2aa676aaccac9ec5070dd297d53a48f331b34d06a8e73f7c9a05b3551c7a5f03N

Sharing

Copy URL

Twitter E-mail

General

Target

2aa676aaccac9ec5070dd297d53a48f331b34d06a8e73f7c9a05b3551c7a5f03N
Size

1.3MB
MD5

e540269df92e90ebdd4777871e1a4d20
SHA1

2dc0438b93891a73df8bc1ada6a4133d3de0ac48
SHA256

2aa676aaccac9ec5070dd297d53a48f331b34d06a8e73f7c9a05b3551c7a5f03
SHA512

e013dad07e384b28fa024aa20a6f50f7d76a377dd0c8af6cf0972ea54f85786c6ddb9bc4d0e4158112057220274d684b3db7f350f307cc83726062e165ad1f41
SSDEEP

12288:H3C7s+X/hXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDt3kbE:8s+XpsqjnhMgeiCl7G0nehbGZpbD

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2aa676aaccac9ec5070dd297d53a48f331b34d06a8e73f7c9a05b3551c7a5f03N

Files

2aa676aaccac9ec5070dd297d53a48f331b34d06a8e73f7c9a05b3551c7a5f03N
.exe windows:6 windows x86 arch:x86

d1be84d37a245f92b28658e15f154077

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\BuildAgent\work\7116a2615eef197f\community\native\WinElevator\Release\launcher.pdb

Imports

kernel32

GetModuleFileNameW
CreateNamedPipeW
WaitForSingleObject
FreeEnvironmentStringsW
GetLastError
CloseHandle
CreateThread
GetCurrentDirectoryW
WriteFile
GetCurrentProcessId
GetFileType
GetEnvironmentStringsW
ConnectNamedPipe
FlushFileBuffers
GetExitCodeProcess
CreateFileW
DecodePointer
GetStdHandle
GetCommandLineW
LocalFree
ReadFile
WriteConsoleW
SetFilePointerEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
GetStartupInfoW
GetModuleHandleW
RtlUnwind
SetLastError
EnterCriticalSection
LeaveCriticalSection
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
ExitProcess
GetModuleHandleExW
MultiByteToWideChar
WideCharToMultiByte
GetCommandLineA
GetACP
HeapFree
HeapAlloc
CompareStringW
LCMapStringW
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetOEMCP
GetCPInfo
SetEnvironmentVariableW
SetStdHandle
GetStringTypeW
GetProcessHeap
GetConsoleCP
GetConsoleMode
HeapSize
RaiseException

user32

wsprintfW

advapi32

RegisterEventSourceW
ReportEventW
DeregisterEventSource

shell32

CommandLineToArgvW
ShellExecuteExW

Sections

.text
Size: 74KB - Virtual size: 73KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.gfids
Size: 512B - Virtual size: 172B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.2MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

d1be84d37a245f92b28658e15f154077

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

Sections

.text Size: 74KB - Virtual size: 73KB

.rdata Size: 26KB - Virtual size: 26KB

.data Size: 2KB - Virtual size: 4KB

.gfids Size: 512B - Virtual size: 172B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 1.2MB - Virtual size: 1.8MB

.text
Size: 74KB - Virtual size: 73KB

.rdata
Size: 26KB - Virtual size: 26KB

.data
Size: 2KB - Virtual size: 4KB

.gfids
Size: 512B - Virtual size: 172B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 1.2MB - Virtual size: 1.8MB