9c8c36e23be28b046ed7c330a9fd67aafed1a17bc4bdcad3f6ec585d712b9492N

Sharing

Copy URL Twitter E-mail

General

Target

9c8c36e23be28b046ed7c330a9fd67aafed1a17bc4bdcad3f6ec585d712b9492N
Size

92KB
MD5

14a1dd129574f04621aa7a16834031c0
SHA1

5c817a0b8d364d08c6333a66941fc237b3780bb8
SHA256

9c8c36e23be28b046ed7c330a9fd67aafed1a17bc4bdcad3f6ec585d712b9492
SHA512

fd7eb8349547b058e2da0963109a158851e86216b585dfea7ea67820aab77133939cdee77c4e79184254435ff6e27ffa43445352058f42bc4aef51c6bcb6197b
SSDEEP

1536:2hSc2n9eCsu8ys3YaSyaNYcKSaDKH+53sz9MfN42W6i2lDut1tfVT0:2hSc2n9eCsu8y+St+cKSaDKeNsz9MfNj

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9c8c36e23be28b046ed7c330a9fd67aafed1a17bc4bdcad3f6ec585d712b9492N

Files

9c8c36e23be28b046ed7c330a9fd67aafed1a17bc4bdcad3f6ec585d712b9492N
.exe windows:5 windows x86 arch:x86

edb346b91f1f48789eec550c5c7d8e51

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE

PDB Paths

mqdssvc.pdb

Imports

msvcrt

wcsncmp
_getche
free
malloc
wcscmp
wcscpy
_resetstkoflw
printf
__CxxFrameHandler
?what@exception@@UBEPBDXZ
_purecall
_controlfp
?terminate@@YAXXZ
_onexit
__dllonexit
??1type_info@@UAE@XZ
__set_app_type
__p__fmode
__p__commode
_adjust_fdiv
__setusermatherr
_initterm
__wgetmainargs
__winitenv
_cexit
_XcptFilter
_exit
_c_exit
_except_handler3
rand
??1exception@@UAE@XZ
??0exception@@QAE@XZ
_vsnwprintf
_wcsicmp
memmove
exit
_CxxThrowException
??0exception@@QAE@ABV0@@Z
wcslen

advapi32

TraceEvent
StartServiceCtrlDispatcherW
RegisterServiceCtrlHandlerW
SetServiceStatus
RegOpenKeyExW
RegEnumValueW
TraceMessage
UnregisterTraceGuids
RegisterTraceGuidsW
GetTraceLoggerHandle
GetTraceEnableLevel
GetTraceEnableFlags
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegCreateKeyExW
RegSetValueExW
RegCloseKey
RegQueryValueExW
RegDeleteValueW
RegisterEventSourceW
ReportEventW

kernel32

LeaveCriticalSection
DeleteCriticalSection
InterlockedIncrement
InitializeCriticalSection
ExitProcess
FreeLibrary
GetProcAddress
LoadLibraryW
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
SetUnhandledExceptionFilter
EnterCriticalSection
LocalFree
GetLastError
ExpandEnvironmentStringsW
CloseHandle
CreateThread
Sleep
GetModuleFileNameW
QueryPerformanceCounter
GetTickCount
GetCurrentThreadId
GetCurrentProcessId

ws2_32

sendto
select
__WSAFDIsSet
recvfrom
socket
setsockopt
WSAGetLastError
inet_ntoa
htons
bind
closesocket
gethostbyname

user32

LoadStringW

ole32

CoInitializeEx
CoCreateInstance
CoUninitialize

mqdssrv

DSCreateServersCache
DSLookupEnd
DSLookupNext
DSLookupBegin
DSGetObjectPropertiesGuid
DSExSetTimer
DSTerminate
DSServerInit
DSIsWeakenSecurity
DSSetObjectPropertiesGuid
DSRelaxSecurity

mqsec

MQSec_IsDC
??1CRestriction@@QAE@XZ
??1CColumns@@QAE@XZ
?Add@CColumns@@QAEXABK@Z
??0CColumns@@QAE@I@Z
?AddRestriction@CRestriction@@QAEXPAU_GUID@@KK@Z
?AddRestriction@CRestriction@@QAEXKKK@Z
??0CRestriction@@QAE@I@Z
MQSec_IsSystemSid
MQSec_GetProcessSid
?DeleteFalconKeyValue@@YGJPBG@Z
SetFalconKeyValue
?GetComputerDnsNameInternal@@YGJPAGPAK@Z
?GetComputerNameInternal@@YGJPAGPAK@Z
GetFalconKeyValue
MQSec_CanGenerateAudit

mqutil

MQGetResourceHandle

msvcp60

??0bad_alloc@std@@QAE@PBD@Z
??1bad_alloc@std@@UAE@XZ
??0bad_alloc@std@@QAE@ABV01@@Z

netapi32

DsGetDcNameW
NetApiBufferFree

ntdll

RtlImageNtHeader
RtlFreeHeap
RtlAllocateHeap

oleaut32

SysFreeString
SysAllocString

Sections

.text
Size: 62KB - Virtual size: 62KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 27KB - Virtual size: 29KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

edb346b91f1f48789eec550c5c7d8e51

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

advapi32

kernel32

ws2_32

user32

ole32

mqdssrv

mqsec

mqutil

msvcp60

netapi32

ntdll

oleaut32

Sections

.text Size: 62KB - Virtual size: 62KB

.data Size: 1KB - Virtual size: 2KB

.rsrc Size: 27KB - Virtual size: 29KB

.text
Size: 62KB - Virtual size: 62KB

.data
Size: 1KB - Virtual size: 2KB

.rsrc
Size: 27KB - Virtual size: 29KB