7f73a84f75ebbb089daf2d4f52493641c1791867891056496f510fa60ef2c822N

Sharing

Copy URL

Twitter E-mail

General

Target

7f73a84f75ebbb089daf2d4f52493641c1791867891056496f510fa60ef2c822N
Size

42KB
MD5

52945e3e4b8ea2702a0c5bf4261e1770
SHA1

8bbbcd104f37cd0e156489839ffc691c323f59a4
SHA256

7f73a84f75ebbb089daf2d4f52493641c1791867891056496f510fa60ef2c822
SHA512

5f59bff6ba54c4a3781e433759badd22b7de59a8062201152fa656b8cfa99d2eefefa59b2680fd7b4c888b5817ffe979930a23e9bb52cb5f333d2e4cc25537d7
SSDEEP

768:fm8RocpybBNBaqPQwxxBozGSUYwt+l7fCNlZW+gfx7ejqh5TisKl4qJ:fmOybBNnQw56pSZW+euqh5TisKldJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7f73a84f75ebbb089daf2d4f52493641c1791867891056496f510fa60ef2c822N

Files

7f73a84f75ebbb089daf2d4f52493641c1791867891056496f510fa60ef2c822N
.exe windows:6 windows x64 arch:x64

f4369fe6edb9072e57e85e59e525feb3

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

wuapp.pdb

Imports

kernel32

GetFileAttributesW
CreateDirectoryW
CreateFileW
GetSystemDirectoryW
LoadLibraryExW
GetVolumePathNameW
GetDriveTypeW
GetFileType
CloseHandle
CreateProcessW
GetCommandLineW
GetProcAddress
FreeLibrary
LoadLibraryW
Sleep
GetStartupInfoW
SetUnhandledExceptionFilter
GetModuleHandleW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
CreateMutexW
WaitForSingleObject
ReleaseMutex
GetLastError
SetLastError
GetModuleFileNameW
GetSystemTime
WideCharToMultiByte
SetFilePointer
WriteFile
FlushFileBuffers
GetFileSize
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
SetEndOfFile
CompareStringW
OutputDebugStringW
VerSetConditionMask
VerifyVersionInfoW
lstrlenW
HeapAlloc
GetProcessHeap
HeapFree
ExpandEnvironmentStringsW
GetTimeZoneInformation
SystemTimeToTzSpecificLocalTime

msvcrt

malloc
memcpy
_vsnwprintf
__wgetmainargs
__C_specific_handler
_XcptFilter
_exit
_cexit
exit
_wcmdln
_initterm
_amsg_exit
__setusermatherr
_commode
_fmode
__set_app_type
?terminate@@YAXXZ
_unlock
__dllonexit
_lock
_onexit
memset
memmove
free

ntdll

RtlLookupFunctionEntry
RtlVirtualUnwind
RtlCaptureContext

advapi32

RegCloseKey
AllocateAndInitializeSid
CheckTokenMembership
CopySid
IsValidSid
FreeSid
RegQueryValueExW
GetUserNameW
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAce
InitializeAcl
RegOpenKeyExW
GetLengthSid

ole32

CoUninitialize
CoInitializeEx
CoCreateInstance

shlwapi

StrChrW
StrRChrW
PathIsRelativeW
PathStripToRootW
PathIsUNCW
PathIsRootW

Sections

.text
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 984B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

�F
Size: 512B - Virtual size: 198B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f4369fe6edb9072e57e85e59e525feb3

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

msvcrt

ntdll

advapi32

ole32

shlwapi

Sections

.text Size: 31KB - Virtual size: 30KB

.data Size: 512B - Virtual size: 4KB

.pdata Size: 1024B - Virtual size: 984B

.rsrc Size: 2KB - Virtual size: 1KB

�F Size: 512B - Virtual size: 198B

.text
Size: 31KB - Virtual size: 30KB

.data
Size: 512B - Virtual size: 4KB

.pdata
Size: 1024B - Virtual size: 984B

.rsrc
Size: 2KB - Virtual size: 1KB

�F
Size: 512B - Virtual size: 198B