868b9565d481e40fd4f945f963b1f6a280a4195ac37f74a8f7e02af9ba6483c3

Sharing

Copy URL Twitter E-mail

General

Target

868b9565d481e40fd4f945f963b1f6a280a4195ac37f74a8f7e02af9ba6483c3
Size

2.3MB
MD5

883c21a620d24f73258e96d4cc588124
SHA1

4e80032edd607c64480e7ea966d1d0f199170f16
SHA256

868b9565d481e40fd4f945f963b1f6a280a4195ac37f74a8f7e02af9ba6483c3
SHA512

a04b8095c0c642b9ef3e65112437e9bc7b46e087cc1ed87077dc8b30887478360e8fe95078f4a4b0cdee231eff3e6fef810d6cf83aac044d680fcde5f5369584
SSDEEP

49152:LNe30jaNf1TWbdzSe30jaNf1TWbdzze30jaNf1TWbdz:LNU023WQU023WZU023W

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
868b9565d481e40fd4f945f963b1f6a280a4195ac37f74a8f7e02af9ba6483c3

Files

868b9565d481e40fd4f945f963b1f6a280a4195ac37f74a8f7e02af9ba6483c3
.exe windows:5 windows x64 arch:x64

7844d97128a514140775bf591553dcd8

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

aspnet_regiis.pdb

Imports

msvcr80

_decode_pointer
_onexit
_lock
__dllonexit
_unlock
?terminate@@YAXXZ
__set_app_type
_encode_pointer
_fmode
_commode
__setusermatherr
_configthreadlocale
_initterm_e
_initterm
_wcsicmp
__winitenv
exit
_cexit
_exit
_XcptFilter
__C_specific_handler
__wgetmainargs
_amsg_exit
wcstok
memcpy
_wtoi
_vsnwprintf_s
__crt_debugger_hook

advapi32

RegQueryValueExW
RegCloseKey
RegOpenKeyExW

kernel32

HeapSize
GetProcAddress
LoadLibraryW
GetSystemDirectoryW
GetVersionExW
RtlZeroMemory
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
HeapReAlloc
UnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
GetSystemTimeAsFileTime
GetCurrentProcessId
GetCurrentThreadId
GetTickCount
QueryPerformanceCounter
SetUnhandledExceptionFilter
GetStdHandle
GetConsoleScreenBufferInfo
LocalAlloc
HeapFree
HeapAlloc
IsDebuggerPresent
lstrlenW
ExitThread
Sleep
CreateThread
LocalFree
CloseHandle
WaitForSingleObject
FreeLibrary
FormatMessageW
GetLastError

ole32

CoUninitialize
CoInitializeEx

webengine

RunAspnetCA
LoadResourceString
RegisterScriptMapsOnVista
DetectErrorAndGetLogfileName
ListAspnetInstalledIISKeys
ListAspnetInstalledVersions
PrintResourceStringNoNewLine
ValidateIISPath
RunPkgmgr
GetExistingVersion
GrantAccessToUserAccount
RegisterAspNetEx
UnregisterAspNet
RemoveClientScriptFiles
CopyClientScriptFiles
PrintStringToStdOut
CallManagedProtectedConfigAction
IsVista
PrintResourceString
SetRemoteConfigDCOMRegKeys
AspnetLoadResourceDLL
CheckIISState
RunningOn64Bit
RemoveAspnetFromIISKey
IsMatchingBitness
GrantAccessToUserAccountOnVista
IsRegisteredInProc
GetXSPHeap

ntdll

RtlCopyMemory

Sections

.text
Size: 31KB - Virtual size: 30KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2.3MB - Virtual size: 2.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

7844d97128a514140775bf591553dcd8

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcr80

advapi32

kernel32

ole32

webengine

ntdll

Sections

.text Size: 31KB - Virtual size: 30KB

.data Size: 2KB - Virtual size: 16KB

.pdata Size: 1KB - Virtual size: 1KB

.rsrc Size: 2.3MB - Virtual size: 2.3MB

.text
Size: 31KB - Virtual size: 30KB

.data
Size: 2KB - Virtual size: 16KB

.pdata
Size: 1KB - Virtual size: 1KB

.rsrc
Size: 2.3MB - Virtual size: 2.3MB