efc41435dd4b97639b903e7cf4487bb10c0d77c3c7a19fd09188927cf44674ebN

Sharing

Copy URL

Twitter E-mail

General

Target

efc41435dd4b97639b903e7cf4487bb10c0d77c3c7a19fd09188927cf44674ebN
Size

660KB
MD5

3d1799c91f1e4b73c590351a7feb98c0
SHA1

6eea579e97b4a4999f2054c1becb27d58a7e61a4
SHA256

efc41435dd4b97639b903e7cf4487bb10c0d77c3c7a19fd09188927cf44674eb
SHA512

423da7d6625e8db28c2e15f6549461e692a5ad3eeca5d768395f05787c34c3c361ba1782263e93ef833395172ef99e5614400343d868969914f9cddad4e38d68
SSDEEP

12288:EGBuzeGjS4QIPsuuOron7WLD5/wGiNpCMkAuPA2LcP:EqGjLZXcnzGc/22

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
efc41435dd4b97639b903e7cf4487bb10c0d77c3c7a19fd09188927cf44674ebN

Files

efc41435dd4b97639b903e7cf4487bb10c0d77c3c7a19fd09188927cf44674ebN
.exe windows:6 windows x64 arch:x64

34af71f87f9af4c9cf96d0df9a49961c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

GetCurrentProcessId
GetCurrentThreadId
GetModuleHandleW
GetSystemTimeAsFileTime
GetTickCount
InitializeSListHead
IsDebuggerPresent
IsProcessorFeaturePresent
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetUnhandledExceptionFilter
UnhandledExceptionFilter

msvcp140

??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0_Lockit@std@@QEAA@H@Z
??0ios_base@std@@IEAA@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1_Lockit@std@@QEAA@XZ
??1ios_base@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Getcat@?$ctype@_W@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Id_cnt@id@locale@std@@0HA
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Osfx@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAXXZ
?_Throw_Cpp_error@std@@YAXH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Xout_of_range@std@@YAXPEBD@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?clear@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEAAXH_N@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?fail@ios_base@std@@QEBA_NXZ
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADXZ
?flags@ios_base@std@@QEBAHXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?flush@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?getloc@ios_base@std@@QEBA?AVlocale@2@XZ
?good@ios_base@std@@QEBA_NXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?id@?$ctype@_W@std@@2V0locale@2@A
?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IEAAXPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?put@?$basic_ostream@_WU?$char_traits@_W@std@@@std@@QEAAAEAV12@_W@Z
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputc@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@QEAAG_W@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBAPEAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?uncaught_exception@std@@YA_NXZ
?wcout@std@@3V?$basic_ostream@_WU?$char_traits@_W@std@@@1@A
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?widen@?$basic_ios@_WU?$char_traits@_W@std@@@std@@QEBA_WD@Z
?width@ios_base@std@@QEAA_J_J@Z
?width@ios_base@std@@QEBA_JXZ
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
_Cnd_do_broadcast_at_thread_exit
_Thrd_detach

vcruntime140

_CxxThrowException
__C_specific_handler
__CxxFrameHandler3
__current_exception
__current_exception_context
__std_exception_copy
__std_exception_destroy
__std_terminate
_purecall
memchr
memcmp
memcpy
memmove
memset
strstr

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
__p__commode
__stdio_common_vfprintf
__stdio_common_vsprintf
_fseeki64
_get_stream_buffer_pointers
_set_fmode
fclose
fflush
fgetc
fgetpos
fputc
fread
freopen_s
fsetpos
fwrite
getchar
setvbuf
ungetc

api-ms-win-crt-runtime-l1-1-0

__p___argc
__p___argv
_beginthreadex
_c_exit
_cexit
_configure_narrow_argv
_crt_atexit
_exit
_get_initial_narrow_environment
_initialize_narrow_environment
_initialize_onexit_table
_initterm
_initterm_e
_invalid_parameter_noinfo_noreturn
_register_onexit_function
_register_thread_local_exe_atexit_callback
_seh_filter_exe
_set_app_type
exit
system
terminate

