7be87343ffb650d0c60ea1417994c4ba6ae4ce41e6be97b1136a7e44c177dca2N

Sharing

Copy URL Twitter E-mail

General

Target

7be87343ffb650d0c60ea1417994c4ba6ae4ce41e6be97b1136a7e44c177dca2N
Size

772KB
MD5

4cf42e6cbf44571d1f5c23886ab69970
SHA1

e60f19f3d0f78a53abb0bddbcf36b14634b23020
SHA256

7be87343ffb650d0c60ea1417994c4ba6ae4ce41e6be97b1136a7e44c177dca2
SHA512

298513e6c917622d28860c05f2e14cddf5eb41bcc9748df501432354d585c8fa29def8f70ae217e5386e84853be941d98da9bd1ff8b31853d37a07c024bd7d57
SSDEEP

12288:MIVtQc1/OMTCWYPmBKAxyCcXW696VxXaG/k:MIVtQc1/OMTCPQKAMV96TaG/k

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7be87343ffb650d0c60ea1417994c4ba6ae4ce41e6be97b1136a7e44c177dca2N

Files

7be87343ffb650d0c60ea1417994c4ba6ae4ce41e6be97b1136a7e44c177dca2N
.exe windows:6 windows x64 arch:x64

75ee80b9a1651ceb478a16b008beecd8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

TfSysMon_Killer.pdb

Imports

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressAll
WaitOnAddress
WakeByAddressSingle

advapi32

StartServiceA
ControlService
CreateServiceW
OpenSCManagerW
OpenServiceA
OpenSCManagerA
OpenServiceW
CloseServiceHandle
DeleteService

kernel32

GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStdHandle
GetCurrentProcessId
HeapFree
HeapReAlloc
lstrlenW
ReleaseMutex
GetProcessHeap
GetCurrentProcess
GetCommandLineW
GetConsoleMode
GetEnvironmentVariableW
SetLastError
GetModuleHandleW
FormatMessageW
GetModuleFileNameW
ExitProcess
MultiByteToWideChar
WriteConsoleW
WideCharToMultiByte
CreateThread
GetModuleHandleA
GetProcAddress
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
QueryPerformanceCounter
Sleep
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
SetWaitableTimer
CreateWaitableTimerExW
GetCurrentThread
SetThreadStackGuarantee
AddVectoredExceptionHandler
GetLastError
ReleaseSemaphore
Process32Next
Process32First
CreateToolhelp32Snapshot
GetCurrentDirectoryW
SetConsoleCtrlHandler
CreateSemaphoreA
WaitForSingleObject
CloseHandle
DeviceIoControl
CreateFileW
GetCurrentThreadId
HeapAlloc
IsProcessorFeaturePresent

ntdll

RtlNtStatusToDosError
NtWriteFile

vcruntime140

__CxxFrameHandler3
memmove
_CxxThrowException
__C_specific_handler
__current_exception
__current_exception_context
memcpy
memset
memcmp

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

exit
_exit
_initterm_e
_initterm
_set_app_type
__p___argc
__p___argv
_seh_filter_exe
_c_exit
_register_thread_local_exe_atexit_callback
_get_initial_narrow_environment
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_cexit
_crt_atexit
terminate

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode

Sections

.text
Size: 598KB - Virtual size: 597KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 137KB - Virtual size: 137KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 880B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 33KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

75ee80b9a1651ceb478a16b008beecd8

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

bcryptprimitives

api-ms-win-core-synch-l1-2-0

advapi32

kernel32

ntdll

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 598KB - Virtual size: 597KB

.rdata Size: 137KB - Virtual size: 137KB

.data Size: 512B - Virtual size: 880B

.pdata Size: 33KB - Virtual size: 32KB

.reloc Size: 2KB - Virtual size: 1KB

.text
Size: 598KB - Virtual size: 597KB

.rdata
Size: 137KB - Virtual size: 137KB

.data
Size: 512B - Virtual size: 880B

.pdata
Size: 33KB - Virtual size: 32KB

.reloc
Size: 2KB - Virtual size: 1KB