96e28edb585188679a059b84f5ecc55fa0c96d2db875febb20fc77efc26d5941N

Sharing

Copy URL Twitter E-mail

General

Target

96e28edb585188679a059b84f5ecc55fa0c96d2db875febb20fc77efc26d5941N
Size

122KB
MD5

3254a99ec0e29977f0327dd350eb6b20
SHA1

a059cf7aaf5e2d5dc179d3b7377897da6b5d1473
SHA256

96e28edb585188679a059b84f5ecc55fa0c96d2db875febb20fc77efc26d5941
SHA512

eacd7d3b8b16cbe947e3cdc10b622c052a73d0dbf5a67a0046fb343e82a239ba3cf6d6dbd412be177bef8bddceb1b5784ce5ab9cc7f64a9bc9c9dde24b3b2dff
SSDEEP

3072:veH13TTT0TjTWTFTr+ToTlT7TwTuDEDvD16UNgn1SpXol0u1EPxKyedPd:v41HM31KSQR1EPQ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
96e28edb585188679a059b84f5ecc55fa0c96d2db875febb20fc77efc26d5941N

Files

96e28edb585188679a059b84f5ecc55fa0c96d2db875febb20fc77efc26d5941N
.exe windows:6 windows x86 arch:x86

4608234e0985565e6318f6ee59da1502

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

robocopy.pdb

Imports

advapi32

GetUserNameW
AdjustTokenPrivileges
LookupPrivilegeValueW
OpenProcessToken
DecryptFileW
EncryptFileW
ReadEncryptedFileRaw
GetSecurityDescriptorControl
SetNamedSecurityInfoW
GetNamedSecurityInfoW
RegCreateKeyExW
RegCloseKey
RegQueryValueExW
RegSetValueExW
RegDeleteValueW
CloseEncryptedFileRaw
WriteEncryptedFileRaw
OpenEncryptedFileRawW

kernel32

CompareStringW
lstrlenW
LocalFileTimeToFileTime
SystemTimeToFileTime
FileTimeToSystemTime
GetSystemTime
GetFullPathNameW
ExpandEnvironmentStringsW
GetLastError
GetVersion
TlsGetValue
Sleep
GetLocalTime
SetLastError
InitializeSRWLock
ReleaseSRWLockExclusive
TlsSetValue
GetCurrentThreadId
CloseHandle
OpenThread
AcquireSRWLockExclusive
CreateEventW
CreateThreadpoolCleanupGroup
SetThreadpoolThreadMaximum
CreateThreadpool
TlsAlloc
OpenProcess
GetCurrentProcessId
FindNextChangeNotification
FindCloseChangeNotification
WaitForMultipleObjects
SetWaitableTimer
CreateWaitableTimerW
FindFirstChangeNotificationW
SetFileTime
SetEvent
GetFileAttributesW
CloseThreadpoolWork
SubmitThreadpoolWork
CreateThreadpoolWork
CloseThreadpoolCleanupGroupMembers
SleepEx
WaitForSingleObjectEx
QueryPerformanceCounter
QueryPerformanceFrequency
SetErrorMode
GetModuleHandleW
HeapSetInformation
SetThreadUILanguage
GetConsoleOutputCP
WideCharToMultiByte
FormatMessageW
CompareFileTime
GetVolumeInformationW
GlobalFree
CreateFileW
GetFileInformationByHandle
DeviceIoControl
FindClose
FindFirstFileW
CreateDirectoryW
SetFileAttributesW
RemoveDirectoryW
FindNextFileW
lstrcmpW
FindFirstFileExW
lstrcmpiW
BackupWrite
BackupRead
DeleteFileW
WaitForSingleObject
LocalFree
CopyFileExW
GetFileTime
GetExitCodeThread
ExitThread
ResumeThread
SetThreadPriority
CreateThread
InterlockedExchange
InterlockedCompareExchange
SetUnhandledExceptionFilter
GetModuleHandleA
GetTickCount
GetSystemTimeAsFileTime
TerminateProcess
GetCurrentProcess
UnhandledExceptionFilter
GetConsoleMode
GetStdHandle
GetFileType
HeapValidate
GetProcessHeap
HeapAlloc
HeapSize
HeapFree
ExitProcess
WriteConsoleW
PrivCopyFileExW

mfc42u

ord927
ord2756
ord922
ord535
ord925
ord5601
ord3971
ord996
ord2606
ord1863
ord3658
ord715
ord415
ord540
ord858
ord5706
ord942
ord4199
ord1081
ord861
ord538
ord800
ord4124
ord5616
ord823
ord825
ord1184
ord6928

msvcrt

_unlock
__dllonexit
_lock
_onexit
_except_handler4_common
_controlfp
_cexit
__wgetmainargs
memcpy
_wcsnicmp
malloc
free
clock
memset
_ftol2
_ftol2_sse
fflush
__p__commode
??1type_info@@UAE@XZ
swprintf_s
??_U@YAPAXI@Z
??_V@YAXPAX@Z
printf
time
ctime
fgetws
fclose
fwprintf
__iob_func
fputws
_wfopen
_fileno
_setmode
fprintf
wprintf
__CxxFrameHandler3
_vsnwprintf
?terminate@@YAXXZ
__set_app_type
__setusermatherr
_amsg_exit
_wsetlocale
__p__fmode
_initterm
exit
_XcptFilter
fwprintf_s
_exit
_get_osfhandle
_errno

user32

LoadStringW

ws2_32

WSACleanup

ntdll

NtSetInformationProcess

Sections

.text
Size: 83KB - Virtual size: 83KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.data
Size: 512B - Virtual size: 392KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 35KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

4608234e0985565e6318f6ee59da1502

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

advapi32

kernel32

mfc42u

msvcrt

user32

ws2_32

ntdll

Sections

.text Size: 83KB - Virtual size: 83KB

.data Size: 512B - Virtual size: 392KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 35KB - Virtual size: 36KB

.text
Size: 83KB - Virtual size: 83KB

.data
Size: 512B - Virtual size: 392KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 35KB - Virtual size: 36KB