api-ms-win-crt-filesystem-l1-1-0

_lock_file
_unlock_file
_wchdir

api-ms-win-crt-string-l1-1-0

_strdup
_stricmp
_wcsicmp
strcmp
strlen
tolower
wcscmp
wcscpy
wcslen

api-ms-win-crt-heap-l1-1-0

_callnewh
_set_new_mode
free
malloc

api-ms-win-crt-convert-l1-1-0

wcstombs

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Exports

Exports

MD5Final
MD5Init
MD5Transform
MD5Update
add_auto_stkpnt
add_base_tils
add_byte
add_cref
add_dref
add_dword
add_encoding
add_entry
add_enum
add_enum_member
add_frame
add_func_ex
add_hidden_range
add_idc_class
add_idc_func
add_idc_gvar
add_mapping
add_qword
add_refinfo_dref
add_regarg
add_regvar
add_segm
add_segm_ex
add_segment_translation
add_sourcefile
add_spaces
add_stkvar
add_struc
add_struc_member
add_til
add_tryblk
add_undo_record
add_user_stkpnt
add_word
aes_decrypt_cbc
aes_setkey_dec
align_down_to_stack
align_up_to_stack
alloc_type_ordinals
allocate_selector
append_abi_opts
append_argloc
append_cmt
append_disp
append_func_tail
append_notification_point
append_snprintf
append_struct_fields
append_tinfo_covered
append_to_flowchart
apply_callee_tinfo
apply_cdecl
apply_fixup
apply_idasgn_to
apply_metadata
apply_named_type
apply_once_tinfo_and_name
apply_startup_sig
apply_tinfo
apply_tinfo_to_stkarg
asctoreal
ash
atob32
atob64
atoea
atos
attach_custom_data_format
auto_apply_tail
auto_apply_type
auto_cancel
auto_get
auto_is_ok
auto_make_step
auto_mark_range
auto_recreate_insn
auto_unmark
auto_wait
auto_wait_range
b2a32
b2a64
b2a_width
back_char
backup_metadata
base2file
base64_decode
base64_encode
basic_parser_parse
batch
begin_type_updating
bf_decrypt_cbc
bf_decrypt_ecb
bf_set_key
bin_search
bin_search2
bin_search3
bitcount
bitrange_t_extract_using_bitrange
bitrange_t_inject_using_bitrange
bookmarks_t_erase
bookmarks_t_find_index
bookmarks_t_get
bookmarks_t_get_desc
bookmarks_t_get_dirtree_id
bookmarks_t_mark
bookmarks_t_set_desc
bookmarks_t_size
borrow_license
btoa128
btoa32
btoa64
btoa_width
build_anon_type_name
build_loaders_list
build_snapshot_tree
build_stkvar_name
build_stkvar_xrefs
build_strlist
calc_bg_color
calc_c_cpp_name
calc_crc32
calc_dataseg
calc_def_align
calc_default_sizeof_ldbl
calc_file_crc32
calc_fixup_size
calc_func_metadata
calc_func_size
calc_idasgn_state
calc_max_align
calc_max_item_end
calc_min_align
calc_number_of_children
calc_offset_base
calc_prefix_color
calc_probable_base_by_value
calc_reference_data
calc_stkvar_struc_offset
calc_switch_cases
calc_thunk_func_target
calc_tinfo_gaps
call_idc_func
call_system
callui
can_be_off32
can_define_item
cancel_undo_point
cfg_get_cc_parm
cfgopt_t__apply
cfgopt_t__apply2
cfgopt_t__apply3
change_codepage
change_segment_status
change_storage_type
check_flat_jump_table
check_for_table_jump
check_process_exit
check_spoiled_jpt
choose_ioport_device
choose_ioport_device2
choose_local_tinfo
choose_local_tinfo_and_delta
choose_named_type
chunk_size
chunk_start
cleanup_appcall
cleanup_argloc
cleanup_name
clear_strlist
clear_tinfo_t
cliopts_t_add
cliopts_t_apply
cliopts_t_find_long
cliopts_t_find_short
cliopts_t_usage
close_ids_file
close_linput
closing_comment
clr_abits
clr_lzero
clr_module_data
clr_node_info
clr_op_type
code_highlight_block
