9be63aba4202522e6ed4b38b048fb418f0b255164199afde2dd514b28201c4a9

Sharing

Copy URL Twitter E-mail

General

Target

9be63aba4202522e6ed4b38b048fb418f0b255164199afde2dd514b28201c4a9
Size

14.5MB
MD5

f577d6bec8f3c05a1a51c3acfa4e38c3
SHA1

45604870fb75540d67a498dfa8bbb8842c1e18f8
SHA256

9be63aba4202522e6ed4b38b048fb418f0b255164199afde2dd514b28201c4a9
SHA512

f63269f9eda5ca96d83156d7c44bcaaf7600d7edcfb3a6b2b470c1619ca274c5d4c2966298b8d20d8b4063bc2b04a8c1900d2aaf62b62f09e51a45a7a2ad8c07
SSDEEP

196608:1FiNM0UhVC5a4mFz9EIOq8QbD/D503tFIEE+QQYtJEHHtVnpfTNCVAAws76G4f5n:1UMthVEa4mFz9eK+te+PtVnS8s765

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9be63aba4202522e6ed4b38b048fb418f0b255164199afde2dd514b28201c4a9

Files

9be63aba4202522e6ed4b38b048fb418f0b255164199afde2dd514b28201c4a9
.exe windows:6 windows x64 arch:x64

ee64191ea88ae1fc5626d3faaca4c847

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GlobalAlloc

user32

TranslateMessage

gdi32

GetDeviceCaps

advapi32

StartServiceA

shell32

SHGetSpecialFolderPathA

msvcp140

_Query_perf_frequency

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

winhttp

WinHttpQueryHeaders

version

GetFileVersionInfoSizeA

imm32

ImmSetCandidateWindow

d3dcompiler_43

D3DCompile

vcruntime140

strstr

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_initterm

api-ms-win-crt-heap-l1-1-0

free

api-ms-win-crt-convert-l1-1-0

mbstowcs

api-ms-win-crt-stdio-l1-1-0

fclose

api-ms-win-crt-filesystem-l1-1-0

remove

api-ms-win-crt-math-l1-1-0

sinf

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-string-l1-1-0

strncmp

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: - Virtual size: 789KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: - Virtual size: 184KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.ollvm0
Size: - Virtual size: 8.7MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.ollvm1
Size: 512B - Virtual size: 416B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.ollvm2
Size: 14.5MB - Virtual size: 14.5MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rsrc
Size: 1024B - Virtual size: 648B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 280B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

ee64191ea88ae1fc5626d3faaca4c847

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

gdi32

advapi32

shell32

msvcp140

d3d11

dwmapi

winhttp

version

imm32

d3dcompiler_43

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: - Virtual size: 789KB

.rdata Size: - Virtual size: 184KB

.data Size: - Virtual size: 3KB

.pdata Size: - Virtual size: 45KB

.ollvm0 Size: - Virtual size: 8.7MB

.ollvm1 Size: 512B - Virtual size: 416B

.ollvm2 Size: 14.5MB - Virtual size: 14.5MB

.rsrc Size: 1024B - Virtual size: 648B

.reloc Size: 512B - Virtual size: 280B

.text
Size: - Virtual size: 789KB

.rdata
Size: - Virtual size: 184KB

.data
Size: - Virtual size: 3KB

.pdata
Size: - Virtual size: 45KB

.ollvm0
Size: - Virtual size: 8.7MB

.ollvm1
Size: 512B - Virtual size: 416B

.ollvm2
Size: 14.5MB - Virtual size: 14.5MB

.rsrc
Size: 1024B - Virtual size: 648B

.reloc
Size: 512B - Virtual size: 280B