1941bd10b19eed7d51632b3b0ceb82e259d4ffb0431a5215f1a8e868b4cffd41

Sharing

Copy URL Twitter E-mail

General

Target

1941bd10b19eed7d51632b3b0ceb82e259d4ffb0431a5215f1a8e868b4cffd41
Size

371KB
MD5

68ef5ee80e981994898b953bd4d976ee
SHA1

ad88d3d48073ef05266171501d60d4a69e4248aa
SHA256

1941bd10b19eed7d51632b3b0ceb82e259d4ffb0431a5215f1a8e868b4cffd41
SHA512

afdf83f73d2e8343b4c4c1dfcbeef8023da0dc743f9a625bba1daf04b24d7f1ad7caad6dcc09fb6a6c9e7d33d1453340b41ac6a80e64d361349fa68bee5d631d
SSDEEP

6144:EjH5YfH0PEm50ESiXhiUf9rZwcj+VA1nz1RBV6qE:OHWfH0PEm50ESiXhi5Unz1V

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1941bd10b19eed7d51632b3b0ceb82e259d4ffb0431a5215f1a8e868b4cffd41

Files

1941bd10b19eed7d51632b3b0ceb82e259d4ffb0431a5215f1a8e868b4cffd41
.exe windows:6 windows x64 arch:x64

a93a89590cd30c5a669d3c792fd5527a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\代码\http远程加载(2)\x64\Release\http远程加载(2).pdb

Imports

kernel32

VirtualFree
VirtualAlloc
GetLastError
CreateFileW
CloseHandle
SetFilePointerEx
GetFileSizeEx
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwindEx
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
EncodePointer
RaiseException
RtlPcToFileHeader
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapSize
HeapValidate
GetSystemInfo
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
GetFileType
OutputDebugStringW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetStringTypeW
GetProcessHeap
HeapFree
HeapReAlloc
HeapQueryInformation
WriteConsoleW

wininet

HttpSendRequestA
InternetReadFile
InternetOpenA
HttpOpenRequestA
HttpQueryInfoA
InternetCloseHandle
InternetConnectA

Sections

.text
Size: 267KB - Virtual size: 267KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 83KB - Virtual size: 83KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 13KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a93a89590cd30c5a669d3c792fd5527a

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

wininet

Sections

.text Size: 267KB - Virtual size: 267KB

.rdata Size: 83KB - Virtual size: 83KB

.data Size: 3KB - Virtual size: 8KB

.pdata Size: 13KB - Virtual size: 13KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 267KB - Virtual size: 267KB

.rdata
Size: 83KB - Virtual size: 83KB

.data
Size: 3KB - Virtual size: 8KB

.pdata
Size: 13KB - Virtual size: 13KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 2KB - Virtual size: 1KB