c82bc5adcc85cc3bfcddd47107517688626ab845fa2a1e21f780cab8aa4a8f88

Sharing

Copy URL

Twitter E-mail

General

Target

c82bc5adcc85cc3bfcddd47107517688626ab845fa2a1e21f780cab8aa4a8f88
Size

148KB
MD5

a5484e12cc924f21a9e113916b10f543
SHA1

31a97af056c3c8f339e2f01d1b940dce6ed31ee9
SHA256

c82bc5adcc85cc3bfcddd47107517688626ab845fa2a1e21f780cab8aa4a8f88
SHA512

9e2089341f20f16ad42527b650deda034f2cb3b2ad1a1ad9924c716407ffb191494c830fb48cbcbef87d4f60c178e1cc88a11c1e75999e24a2e31411e35dc29f
SSDEEP

1536:UoveAX56dIB/4ZW9ow4uTxoRzNWqWyZE3RCoVQZnmkEhH1NcGKFJHqKsd8HAc83Y:lpVrb1oRzNWqZEeEFUGK5sQ7gS

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c82bc5adcc85cc3bfcddd47107517688626ab845fa2a1e21f780cab8aa4a8f88

Files

c82bc5adcc85cc3bfcddd47107517688626ab845fa2a1e21f780cab8aa4a8f88
.exe windows:6 windows x64 arch:x64

41678f6e51d2176c1a7d8f45f45a737b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

Unhook.pdb

Imports

api-ms-win-core-synch-l1-2-0

WaitOnAddress
WakeByAddressSingle
WakeByAddressAll

kernel32

GetLastError
HeapReAlloc
HeapFree
GetCurrentThread
CloseHandle
AddVectoredExceptionHandler
QueryPerformanceCounter
VirtualAlloc
LoadLibraryA
GetProcAddress
SetUnhandledExceptionFilter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
UnhandledExceptionFilter
LoadLibraryExA
GetEnvironmentVariableW
WideCharToMultiByte
RtlVirtualUnwind
ReleaseMutex
CreateMutexA
GetCurrentProcessId
GetCurrentProcess
WaitForSingleObjectEx
RtlLookupFunctionEntry
RtlCaptureContext
GetCurrentDirectoryW
WaitForSingleObject
GetProcessHeap
HeapAlloc
IsDebuggerPresent
FormatMessageW
GetModuleHandleW
lstrlenW
SetLastError
GetModuleHandleA
GetConsoleMode
WriteConsoleW
VirtualProtect
MultiByteToWideChar
SetThreadStackGuarantee
GetStdHandle
IsProcessorFeaturePresent

ntdll

NtWriteFile
RtlNtStatusToDosError

oleaut32

SysStringLen
SysFreeString

vcruntime140

memcpy
__CxxFrameHandler3
_CxxThrowException
memset
__current_exception_context
__current_exception
__C_specific_handler
memmove
memcmp

api-ms-win-crt-runtime-l1-1-0

_crt_atexit
_set_app_type
_register_onexit_function
_initialize_onexit_table
terminate
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___argv
__p___argc
_configure_narrow_argv
_exit
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_seh_filter_exe

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode
free

Sections

.text
Size: 104KB - Virtual size: 104KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 36KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 720B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 800B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

41678f6e51d2176c1a7d8f45f45a737b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-core-synch-l1-2-0

kernel32

ntdll

oleaut32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 104KB - Virtual size: 104KB

.rdata Size: 36KB - Virtual size: 36KB

.data Size: 512B - Virtual size: 720B

.pdata Size: 4KB - Virtual size: 4KB

.reloc Size: 1024B - Virtual size: 800B

.text
Size: 104KB - Virtual size: 104KB

.rdata
Size: 36KB - Virtual size: 36KB

.data
Size: 512B - Virtual size: 720B

.pdata
Size: 4KB - Virtual size: 4KB

.reloc
Size: 1024B - Virtual size: 800B