5d6351d8d0b58f39d54010b12df52b05482a36abaec3700864f98b09c0c0f795

Sharing

Copy URL

Twitter E-mail

General

Target

5d6351d8d0b58f39d54010b12df52b05482a36abaec3700864f98b09c0c0f795
Size

4.5MB
MD5

6cb1101167c96fadcd5d41cc9ee4ef78
SHA1

aeb68129ef052e697d8c0b4c4b0dba850e58a66a
SHA256

5d6351d8d0b58f39d54010b12df52b05482a36abaec3700864f98b09c0c0f795
SHA512

14092624aace59df83a75d9310ca00b6c66b7fe4535889b43494092bdc764ad10fe641a761a056c58201139c5d97faeaa6cc60eaa27805d7146730c8067ce882
SSDEEP

98304:2m/t0/HSTCGIKzgIdS4v0yeZw+jyGU8jX5QKb:2DqTYOgo0Vu+jy8X51b

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5d6351d8d0b58f39d54010b12df52b05482a36abaec3700864f98b09c0c0f795

Files

5d6351d8d0b58f39d54010b12df52b05482a36abaec3700864f98b09c0c0f795
.exe windows:6 windows x86 arch:x86

44fcaf4a22f053d25f06618233351cb5

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\anils\openssl3\openssl\openssl-3.0.10\apps\openssl.pdb

Imports

ws2_32

gethostbyname
gethostbyaddr
inet_ntoa
inet_addr
htons
getservbyname
WSASetLastError
sendto
send
recvfrom
getsockopt
recv
setsockopt
WSAGetLastError
shutdown
select
ntohs
__WSAFDIsSet
ioctlsocket
getsockname
WSAStartup
WSACleanup
accept
bind
closesocket
connect
listen
socket
getservbyport
htonl

advapi32

CryptCreateHash
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
DeregisterEventSource
CryptDecrypt
CryptExportKey
CryptGetUserKey

crypt32

CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertFreeCertificateContext
CertGetCertificateContextProperty
CertOpenStore

user32

GetUserObjectInformationW
MessageBoxW
GetProcessWindowStation

bcrypt

BCryptGenRandom

kernel32

AcquireSRWLockExclusive
ReleaseSRWLockShared
ReleaseSRWLockExclusive
AcquireSRWLockShared
ReadConsoleW
ReadConsoleA
SetConsoleMode
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
VirtualFree
FindClose
GetACP
QueryPerformanceCounter
GetSystemTimeAsFileTime
LoadLibraryW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
InitializeSRWLock
GetConsoleMode
ConvertThreadToFiberEx
ConvertFiberToThread
CreateFiberEx
DeleteFiber
SwitchToFiber
Sleep
CloseHandle
GetLastError
PeekNamedPipe
ExitProcess
CreateThread
TerminateThread
GetFileAttributesW
MultiByteToWideChar
GetStdHandle
DeleteFileW
ReadFile
WriteFile
GetProcessTimes
GetCurrentProcessId
OpenProcess
GetSystemTime
MoveFileW
SystemTimeToFileTime
PeekConsoleInputW
GetCommandLineW
GetEnvironmentVariableW
FindFirstFileW
FindNextFileW
WideCharToMultiByte
GetConsoleOutputCP
SetConsoleOutputCP
SetLastError
GetFileType
GetModuleHandleW
GetProcAddress
GetSystemDirectoryA
FreeLibrary
LoadLibraryA
FormatMessageA

vcruntime140

_except_handler4_common
wcsstr
memchr
memmove
strrchr
memcmp
strstr
memset
strchr
memcpy
__current_exception_context
__current_exception

api-ms-win-crt-convert-l1-1-0

strtoul
strtol
atoi
atol

api-ms-win-crt-stdio-l1-1-0

ferror
fread
fseek
ftell
fwrite
setvbuf
_setmode
_kbhit
__stdio_common_vswprintf
_open
fputs
_close
__p__commode
_set_fmode
fgets
__stdio_common_vsprintf_s
__stdio_common_vfprintf
clearerr
__acrt_iob_func
fopen
__stdio_common_vsscanf
_wfopen
setbuf
_fileno
feof
fclose
fputc
fflush
__stdio_common_vsprintf

api-ms-win-crt-runtime-l1-1-0

_errno
_register_onexit_function
_initialize_onexit_table
exit
_set_app_type
_seh_filter_exe
_crt_atexit
_configure_narrow_argv
_initialize_narrow_environment
_get_initial_narrow_environment
_initterm
signal
_controlfp_s
_initterm_e
terminate
__p___argc
__p___argv
raise
_exit
strerror
strerror_s
perror
_getpid
_register_thread_local_exe_atexit_callback
_c_exit
_cexit

api-ms-win-crt-string-l1-1-0

wcscmp
strlen
strncat
strcat
strncpy_s
strcat_s
strcpy_s
strspn
strcspn
wcslen
wcscpy
toupper
tolower
strncpy
isprint
strcmp
isdigit
isxdigit
strncmp
strcpy
islower
isspace

api-ms-win-crt-filesystem-l1-1-0

_stat64i32
_chmod
_access
_fstat64i32
_unlink

api-ms-win-crt-utility-l1-1-0

_lrotr
_lrotl
qsort

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-time-l1-1-0

_gmtime64_s
_time64

api-ms-win-crt-math-l1-1-0

__setusermatherr
_fdopen

api-ms-win-crt-heap-l1-1-0

calloc
realloc
_set_new_mode
malloc
free

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 751KB - Virtual size: 751KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 44KB - Virtual size: 55KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 960B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 708KB - Virtual size: 712KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

44fcaf4a22f053d25f06618233351cb5

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

advapi32

crypt32

user32

bcrypt

kernel32

vcruntime140

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 3.0MB - Virtual size: 3.0MB

.rdata Size: 751KB - Virtual size: 751KB

.data Size: 44KB - Virtual size: 55KB

.rsrc Size: 1024B - Virtual size: 960B

.reloc Size: 708KB - Virtual size: 712KB

.text
Size: 3.0MB - Virtual size: 3.0MB

.rdata
Size: 751KB - Virtual size: 751KB

.data
Size: 44KB - Virtual size: 55KB

.rsrc
Size: 1024B - Virtual size: 960B

.reloc
Size: 708KB - Virtual size: 712KB