SecuriteInfo[.]com[.]Win64[.]MalwareX-gen[.]32396[.]3970

Sharing

Copy URL Twitter E-mail

General

Target

SecuriteInfo.com.Win64.MalwareX-gen.32396.3970
Size

20KB
MD5

69cf2ff495c90c2bdd9182e9d1d83467
SHA1

32111f59feb39824f1f8b7d1d541f483c120fc69
SHA256

915bec2968a2cda0014b6fbe20c14f2588059a1d730e8ec44e07c44e19ffe7bc
SHA512

3400facf84a0d68cf83a8ef94859bb032a00dc709987c7741767d0674f0d7069c7cf7cdb2469d18fd3e56f9ab9df391d208fb5071e6bc8d938873e013aee443f
SSDEEP

384:hdTUxXB4Mo3FvFCqUDqye8QAlHlMK35y:hZuXa51c2r8QAlyK3s

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
SecuriteInfo.com.Win64.MalwareX-gen.32396.3970

Files

SecuriteInfo.com.Win64.MalwareX-gen.32396.3970
.exe windows:6 windows x64 arch:x64

b77ae6ce2e7665d976d37bf6afd1b097

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\erays\Desktop\Process-Hollowing-main\Source\x64\Release\runpe.pdb

Imports

kernel32

ReadFile
WriteProcessMemory
HeapFree
TerminateProcess
Wow64SetThreadContext
Wow64GetThreadContext
ResumeThread
CreateFileA
CloseHandle
HeapAlloc
GetThreadContext
VirtualAllocEx
GetFileSize
ReadProcessMemory
GetProcessHeap
CreateProcessA
SetThreadContext
IsWow64Process
RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
GetModuleHandleW
IsDebuggerPresent
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent

vcruntime140

__current_exception
__C_specific_handler
memcpy
__current_exception_context
memset

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf
__acrt_iob_func
__p__commode
_set_fmode

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
_seh_filter_exe
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___argv
__p___argc
_exit
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_set_app_type

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

Sections

.text
Size: 9KB - Virtual size: 8KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 7KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 612B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 48B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

b77ae6ce2e7665d976d37bf6afd1b097

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 9KB - Virtual size: 8KB

.rdata Size: 7KB - Virtual size: 7KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 1024B - Virtual size: 612B

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 512B - Virtual size: 48B

.text
Size: 9KB - Virtual size: 8KB

.rdata
Size: 7KB - Virtual size: 7KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 1024B - Virtual size: 612B

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 512B - Virtual size: 48B