6c9ef9f3165aeb5c0925cb0ec9be94cd40ca70045b8f27d7f83a86ebeb7ef46eN

Sharing

Copy URL Twitter E-mail

General

Target

6c9ef9f3165aeb5c0925cb0ec9be94cd40ca70045b8f27d7f83a86ebeb7ef46eN
Size

35KB
MD5

18dbff8a7d8e7a34bbaaf0fd8f00a080
SHA1

80c6625866e411a2517902f7d3bee700da83dd23
SHA256

6c9ef9f3165aeb5c0925cb0ec9be94cd40ca70045b8f27d7f83a86ebeb7ef46e
SHA512

c890adb8685935e4f39b8fd0647267fa7466f59ae37fd58f8c89963e2c50461f9a61c6c8783e8fe34f64d51876b6b794ebdd7a45ce8f5dac4c81d44f7d8f9760
SSDEEP

768:XH0Dbmx7aF66Tte7fqARzisKl4qJzisKl4qJsisKl4qJ:XzNyt2fPRzisKldJzisKldJsisKldJ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6c9ef9f3165aeb5c0925cb0ec9be94cd40ca70045b8f27d7f83a86ebeb7ef46eN

Files

6c9ef9f3165aeb5c0925cb0ec9be94cd40ca70045b8f27d7f83a86ebeb7ef46eN
.exe windows:6 windows x64 arch:x64

9c8673e3f4667c3604764e239a746b87

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

secinit.pdb

Imports

advapi32

CloseServiceHandle
OpenProcessToken
OpenSCManagerW
OpenServiceW
RegCreateKeyExW
LookupPrivilegeValueW
QueryServiceStatus
RegOpenKeyExW
AdjustTokenPrivileges
RegLoadKeyW
RegCloseKey
RegSetValueExW
RegUnLoadKeyW
RegQueryValueExW

kernel32

LoadLibraryExW
GetCurrentProcess
WaitForSingleObject
GetTickCount
Sleep
lstrlenW
GetLastError
GetProcAddress
OpenEventW
CloseHandle
TerminateProcess
GetSystemTimeAsFileTime
UnhandledExceptionFilter
GetCurrentProcessId
FreeLibrary
GetCurrentThreadId
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetModuleHandleW

user32

CharUpperW

msvcrt

_amsg_exit
__setusermatherr
_commode
_fmode
__set_app_type
?terminate@@YAXXZ
_initterm
exit
_exit
_XcptFilter
__C_specific_handler
__getmainargs
srand
rand
wcschr
_cexit
_stricmp
memset

ntdll

RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
NtCreateEvent
NtOpenEvent
NtClose
RtlInitUnicodeString

netapi32

NetJoinDomain

userenv

GetDefaultUserProfileDirectoryW

Sections

.text
Size: 12KB - Virtual size: 11KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 512B - Virtual size: 288B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

�,
Size: 512B - Virtual size: 84B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

9c8673e3f4667c3604764e239a746b87

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

user32

msvcrt

ntdll

netapi32

userenv

Sections

.text Size: 12KB - Virtual size: 11KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 512B - Virtual size: 288B

.rsrc Size: 2KB - Virtual size: 1KB

�, Size: 512B - Virtual size: 84B

.text
Size: 12KB - Virtual size: 11KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 512B - Virtual size: 288B

.rsrc
Size: 2KB - Virtual size: 1KB

�,
Size: 512B - Virtual size: 84B