E6DlmOHEJ7zb[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

E6DlmOHEJ7zb.exe
Size

13.7MB
MD5

34b359daded00e789e798932e7ff6898
SHA1

c344e92a2482a2aadfc4a70475825d19e4203c83
SHA256

64014bd370f1c1613968bd4e50e7639122bdad552d004e6ef6af9aa5c8a391a5
SHA512

c1097e565963d58afd42b75a7c828e72cb2a087632c4343a2ad37267842e6338da7d30ef038b6d710479f6d58190100020430523c2e83d9366ee45c6e0bf9f29
SSDEEP

196608:7l7ALwo6ytV/xBljk2eunq+CFC/VVdHffq6kVvQyJSz+1JT59kYRwGwPh2ErdNHV:57otV/BgRuq9A3HaDQkSzkX5ShZd9V

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
E6DlmOHEJ7zb.exe

Files

E6DlmOHEJ7zb.exe
.exe windows:6 windows x64 arch:x64

Password: fcsdghv

1c9919e68b18afb21bbb9ef12617f657

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

d3d11

D3D11CreateDeviceAndSwapChain

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

d3dcompiler_43

D3DCompile

gdi32

CreateRoundRectRgn

dwmapi

DwmExtendFrameIntoClientArea

msvcp140

?always_noconv@codecvt_base@std@@QEBA_NXZ

user32

GetForegroundWindow

kernel32

GetFileInformationByHandleEx
GetSystemTimeAsFileTime
HeapAlloc
HeapFree
ExitProcess
GetModuleHandleA
LoadLibraryA
GetProcAddress

imm32

ImmReleaseContext

ole32

CoCreateInstance

oleaut32

SysAllocString

shell32

ShellExecuteW

winmm

mciSendStringW

advapi32

OpenProcessToken

normaliz

IdnToAscii

wldap32

ord41

crypt32

CertOpenStore

ws2_32

ntohl

rpcrt4

RpcStringFreeA

psapi

GetModuleInformation

winhttp

WinHttpConnect

ntdll

RtlAdjustPrivilege

userenv

UnloadUserProfile

iphlpapi

GetAdaptersInfo

vcruntime140

longjmp

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function

api-ms-win-crt-string-l1-1-0

wcslen

api-ms-win-crt-stdio-l1-1-0

_write

api-ms-win-crt-heap-l1-1-0

_callnewh

api-ms-win-crt-utility-l1-1-0

srand

api-ms-win-crt-math-l1-1-0

floorf

api-ms-win-crt-convert-l1-1-0

strtoul

api-ms-win-crt-filesystem-l1-1-0

_stat64

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func

Sections

.text
Size: - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 321KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 1.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 56KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourc
Size: - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.detourd
Size: - Virtual size: 24B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.A?q
Size: - Virtual size: 11.2MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.Ppm
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.^Vp
Size: 13.7MB - Virtual size: 13.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: fcsdghv

1c9919e68b18afb21bbb9ef12617f657

Headers

DLL Characteristics

File Characteristics

Imports

d3d11

d3dx11_43

d3dcompiler_43

gdi32

dwmapi

msvcp140

user32

kernel32

imm32

ole32

oleaut32

shell32

winmm

advapi32

normaliz

wldap32

crypt32

ws2_32

rpcrt4

psapi

winhttp

ntdll

userenv

iphlpapi

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: - Virtual size: 1.6MB

.rdata Size: - Virtual size: 321KB

.data Size: - Virtual size: 1.1MB

.pdata Size: - Virtual size: 56KB

.detourc Size: - Virtual size: 8KB

.detourd Size: - Virtual size: 24B

.A?q Size: - Virtual size: 11.2MB

.Ppm Size: 6KB - Virtual size: 6KB

.^Vp Size: 13.7MB - Virtual size: 13.7MB

.rsrc Size: 512B - Virtual size: 480B

.text
Size: - Virtual size: 1.6MB

.rdata
Size: - Virtual size: 321KB

.data
Size: - Virtual size: 1.1MB

.pdata
Size: - Virtual size: 56KB

.detourc
Size: - Virtual size: 8KB

.detourd
Size: - Virtual size: 24B

.A?q
Size: - Virtual size: 11.2MB

.Ppm
Size: 6KB - Virtual size: 6KB

.^Vp
Size: 13.7MB - Virtual size: 13.7MB

.rsrc
Size: 512B - Virtual size: 480B