combine_regs_jpt
compact_numbered_types
compact_til
compare_arglocs
compare_bpt_locs
compare_tinfo
compile_idc_file
compile_idc_snippet
compile_idc_text
construct_macro
construct_macro2
convert_encoding
copy_argloc
copy_debug_event
copy_idcv
copy_named_type
copy_sreg_ranges
copy_tinfo_t
create_16bit_data
create_32bit_data
create_align
create_byfunc_merge_handler
create_bytearray_linput
create_data
create_dirtree
create_encoding_helper
create_filename_cmt
create_generic_linput
create_hit_counter
create_idcv_ref
create_insn
create_lexer
create_memory_linput
create_moddata_diff_source
create_moddata_merge_handler
create_multirange_qflow_chart
create_nodeval_diff_source
create_nodeval_merge_handler
create_nodeval_merge_handlers
create_numbered_type_name
create_outctx
create_qflow_chart
create_simple_diff_handler
create_simple_idb_diff_handler
create_strlit
create_switch_table
create_switch_xrefs
create_tinfo
create_undo_point
create_xrefs_from
create_zip_linput
dbg
dbg_appcall
dbg_get_input_path
debug
decode_insn
decode_preceding_insn
decode_prev_insn
decorate_name
deep_copy_idcv
define_stkvar
del_aflags
del_cref
del_debug_names
del_dref
del_encoding
del_enum
del_enum_id
del_enum_member
del_extra_cmt
del_fixup
del_frame
del_func
del_hidden_range
del_idasgn
del_idc_func
del_idcv_attr
del_item_color
del_items
del_jumptable_info
del_mapping
del_member_tinfo
del_named_type
del_node_info
del_numbered_type
del_qatexit
del_refinfo
del_regvar
del_segm
del_segment_translations
del_selector
del_source_linnum
del_sourcefile
del_sreg_range
del_stkpnt
del_str_type
del_stroff_path
del_struc
del_struc_member
del_struc_members
del_switch_info
del_til
del_tinfo_attr
del_tryblks
del_value
del_wide_value
delete_all_xrefs_from
delete_dirtree
delete_extra_cmts
delete_imports
delete_switch_table
delete_unreferenced_stkvars
delete_wrong_frame_info
delete_wrong_stkvar_ops
delinf
demangle
demangle_name
deref_idcv
deref_ptr
deserialize_dynamic_register_set
deserialize_tinfo
destroy_lexer
destroy_moddata_merge_handlers
detach_custom_data_format
determine_rtl
diff_metadata
diff_source_merge_region
dirtree_change_rank
dirtree_chdir
dirtree_errstr
dirtree_find_entry
dirtree_findfirst
dirtree_findnext
dirtree_get_abspath_by_cursor
dirtree_get_abspath_by_relpath
dirtree_get_dir_size
dirtree_get_entry_attrs
dirtree_get_entry_name
dirtree_get_id
dirtree_get_nodename
dirtree_get_parent_cursor
dirtree_get_rank
dirtree_getcwd
dirtree_link
dirtree_link_inode
dirtree_mkdir
dirtree_rename
dirtree_resolve_cursor
dirtree_resolve_path
dirtree_rmdir
dirtree_set_id
dirtree_set_nodename
dirtree_traverse
disable_flags
display_gdl
dstr_tinfo
dto_copy_from_inf
dto_copy_to_inf
dto_init
dummy_name_ea
dump_func_type_data
ea2node
ea2str
eadd
echsize
eclose
ecmp
ecreate
ediv
eetol
eetol64
eetol64u
eldexp
eltoe
eltoe64
eltoe64u
emdnorm
emovi
emovo
emul
enable_auto
enable_flags
enable_numbered_types
end_type_updating
enum_decode
enum_encode
enum_import_names
enumerate_files
enumerate_files2
enumerate_segments_with_selector
enumerate_selectors
enumplace_t__adjust
enumplace_t__beginning
enumplace_t__clone
enumplace_t__compare
enumplace_t__compare2
enumplace_t__copyfrom
enumplace_t__deserialize
