790fb3bd6f65115b7d73c49ea7ab030ed493f87a95706d2827f9965d2e622981

Sharing

Copy URL Twitter E-mail

General

Target

790fb3bd6f65115b7d73c49ea7ab030ed493f87a95706d2827f9965d2e622981
Size

1.5MB
MD5

ed12962f4d1c8a5b3c142783316b724d
SHA1

1dd3aea5c36a6d54955e5f58ff42fa4abc9f17a8
SHA256

790fb3bd6f65115b7d73c49ea7ab030ed493f87a95706d2827f9965d2e622981
SHA512

e6f13f8893be23f6dbe791ab96cfa2f4c715062e63ded90372c5d15a50db40627ddca93cf1bbb7fbfc99189298c1e27ecb641382884e543733db4944ba66ed5b
SSDEEP

24576:X6aZQCrdB81/qmhB1XelfIjH2ZtVTkBcXE:X6aZQC81CwB1CfIQtVkAE

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
790fb3bd6f65115b7d73c49ea7ab030ed493f87a95706d2827f9965d2e622981

Files

790fb3bd6f65115b7d73c49ea7ab030ed493f87a95706d2827f9965d2e622981
.exe windows:6 windows x64 arch:x64

667104a518760a4db05b476ebdd65113

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\Ben_CodeBase\ASUS_CodeBase\#ASUS_USB_CodeBase_35601\ELANFPService\x64\Release\ELANFPService.pdb

Imports

kernel32

FindNextFileW
DeviceIoControl
RemoveDirectoryW
GetUserDefaultUILanguage
FindClose
CreateFileW
MultiByteToWideChar
DeleteFileW
LoadLibraryW
GetProcAddress
FindFirstFileW
GetModuleFileNameW
IsDebuggerPresent
EnterCriticalSection
LeaveCriticalSection
WriteConsoleW
GetConsoleMode
GetConsoleCP
FlushFileBuffers
WTSGetActiveConsoleSessionId
FindResourceW
LoadResource
ResetEvent
FindResourceExW
LockResource
SetEvent
GetTickCount64
Sleep
CreateEventW
QueueUserWorkItem
OpenEventW
WaitForSingleObject
TerminateProcess
GetCurrentProcess
SetLastError
SizeofResource
GetProcessHeap
DeleteCriticalSection
HeapDestroy
GetLocalTime
HeapAlloc
RaiseException
CloseHandle
HeapReAlloc
OutputDebugStringW
GetLastError
HeapSize
InitializeCriticalSectionEx
GetModuleHandleW
HeapFree
SetFilePointerEx
GetFileSizeEx
GetStringTypeW
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
WideCharToMultiByte
GetCPInfo
GetOEMCP
GetACP
IsValidCodePage
FindFirstFileExW
LCMapStringW
CompareStringW
GetFileType
GetCommandLineW
InitializeCriticalSectionAndSpinCount
WaitForSingleObjectEx
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetStartupInfoW
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
RtlUnwindEx
RtlPcToFileHeader
EncodePointer
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
ExitProcess
GetModuleHandleExW
GetStdHandle
WriteFile
GetCommandLineA

user32

RegisterPowerSettingNotification
wsprintfW
LoadStringW

advapi32

CreateServiceW
QueryServiceStatus
CloseServiceHandle
OpenSCManagerW
DeleteService
ControlService
OpenServiceW
RegisterServiceCtrlHandlerExW
SetSecurityDescriptorDacl
SetServiceStatus
RegSetValueExW
InitializeSecurityDescriptor
StartServiceCtrlDispatcherW
RegQueryValueExW
RegCloseKey
RegQueryInfoKeyW
AllocateAndInitializeSid
SetEntriesInAclW
RegCreateKeyExW
RegEnumKeyExW
RegDeleteTreeW
RegOpenKeyExW
RegDeleteValueW
RegEnumValueW

shell32

ShellExecuteW

winbio

WinBioLockUnit
WinBioFree
WinBioUnlockUnit
WinBioEnumEnrollments
WinBioOpenSession
WinBioCloseSession
WinBioEnumBiometricUnits

setupapi

SetupDiEnumDeviceInfo
SetupDiDestroyDeviceInfoList
SetupDiGetDeviceRegistryPropertyW
SetupDiGetClassDevsW

Sections

.text
Size: 107KB - Virtual size: 106KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 63KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 3KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

667104a518760a4db05b476ebdd65113

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shell32

winbio

setupapi

Sections

.text Size: 107KB - Virtual size: 106KB

.rdata Size: 63KB - Virtual size: 63KB

.data Size: 3KB - Virtual size: 8KB

.pdata Size: 6KB - Virtual size: 6KB

.rsrc Size: 12KB - Virtual size: 11KB

.reloc Size: 1.3MB - Virtual size: 1.3MB

.text
Size: 107KB - Virtual size: 106KB

.rdata
Size: 63KB - Virtual size: 63KB

.data
Size: 3KB - Virtual size: 8KB

.pdata
Size: 6KB - Virtual size: 6KB

.rsrc
Size: 12KB - Virtual size: 11KB

.reloc
Size: 1.3MB - Virtual size: 1.3MB