b1921e7e0377938146532a5abbd6dda82dff5008a94f921c40f0abf6844f9112[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

b1921e7e0377938146532a5abbd6dda82dff5008a94f921c40f0abf6844f9112.exe
Size

99KB
MD5

206addac1b15931a5a6f35222eced8c8
SHA1

297f99ca521f8a6133c39ce32d4f6e096860a4b7
SHA256

b1921e7e0377938146532a5abbd6dda82dff5008a94f921c40f0abf6844f9112
SHA512

68586256c387891c637063143a13ff7c9aa81aba28f2f7519f272ee2c123d5d21f11f666324166403625226867ca7e93c58822fab6bc4308b98ae50179103879
SSDEEP

1536:/AQQNQdlseZ1ffEaEWbAub1bGb6bBbzgEMbbE8bWB7zdWmLVz6o587DSfZYnd8m:4QQidl1Pp9Lp6887OCd8m

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b1921e7e0377938146532a5abbd6dda82dff5008a94f921c40f0abf6844f9112.exe

Files

b1921e7e0377938146532a5abbd6dda82dff5008a94f921c40f0abf6844f9112.exe
.exe windows:6 windows x64 arch:x64

5a71cd95736a46b01adfe7028b8fdffb

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

C:\Users\Administrator\Desktop\ENIGMA PERM\Build\ENIGMA SOLUTIONS PERM.pdb

Imports

kernel32

SetConsoleTextAttribute
SetConsoleTitleA
GetStdHandle
Sleep
CreateThread
Beep
GetConsoleWindow
SetConsoleTitleW
FormatMessageA
GetLocaleInfoEx
CreateFileW
FindClose
FindFirstFileW
GetFileAttributesExW
AreFileApisANSI
CloseHandle
GetLastError
GetModuleHandleW
GetFileInformationByHandleEx
MultiByteToWideChar
WideCharToMultiByte
GetCurrentThreadId
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
LocalFree

user32

FindWindowA
ShowWindow
GetAsyncKeyState

msvcp140

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
_Query_perf_frequency
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exception@std@@YA_NXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Winerror_map@std@@YAHH@Z
?_Xlength_error@std@@YAXPEBD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Syserror_map@std@@YAPEBDH@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
_Query_perf_counter

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context
__current_exception
memcmp
_CxxThrowException
__std_exception_copy
__std_exception_destroy
memcpy
__C_specific_handler
memset
__std_terminate
memmove

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-heap-l1-1-0

malloc
_set_new_mode
_callnewh
free

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-runtime-l1-1-0

_get_initial_narrow_environment
_crt_atexit
_initterm
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_exe
_initterm_e
exit
_exit
abort
__p___argc
_set_app_type
_invalid_parameter_noinfo_noreturn
__p___argv
_c_exit
system
terminate
_register_onexit_function
_register_thread_local_exe_atexit_callback
_cexit

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func
_configthreadlocale

shell32

ShellExecuteW

Sections

.text
Size: 77KB - Virtual size: 77KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 180B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

5a71cd95736a46b01adfe7028b8fdffb

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

shell32

Sections

.text Size: 77KB - Virtual size: 77KB

.rdata Size: 16KB - Virtual size: 16KB

.data Size: 1024B - Virtual size: 2KB

.pdata Size: 2KB - Virtual size: 2KB

.rsrc Size: 512B - Virtual size: 488B

.reloc Size: 512B - Virtual size: 180B

.text
Size: 77KB - Virtual size: 77KB

.rdata
Size: 16KB - Virtual size: 16KB

.data
Size: 1024B - Virtual size: 2KB

.pdata
Size: 2KB - Virtual size: 2KB

.rsrc
Size: 512B - Virtual size: 488B

.reloc
Size: 512B - Virtual size: 180B