d9f094a798c10372baa447c58862d0ae85197f039a1f2edc85723fb96627b38a

Sharing

Copy URL

Twitter E-mail

General

Target

d9f094a798c10372baa447c58862d0ae85197f039a1f2edc85723fb96627b38a
Size

5.1MB
MD5

b8f62a576b958e03cd687e7ed63972b6
SHA1

7d1a4f26e8b9f7475ad7c887959947ed2d4b4dfc
SHA256

d9f094a798c10372baa447c58862d0ae85197f039a1f2edc85723fb96627b38a
SHA512

ae60890453f1f9f9bc390aaf1e4503993601e0d00a6588bc00e8bdcf4f18681749d51b643d701aad33a14564b927304f40eac0fab7f909627ab44ed26fd3bead
SSDEEP

98304:DNU023WQU023WZU023W2U023W3U023WcU023W+U023WJU023W:pp4WQp4WZp4W2p4W3p4Wcp4W+p4WJp4W

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d9f094a798c10372baa447c58862d0ae85197f039a1f2edc85723fb96627b38a

Files

d9f094a798c10372baa447c58862d0ae85197f039a1f2edc85723fb96627b38a
.exe windows:5 windows x64 arch:x64

7844d97128a514140775bf591553dcd8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

aspnet_regiis.pdb

Imports

msvcr80

_decode_pointer
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__set_app_type
_encode_pointer
_fmode
_commode
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcsicmp
__winitenv
exit
_cexit
_exit
_XcptFilter
__C_specific_handler
__wgetmainargs
_amsg_exit
wcstok
memcpy
_wtoi
_vsnwprintf_s
__crt_debugger_hook

advapi32

RegQueryValueExW
RegCloseKey
RegOpenKeyExW

kernel32

HeapSize
GetProcAddress
LoadLibraryW
GetSystemDirectoryW
GetVersionExW
RtlZeroMemory
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
HeapReAlloc
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetStdHandle
GetConsoleScreenBufferInfo
LocalAlloc
HeapFree
HeapAlloc
IsDebuggerPresent
lstrlenW
ExitThread
Sleep
CreateThread
LocalFree
CloseHandle
WaitForSingleObject
FreeLibrary
FormatMessageW
GetLastError

ole32

CoUninitialize
CoInitializeEx

webengine

RunAspnetCA
LoadResourceString
RegisterScriptMapsOnVista
DetectErrorAndGetLogfileName
ListAspnetInstalledIISKeys
ListAspnetInstalledVersions
PrintResourceStringNoNewLine
ValidateIISPath
RunPkgmgr
GetExistingVersion
GrantAccessToUserAccount
RegisterAspNetEx
UnregisterAspNet
RemoveClientScriptFiles
CopyClientScriptFiles
PrintStringToStdOut
CallManagedProtectedConfigAction
IsVista
PrintResourceString
SetRemoteConfigDCOMRegKeys
AspnetLoadResourceDLL
CheckIISState
RunningOn64Bit
RemoveAspnetFromIISKey
IsMatchingBitness
GrantAccessToUserAccountOnVista
IsRegisteredInProc
GetXSPHeap

ntdll

RtlCopyMemory

Sections

.text
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5.1MB - Virtual size: 5.1MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

7844d97128a514140775bf591553dcd8

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcr80

advapi32

kernel32

ole32

webengine

ntdll

Sections

.text Size: 31KB - Virtual size: 30KB

.data Size: 2KB - Virtual size: 16KB

.pdata Size: 1KB - Virtual size: 1KB

.rsrc Size: 5.1MB - Virtual size: 5.1MB

.text
Size: 31KB - Virtual size: 30KB

.data
Size: 2KB - Virtual size: 16KB

.pdata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 5.1MB - Virtual size: 5.1MB