a9694fa1136745d9692c829696d780658c61c7f85c9381c7245696abeb5210b8N

Sharing

Copy URL Twitter E-mail

General

Target

a9694fa1136745d9692c829696d780658c61c7f85c9381c7245696abeb5210b8N
Size

202KB
MD5

e4632873513ab9bd5acc3d2b3b0397c0
SHA1

addf57afb6ccf5ed5d0425040c7347ff9a00c85c
SHA256

a9694fa1136745d9692c829696d780658c61c7f85c9381c7245696abeb5210b8
SHA512

1c0bc88f30548a83fcd9c82c702afe25e441fc8d111ef4bf8fda92aeef7be862dde94c1e6be3a8523b09d397ac6dad3f71fb1452ebfbfac588309cfc3edfa748
SSDEEP

3072:FRlt88H/QLpHFwewOu5iuQ+Areu2qgyZ4ohRLWN44RF4HINecW1AT:t7/Q1HWrOu5ir4yZ4o3LWd4oNrW1A

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a9694fa1136745d9692c829696d780658c61c7f85c9381c7245696abeb5210b8N

Files

a9694fa1136745d9692c829696d780658c61c7f85c9381c7245696abeb5210b8N
.exe windows:6 windows x64 arch:x64

4f4e33d2b0548678e63762cfcc5b6606

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

decryptor.pdb

Imports

api-ms-win-core-synch-l1-2-0

WaitOnAddress
WakeByAddressAll
WakeByAddressSingle

kernel32

GetFullPathNameW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
InitializeSListHead
CloseHandle
GetLastError
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCurrentThread
WaitForSingleObject
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetLastError
GetCurrentDirectoryW
GetEnvironmentVariableW
SetFileInformationByHandle
GetCurrentProcess
SetFilePointerEx
GetStdHandle
GetCurrentProcessId
HeapFree
HeapReAlloc
lstrlenW
ReleaseMutex
GetProcessHeap
HeapAlloc
FindNextFileW
FindClose
CreateFileW
GetFileInformationByHandle
GetFileInformationByHandleEx
CreateDirectoryW
FindFirstFileW
GetConsoleMode
GetModuleHandleW
FormatMessageW
MultiByteToWideChar
WriteConsoleW
WideCharToMultiByte
ReadConsoleW
IsProcessorFeaturePresent
GetModuleHandleA
GetProcAddress
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
GetSystemTimeAsFileTime
GetCurrentThreadId

ntdll

RtlNtStatusToDosError
NtWriteFile
NtReadFile

vcruntime140

__current_exception
__current_exception_context
__C_specific_handler
_CxxThrowException
memmove
memset
memcmp
memcpy
__CxxFrameHandler3

api-ms-win-crt-runtime-l1-1-0

_initterm_e
exit
_exit
_initterm
_get_initial_narrow_environment
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_configure_narrow_argv
__p___argc
_initialize_onexit_table
_initialize_narrow_environment
_register_onexit_function
_crt_atexit
terminate
_set_app_type
_seh_filter_exe

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode

Sections

.text
Size: 146KB - Virtual size: 146KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 45KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 928B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4f4e33d2b0548678e63762cfcc5b6606

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-core-synch-l1-2-0

kernel32

ntdll

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 146KB - Virtual size: 146KB

.rdata Size: 45KB - Virtual size: 45KB

.data Size: 512B - Virtual size: 928B

.pdata Size: 7KB - Virtual size: 6KB

.reloc Size: 1KB - Virtual size: 1KB

.text
Size: 146KB - Virtual size: 146KB

.rdata
Size: 45KB - Virtual size: 45KB

.data
Size: 512B - Virtual size: 928B

.pdata
Size: 7KB - Virtual size: 6KB

.reloc
Size: 1KB - Virtual size: 1KB