91e1a78586a60816b4ad16cdc31bf92c66d19bc9adfe71a720ea20eeb9b32163N

Sharing

Copy URL

Twitter E-mail

General

Target

91e1a78586a60816b4ad16cdc31bf92c66d19bc9adfe71a720ea20eeb9b32163N
Size

111KB
MD5

f7e2d8e4217cd73c9599f0896445d440
SHA1

c5808b3b3056dd54f6c94582cc80c329b96d56f7
SHA256

91e1a78586a60816b4ad16cdc31bf92c66d19bc9adfe71a720ea20eeb9b32163
SHA512

734137eb7f695da293f696d5d0c3b68777d85c5895ae9c6c4cde5065962ef170bc4016db4626a0aeb77bdfd075a57c0e0206251531f71a8610ad9e22d861959c
SSDEEP

3072:WVtXtkTYS+0NSiWm4UpCPyWvaskPOvl+cHoA4voZl/lXL8:WVtXtkTYSFNMzz/Dlb8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
91e1a78586a60816b4ad16cdc31bf92c66d19bc9adfe71a720ea20eeb9b32163N

Files

91e1a78586a60816b4ad16cdc31bf92c66d19bc9adfe71a720ea20eeb9b32163N
.exe windows:6 windows x86 arch:x86

a031ae42e9177b19dc8a3b72f649c225

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

G:\Bob's Stuff\Code\scatter\DTM2ENVI\Release\DTM2ENVI.pdb

Imports

kernel32

GetModuleFileNameA
GetShortPathNameA
DeleteFileA
FileTimeToLocalFileTime
GetFileAttributesExA
GetModuleHandleA
FileTimeToSystemTime
DecodePointer
GetLastError
HeapDestroy
GetWindowsDirectoryA
HeapReAlloc
HeapFree
HeapSize
GetProcessHeap
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
OutputDebugStringA
SetLastError
LeaveCriticalSection
EnterCriticalSection
GetSystemDirectoryA
GetTempPathA
HeapAlloc
GetCommandLineA
RaiseException
OutputDebugStringW
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
SleepConditionVariableSRW
WakeAllConditionVariable
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
LoadLibraryW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW

user32

UnregisterClassA
MessageBoxA

advapi32

RegOpenKeyExA
RegCloseKey
RegQueryValueExA

shell32

ShellExecuteA

mfc140

ord7998
ord4656
ord8672
ord1526
ord1661
ord8322
ord4315
ord266
ord265
ord5898
ord1692
ord1529
ord305
ord3005
ord12503
ord5102
ord4843
ord1509
ord4807
ord8717
ord14334
ord4655
ord12706
ord1696
ord1044
ord310
ord300
ord316
ord2406
ord993
ord1468
ord2383
ord2387

msvcp140

?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?width@ios_base@std@@QAE_J_J@Z
?cerr@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?uncaught_exception@std@@YA_NXZ
?good@ios_base@std@@QBE_NXZ
?flags@ios_base@std@@QBEHXZ
?width@ios_base@std@@QBE_JXZ

vcruntime140

__current_exception_context
memmove
__std_type_info_destroy_list
_except_handler4_common
__current_exception
memset
strchr
__CxxFrameHandler3
__std_terminate

api-ms-win-crt-string-l1-1-0

_strdup
strncpy
_strnicmp
strncmp

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__stdio_common_vfprintf
fwrite
_fseeki64
fseek
fread
_set_fmode
fopen
fclose
_tempnam
__stdio_common_vsprintf
__p__commode

api-ms-win-crt-heap-l1-1-0

_recalloc
free
_set_new_mode

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-filesystem-l1-1-0

_splitpath
_access

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-math-l1-1-0

floor
_CIatan2
_libm_sse2_sqrt_precise
modf
__setusermatherr

api-ms-win-crt-runtime-l1-1-0

_initterm
_get_initial_narrow_environment
_exit
__p___argc
_cexit
__p___argv
_c_exit
terminate
_set_app_type
exit
_initterm_e
system
_seh_filter_exe
_controlfp_s
_errno
_register_thread_local_exe_atexit_callback
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
_invalid_parameter_noinfo

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-time-l1-1-0

_localtime64
asctime
_time64

api-ms-win-crt-locale-l1-1-0

_configthreadlocale
setlocale

oleaut32

SysFreeString

Sections

.text
Size: 76KB - Virtual size: 75KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 25KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1024B - Virtual size: 776B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a031ae42e9177b19dc8a3b72f649c225

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

mfc140

msvcp140

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

oleaut32

Sections

.text Size: 76KB - Virtual size: 75KB

.rdata Size: 26KB - Virtual size: 25KB

.data Size: 512B - Virtual size: 2KB

.rsrc Size: 1024B - Virtual size: 776B

.reloc Size: 7KB - Virtual size: 6KB

.text
Size: 76KB - Virtual size: 75KB

.rdata
Size: 26KB - Virtual size: 25KB

.data
Size: 512B - Virtual size: 2KB

.rsrc
Size: 1024B - Virtual size: 776B

.reloc
Size: 7KB - Virtual size: 6KB