247027be62cbab4920aeb00654b9aaba95724b9866c08493c9464794d7e37a5d

Sharing

Copy URL

Twitter E-mail

General

Target

247027be62cbab4920aeb00654b9aaba95724b9866c08493c9464794d7e37a5d
Size

3.4MB
MD5

91fb049c594f8f98b5b331415e81d679
SHA1

f784ee8f566ff4bc509e16a40ad6b2994dc6478e
SHA256

247027be62cbab4920aeb00654b9aaba95724b9866c08493c9464794d7e37a5d
SHA512

2edab15ac5df46b0d578acd5bfbd2512b48743c7dec713ae9bfb5494452d8b54543c783fd2b28fb9b62a3a926e9c088b1d302f87469cbf3dd60b3076c2d4eb87
SSDEEP

49152:FNe30jaNf1TWbdzSe30jaNf1TWbdzze30jaNf1TWbdzQe30jaNf1TWbdzte30jaO:FNU023WQU023WZU023W2U023W3U023W

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
247027be62cbab4920aeb00654b9aaba95724b9866c08493c9464794d7e37a5d

Files

247027be62cbab4920aeb00654b9aaba95724b9866c08493c9464794d7e37a5d
.exe windows:5 windows x64 arch:x64

7844d97128a514140775bf591553dcd8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

aspnet_regiis.pdb

Imports

msvcr80

_decode_pointer
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__set_app_type
_encode_pointer
_fmode
_commode
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcsicmp
__winitenv
exit
_cexit
_exit
_XcptFilter
__C_specific_handler
__wgetmainargs
_amsg_exit
wcstok
memcpy
_wtoi
_vsnwprintf_s
__crt_debugger_hook

advapi32

RegQueryValueExW
RegCloseKey
RegOpenKeyExW

kernel32

HeapSize
GetProcAddress
LoadLibraryW
GetSystemDirectoryW
GetVersionExW
RtlZeroMemory
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
HeapReAlloc
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetStdHandle
GetConsoleScreenBufferInfo
LocalAlloc
HeapFree
HeapAlloc
IsDebuggerPresent
lstrlenW
ExitThread
Sleep
CreateThread
LocalFree
CloseHandle
WaitForSingleObject
FreeLibrary
FormatMessageW
GetLastError

ole32

CoUninitialize
CoInitializeEx

webengine

RunAspnetCA
LoadResourceString
RegisterScriptMapsOnVista
DetectErrorAndGetLogfileName
ListAspnetInstalledIISKeys
ListAspnetInstalledVersions
PrintResourceStringNoNewLine
ValidateIISPath
RunPkgmgr
GetExistingVersion
GrantAccessToUserAccount
RegisterAspNetEx
UnregisterAspNet
RemoveClientScriptFiles
CopyClientScriptFiles
PrintStringToStdOut
CallManagedProtectedConfigAction
IsVista
PrintResourceString
SetRemoteConfigDCOMRegKeys
AspnetLoadResourceDLL
CheckIISState
RunningOn64Bit
RemoveAspnetFromIISKey
IsMatchingBitness
GrantAccessToUserAccountOnVista
IsRegisteredInProc
GetXSPHeap

ntdll

RtlCopyMemory

Sections

.text
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 3.4MB - Virtual size: 3.4MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

7844d97128a514140775bf591553dcd8

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcr80

advapi32

kernel32

ole32

webengine

ntdll

Sections

.text Size: 31KB - Virtual size: 30KB

.data Size: 2KB - Virtual size: 16KB

.pdata Size: 1KB - Virtual size: 1KB

.rsrc Size: 3.4MB - Virtual size: 3.4MB

.text
Size: 31KB - Virtual size: 30KB

.data
Size: 2KB - Virtual size: 16KB

.pdata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 3.4MB - Virtual size: 3.4MB