a1f05b77df8060bffe18253c51e971152ded20141863b784e70748e5136540e4

Sharing

Copy URL Twitter E-mail

General

Target

a1f05b77df8060bffe18253c51e971152ded20141863b784e70748e5136540e4
Size

836KB
MD5

d741505ba32056fbef8880843f0ab5e8
SHA1

12afcb1c2322695f0bdc213ee53e94a3f2848297
SHA256

a1f05b77df8060bffe18253c51e971152ded20141863b784e70748e5136540e4
SHA512

73d748eb2e8bc3621e03b09b98e2fe9f06929322646b493c56d94981be00090e8b18da39c7fd3c531bd25e2b1fca1a49f481b47f5d7ee943240710a0877b0943
SSDEEP

12288:CcS0NvLaRZ7mCP2Ican7o0VYlb+D9n7M5ufHYaDyu6NMCU1m8aBwjUP9sR0nrsZu:CyvLfzIca7xnIMfNDyuSMCOarA0ndR

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a1f05b77df8060bffe18253c51e971152ded20141863b784e70748e5136540e4

Files

a1f05b77df8060bffe18253c51e971152ded20141863b784e70748e5136540e4
.dll windows:6 windows x86 arch:x86

f227ff36cccacd94891e63786c54dea8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL

PDB Paths

F:\phantompdfci\jenkins\workspace\TAA-PH-AUTO-COMPILE2\Starship\librel\pdb\phc.pdb

Imports

kernel32

GlobalFree
GlobalAlloc
ReadFile
GetFileSize
CreateFileW
CreateDirectoryW
GetModuleFileNameW
GetVersion
GetLocalTime
GetProcAddress
LoadLibraryW
FreeLibrary
SetEvent
CloseHandle
CreateEventW
GetLastError
WriteConsoleW
HeapSize
SetStdHandle
GetConsoleCP
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
FindFirstFileExA
GetProcessHeap
GetOEMCP
IsValidCodePage
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
ReadConsoleW
GetConsoleMode
GetFileType
GetStdHandle
GetModuleFileNameA
GetModuleHandleExW
ExitProcess
HeapReAlloc
WideCharToMultiByte
MultiByteToWideChar
HeapFree
HeapAlloc
RaiseException
RtlUnwind
CreateTimerQueue
UnregisterWaitEx
QueryDepthSList
InterlockedFlushSList
InterlockedPushEntrySList
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
DeleteCriticalSection
GetCurrentThreadId
QueryPerformanceCounter
SetLastError
InitializeCriticalSectionAndSpinCount
Sleep
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetSystemTimeAsFileTime
GetTickCount
GetModuleHandleW
EncodePointer
DecodePointer
LCMapStringW
GetLocaleInfoW
GetStringTypeW
GetCPInfo
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
GetCurrentProcessId
InitializeSListHead
FlushFileBuffers
SetEndOfFile
SetFilePointerEx
WriteFile
ReleaseSemaphore
CreateThread
SetThreadPriority
GetThreadPriority
GetSystemInfo
VirtualAlloc
VirtualFree
FindClose
FindNextFileA
GetACP
LocalFree
WaitForSingleObjectEx
SignalObjectAndWait
SwitchToThread
GetLogicalProcessorInformation
CreateTimerQueueTimer
ChangeTimerQueueTimer
DeleteTimerQueueTimer
GetNumaHighestNodeNumber
GetProcessAffinityMask
SetThreadAffinityMask
RegisterWaitForSingleObject
UnregisterWait
GetCurrentThread
GetThreadTimes
FreeLibraryAndExitThread
GetModuleHandleA
LoadLibraryExW
GetVersionExW
VirtualProtect
DuplicateHandle
InterlockedPopEntrySList

advapi32

RegEnumKeyExW
RegEnumValueW
RegQueryInfoKeyW
RegDeleteKeyW
RegDeleteValueW
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW

shell32

SHGetSpecialFolderPathW

ole32

CoUninitialize
CoInitializeSecurity
CoCreateInstance
CoSetProxyBlanket
CoInitializeEx

oleaut32

SafeArrayGetUBound
SafeArrayGetLBound
SysAllocString
SysFreeString
VariantInit
VariantClear
VariantChangeType
SafeArrayAccessData
SafeArrayUnaccessData

shlwapi

PathFileExistsW

iphlpapi

GetAdaptersInfo

ws2_32

gethostname
htonl
WSAStartup
WSACleanup
inet_addr

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

Exports

Exports

CreateCheckLicense
CreateCheckLicense1
DestroyCheckLicense

Sections

.text
Size: 396KB - Virtual size: 395KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 390KB - Virtual size: 390KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 24KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f227ff36cccacd94891e63786c54dea8

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

advapi32

shell32

ole32

oleaut32

shlwapi

iphlpapi

ws2_32

version

Exports

Exports

Sections

.text Size: 396KB - Virtual size: 395KB

.rdata Size: 390KB - Virtual size: 390KB

.data Size: 24KB - Virtual size: 28KB

.rsrc Size: 4KB - Virtual size: 4KB

.reloc Size: 20KB - Virtual size: 19KB

.text
Size: 396KB - Virtual size: 395KB

.rdata
Size: 390KB - Virtual size: 390KB

.data
Size: 24KB - Virtual size: 28KB

.rsrc
Size: 4KB - Virtual size: 4KB

.reloc
Size: 20KB - Virtual size: 19KB