cb237e2fdea825e5c501b29c5869a0e9c39f544cda8340b6993130b45e758e77N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

cb237e2fdea825e5c501b29c5869a0e9c39f544cda8340b6993130b45e758e77N.exe
Size

2.9MB
MD5

06a2a2c2c9615f9122735e9df198d950
SHA1

28555e6b9b7d103cc6fdddbe440ba781c3e122e4
SHA256

cb237e2fdea825e5c501b29c5869a0e9c39f544cda8340b6993130b45e758e77
SHA512

d4affde027753e86ce8329c3a641126bb74af30f3c2a0b8eb1872506055f1f2671b5b925bd1103f6b3afbc79627bd1ebec5d9e1df261e771b7e65fa826faf262
SSDEEP

49152:pCbXeVC7GdaAWNF0yUJTJQb9RlvHYFlVyvk9raNB49qYA9BG7zzfXW5AiM:1VC7GAN6BkRlAFlAk9+rZlG7O5A

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cb237e2fdea825e5c501b29c5869a0e9c39f544cda8340b6993130b45e758e77N.exe

Files

cb237e2fdea825e5c501b29c5869a0e9c39f544cda8340b6993130b45e758e77N.exe
.dll windows:6 windows x64 arch:x64

a2a5d005e862fd1acbdff2b928e49060

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

kernel32

CreateDirectoryW
WriteProcessMemory
WriteFile
VirtualAlloc
CreateFileW
DuplicateHandle
CreateToolhelp32Snapshot
CreateEventW
Sleep
Process32NextW
SetEvent
LoadLibraryA
CreateThreadpoolWait
Process32FirstW
GetProcAddress
GetProcessHeap
GetModuleHandleW
VirtualProtect
SetLastError
VirtualFree
GetNativeSystemInfo
FreeLibrary
IsBadReadPtr
WaitForSingleObject
CreateThread
VirtualFreeEx
SetEndOfFile
WriteConsoleW
GetCurrentProcessId
LocalFree
HeapAlloc
CloseHandle
GetLastError
OpenProcess
GetVersionExW
LocalAlloc
GetModuleFileNameW
lstrlenW
GetCurrentProcess
VirtualAllocEx
HeapFree
HeapSize
SetStdHandle
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
HeapReAlloc
ReadConsoleW
ReadFile
GetConsoleMode
GetConsoleOutputCP
FlushFileBuffers
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
RtlUnwind
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
MultiByteToWideChar
WideCharToMultiByte
LCMapStringEx
GetStringTypeW
GetCPInfo
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
TerminateProcess
RtlUnwindEx
RtlPcToFileHeader
RaiseException
InterlockedFlushSList
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetFileSizeEx
SetFilePointerEx
GetStdHandle
GetFileType
LCMapStringW

user32

MessageBoxA

advapi32

RegCloseKey
RegCreateKeyExW
RegSetValueExW
GetSidSubAuthorityCount
GetSidSubAuthority
OpenProcessToken
LookupAccountSidW
GetTokenInformation

shell32

ShellExecuteW
SHGetKnownFolderPath

oleaut32

SysAllocString
SysStringLen
SysFreeString

ntdll

NtQueryObject
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
NtQueryInformationProcess

wininet

InternetCloseHandle
InternetOpenUrlW
InternetOpenW
InternetReadFile

rstrtmgr

RmStartSession
RmShutdown
RmGetList
RmRegisterResources
RmEndSession

Sections

.text
Size: 183KB - Virtual size: 182KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 81KB - Virtual size: 81KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2.6MB - Virtual size: 2.6MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 512B - Virtual size: 244B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a2a5d005e862fd1acbdff2b928e49060

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

oleaut32

ntdll

wininet

rstrtmgr

Sections

.text Size: 183KB - Virtual size: 182KB

.rdata Size: 81KB - Virtual size: 81KB

.data Size: 2.6MB - Virtual size: 2.6MB

.pdata Size: 10KB - Virtual size: 9KB

_RDATA Size: 512B - Virtual size: 244B

.reloc Size: 2KB - Virtual size: 2KB

.text
Size: 183KB - Virtual size: 182KB

.rdata
Size: 81KB - Virtual size: 81KB

.data
Size: 2.6MB - Virtual size: 2.6MB

.pdata
Size: 10KB - Virtual size: 9KB

_RDATA
Size: 512B - Virtual size: 244B

.reloc
Size: 2KB - Virtual size: 2KB