enumplace_t__ending
enumplace_t__enter
enumplace_t__generate
enumplace_t__id
enumplace_t__leave
enumplace_t__makeplace
enumplace_t__name
enumplace_t__next
enumplace_t__prev
enumplace_t__print
enumplace_t__rebase
enumplace_t__serialize
enumplace_t__toea
enumplace_t__touval
equal_bytes
eread
errorexit
eseek
eshift
eval_expr
eval_expr_long
eval_idc_expr
eval_idc_snippet
ewrite
exec_system_script
expand_struc
extend_sign
extract_argloc
extract_extra_cmts_from_metadata
extract_frame_desc_from_metadata
extract_insn_cmts_from_metadata
extract_insn_opreprs_from_metadata
extract_module_from_archive
extract_name
extract_type_from_metadata
extract_user_stkpnts_from_metadata
fc_calc_block_type
file2base
find_binary
find_byte
find_byter
find_code
find_custom_data_format
find_custom_data_type
find_custom_fixup
find_custom_refinfo
find_data
find_defined
find_defjump_from_table
find_error
find_extlang
find_free_selector
find_func_bounds
find_idc_class
find_idc_func
find_idc_gvar
find_imm
find_ioport
find_ioport_bit
find_jtable_size
find_not_func
find_notype
find_plugin
find_reg_access
find_regvar
find_selector
find_srclang_parser
find_suspop
find_syseh
find_text
find_tinfo_udt_member
find_unknown
first_idcv_attr
first_named_type
flush_buffers
fopenA
fopenM
fopenRB
fopenRT
fopenWB
fopenWT
for_all_arglocs
for_all_enum_members
for_all_extlangs
for_all_srclang_parsers
forget_problem
format_c_number
format_cdata
format_charlit
freadbytes
free_chunk
free_debug_event
free_dll
free_idasgn
free_idcv
free_loaders_list
free_regarg
free_regvar
free_til
func_does_return
func_has_stkframe_hole
func_item_iterator_decode_preceding_insn
func_item_iterator_decode_prev_insn
func_item_iterator_next
func_item_iterator_prev
func_item_iterator_succ
func_parent_iterator_set
func_tail_iterator_set
func_tail_iterator_set_ea
fwritebytes
gen_complex_call_chart
gen_decorate_name
gen_exe_file
gen_file
gen_fix_fixups

Sections

.text
Size: 573KB - Virtual size: 572KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 77KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 23KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 56B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.voltbl
Size: 512B - Virtual size: 93B

.rsrc
Size: 512B - Virtual size: 16B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 224B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

34af71f87f9af4c9cf96d0df9a49961c

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcp140

vcruntime140

vcruntime140_1

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Exports

Exports

Sections

.text Size: 573KB - Virtual size: 572KB

.rdata Size: 77KB - Virtual size: 76KB

.data Size: 1KB - Virtual size: 23KB

.pdata Size: 5KB - Virtual size: 5KB

.00cfg Size: 512B - Virtual size: 56B

.voltbl Size: 512B - Virtual size: 93B

.rsrc Size: 512B - Virtual size: 16B

.reloc Size: 512B - Virtual size: 224B

.text
Size: 573KB - Virtual size: 572KB

.rdata
Size: 77KB - Virtual size: 76KB

.data
Size: 1KB - Virtual size: 23KB

.pdata
Size: 5KB - Virtual size: 5KB

.00cfg
Size: 512B - Virtual size: 56B

.voltbl
Size: 512B - Virtual size: 93B

.rsrc
Size: 512B - Virtual size: 16B

.reloc
Size: 512B - Virtual size: 224B