174ddg0941cvah[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

174ddg0941cvah.exe
Size

51KB
MD5

0840b1026a7ecd9cc18586df4d9efed8
SHA1

4d0f0172be94ead006d80e914ebddb3390c7f11b
SHA256

08ff38e307f71bdfb9ef5681955d4df1929df170a6f1c8e851693c75bacddeb5
SHA512

9bf52493d59607aa58bb4590b638ff336461c2851e69bda47f9bfdd2b0268ee949e9d38ee8f68a9e43ed48d7e172a5cf8fecb6fac4763c0e86f947e669407a7b
SSDEEP

768:BfnEFrD4+HNwmJ/7UtSwR317uPPlvgXiu/6TbMgHE:FEND40SmJTQSwZ9umiu/6Md

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
174ddg0941cvah.exe

Files

174ddg0941cvah.exe
.exe windows:6 windows x64 arch:x64

f3c35fcf49df18a04c1b1b11bffec5aa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Aplicaciones\Visual Studio\Auto Updated\Process-Hollowing-main\Source\x64\Release\runpe.pdb

Imports

kernel32

GetCurrentThreadId
GetLastError
CloseHandle
HeapAlloc
GetProcAddress
DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
ReadFile
TerminateProcess
Wow64SetThreadContext
Wow64GetThreadContext
ResumeThread
CreateFileA
GetThreadContext
VirtualAllocEx
GetFileSize
ReadProcessMemory
CreateProcessA
SetThreadContext
IsWow64Process
OutputDebugStringW
InitializeSListHead
GetSystemTimeAsFileTime
InitializeCriticalSectionEx
WriteProcessMemory
HeapFree
InitializeCriticalSectionAndSpinCount
CreateEventW
GetModuleHandleW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
IsDebuggerPresent

ntdll

RtlAdjustPrivilege
NtRaiseHardError

vcruntime140

memcpy
__current_exception_context
__current_exception
memset
__C_specific_handler

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode
__stdio_common_vfprintf
__acrt_iob_func

api-ms-win-crt-heap-l1-1-0

_set_new_mode
free

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_register_onexit_function
_crt_atexit
_cexit
_set_app_type
_configure_narrow_argv
_get_initial_narrow_environment
_initterm
_initterm_e
exit
_exit
_initialize_narrow_environment
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
_seh_filter_exe
terminate

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 600B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f3c35fcf49df18a04c1b1b11bffec5aa

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

ntdll

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 8KB - Virtual size: 8KB

.rdata Size: 39KB - Virtual size: 39KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 1024B - Virtual size: 600B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 512B - Virtual size: 72B

.text
Size: 8KB - Virtual size: 8KB

.rdata
Size: 39KB - Virtual size: 39KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 1024B - Virtual size: 600B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 512B - Virtual size: 72B