455f33d369232f524fb614b1dd14426d41d
SSDEEP

98304:FdgQxP36UPyMR4dzhx6Ne+MLrewD/lH7:FGQ3vPGdJVX

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
349552058ca7f1d7c844c275cb713cdeacbd30d067bdd81361286803e388e11e

Files

349552058ca7f1d7c844c275cb713cdeacbd30d067bdd81361286803e388e11e
.exe windows:6 windows x64 arch:x64

821c7451cd9e6e14febd76b8c58a6c53

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

AcquireSRWLockExclusive
CloseHandle
CreateEventW
CreateFileMappingW
CreateFileW
CreateIoCompletionPort
DecodePointer
DeleteCriticalSection
EnterCriticalSection
ExitProcess
FindResourceExW
FindResourceW
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetExitCodeThread
GetFileAttributesA
GetFileSize
GetLastError
GetLocalTime
GetModuleFileNameW
GetModuleHandleExW
GetModuleHandleW
GetNativeSystemInfo
GetProcAddress
GetProcessHeap
GetQueuedCompletionStatus
GetStartupInfoW
GetSystemInfo
GetSystemTimeAsFileTime
GetTickCount64
HeapAlloc
HeapCreate
HeapDestroy
HeapFree
HeapReAlloc
HeapSize
InitializeConditionVariable
InitializeCriticalSection
InitializeCriticalSectionAndSpinCount
InitializeCriticalSectionEx
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
LeaveCriticalSection
LoadLibraryW
LoadResource
LockResource
MapViewOfFileEx
MultiByteToWideChar
OutputDebugStringW
PostQueuedCompletionStatus
QueryPerformanceCounter
ReleaseSRWLockExclusive
ResetEvent
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetEvent
SetLastError
SetUnhandledExceptionFilter
SizeofResource
Sleep
SleepConditionVariableCS
SleepConditionVariableSRW
SwitchToThread
TerminateProcess
TerminateThread
UnhandledExceptionFilter
UnmapViewOfFile
VirtualFree
VirtualQuery
WaitForSingleObject
WakeAllConditionVariable
WakeConditionVariable
WideCharToMultiByte
lstrlenW

user32

DispatchMessageW
EnumDisplayDevicesA
MsgWaitForMultipleObjects
PeekMessageW
TranslateMessage
UnregisterClassW

shlwapi

StrChrW

d3d9

Direct3DCreate9

ws2_32

InetNtopW
InetPtonW
WSACleanup
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAGetLastError
WSAIoctl
WSARecv
WSARecvFrom
WSAResetEvent
WSASend
WSASendTo
WSASetLastError
WSAStartup
WSAStringToAddressW
WSAWaitForMultipleEvents
__WSAFDIsSet
bind
closesocket
connect
freeaddrinfo
getaddrinfo
getpeername
getsockname
getsockopt
htonl
htons
ioctlsocket
ntohl
ntohs
recv
select
send
sendto
setsockopt
shutdown
socket

winmm

timeBeginPeriod
timeEndPeriod
timeGetDevCaps
timeGetTime

msvcrt

?_set_new_mode@@YAHH@Z
?terminate@@YAXXZ
_CxxThrowException
_XcptFilter
__C_specific_handler
__CxxFrameHandler3
___lc_codepage_func
___mb_cur_max_func
__getmainargs
__pctype_func
__set_app_type
_acmdln
_amsg_exit
_beginthreadex
_callnewh
_clearfp
_commode
_errno
_fileno
_initterm
_initterm_e
_iob
_isatty
_ismbblead
_lock
_mbtowc_l
_msize
_set_fmode
_unlock
_wcstoui64
abort
calloc
ceil
ceilf
fflush
free
isalnum
iswctype
log10
malloc
memchr
memcmp
memcpy
memmove
memset
realloc
strcpy_s
strerror
strlen
strnlen
strrchr
strtol
tolower
wcslen
wcsnlen
wcstol
wctomb_s

Sections

.text
Size: 4.6MB - Virtual size: 4.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 53KB - Virtual size: 52KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1009KB - Virtual size: 1014KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.retplne
Size: 512B - Virtual size: 140B

.tls
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 253KB - Virtual size: 253KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

821c7451cd9e6e14febd76b8c58a6c53

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

shlwapi

d3d9

ws2_32

winmm

msvcrt

Sections

.text Size: 4.6MB - Virtual size: 4.6MB

.rdata Size: 53KB - Virtual size: 52KB

.data Size: 1009KB - Virtual size: 1014KB

.pdata Size: 26KB - Virtual size: 25KB

.retplne Size: 512B - Virtual size: 140B

.tls Size: 1KB - Virtual size: 1KB

.reloc Size: 253KB - Virtual size: 253KB

.text
Size: 4.6MB - Virtual size: 4.6MB

.rdata
Size: 53KB - Virtual size: 52KB

.data
Size: 1009KB - Virtual size: 1014KB

.pdata
Size: 26KB - Virtual size: 25KB

.retplne
Size: 512B - Virtual size: 140B

.tls
Size: 1KB - Virtual size: 1KB

.reloc
Size: 253KB - Virtual size: 253KB