a67dde54f29fe50a6075f686923b766ede4651098fad422296f77e6f795d3ab5N[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

a67dde54f29fe50a6075f686923b766ede4651098fad422296f77e6f795d3ab5N.exe
Size

605KB
MD5

ddeee243100248eaadb7d3dd4e332d50
SHA1

2fc4f7c8a4021deae38c90b70d733330768bb8ed
SHA256

a67dde54f29fe50a6075f686923b766ede4651098fad422296f77e6f795d3ab5
SHA512

8ac89be2e8cede50545cd02f8e15f0b89b3354b1a30acddfb06c2d4972bed35faf61ca5b638e0c96fd2e4fd98164f914a3ccc94410e21bb4fa80f0283749b791
SSDEEP

12288:zQVnwSqyDpCstpdhOWjUse8PBUAxxue6HqAhpZq:zQqSqspzB7B3xiHrPq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a67dde54f29fe50a6075f686923b766ede4651098fad422296f77e6f795d3ab5N.exe

Files

a67dde54f29fe50a6075f686923b766ede4651098fad422296f77e6f795d3ab5N.exe
.exe windows:6 windows x64 arch:x64

322f1c1ff4870ee88af8af80b98138a2

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

aspnet_state.pdb

Imports

mswsock

GetAcceptExSockaddrs
AcceptEx

ole32

CoUninitialize
CoInitializeEx

ws2_32

ntohs
bind
WSAGetOverlappedResult
WSAStartup
closesocket
WSARecv
WSASend
WSAAddressToStringA
htons
listen
htonl
WSACleanup
select
recv
WSASocketW
WSAGetLastError
inet_ntoa
setsockopt

mscoree

ClrCreateManagedInstance

webengine4

GetXSPHeap
LoadLibraryUsingFullPath
AttachHandleToThreadPool
XspLogEvent
InitializeLibrary
PrintResourceString
PerfCounterInitialize
AspnetLoadResourceDLL

advapi32

RegQueryValueExW
RegOpenKeyExW
RegCloseKey
StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerW

kernel32

InitializeSListHead
GetCurrentProcessId
QueryPerformanceCounter
GetProcessAffinityMask
GetCurrentProcess
TerminateProcess
GetCurrentThreadId
RtlCaptureContext
GetVersionExW
GetSystemDirectoryW
HeapReAlloc
WideCharToMultiByte
FileTimeToSystemTime
lstrlenW
GetSystemTimeAsFileTime
FileTimeToLocalFileTime
LoadLibraryW
RtlLookupFunctionEntry
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetModuleHandleW
MultiByteToWideChar
HeapCreate
HeapDestroy
HeapAlloc
HeapFree
FreeLibrary
GetProcAddress
SetEvent
WaitForSingleObject
GetSystemInfo
CloseHandle
CreateEventW
SetWaitableTimer
Sleep
CreateThread
FormatMessageW
CreateWaitableTimerW
SetConsoleCtrlHandler
GetLastError
SwitchToThread

vcruntime140_clr0400

strchr
_purecall
memset
__C_specific_handler
memcpy
strstr

ucrtbase_clr0400

_configure_wide_argv
_initialize_wide_environment
_get_initial_wide_environment
_initterm
_initterm_e
exit
_exit
_set_fmode
__p___argc
__p___wargv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_configthreadlocale
_set_new_mode
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
_set_app_type
_itoa_s
wcsncpy_s
wcscpy_s
__stdio_common_vswprintf
strtol
_seh_filter_exe
strncmp
__p__commode
__setusermatherr

Exports

Exports

STWNDCloseConnection
STWNDDeleteStateItem
STWNDEndOfRequest
STWNDGetLocalAddress
STWNDGetLocalPort
STWNDGetRemoteAddress
STWNDGetRemotePort
STWNDIsClientConnected
STWNDSendResponse

Sections

.text
Size: 23KB - Virtual size: 22KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 568KB - Virtual size: 572KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

322f1c1ff4870ee88af8af80b98138a2

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

mswsock

ole32

ws2_32

mscoree

webengine4

advapi32

kernel32

vcruntime140_clr0400

ucrtbase_clr0400

Exports

Exports

Sections

.text Size: 23KB - Virtual size: 22KB

.rdata Size: 9KB - Virtual size: 8KB

.data Size: 512B - Virtual size: 6KB

.pdata Size: 2KB - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 568KB - Virtual size: 572KB

.text
Size: 23KB - Virtual size: 22KB

.rdata
Size: 9KB - Virtual size: 8KB

.data
Size: 512B - Virtual size: 6KB

.pdata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 568KB - Virtual size: 572KB