b1a3ae2dbc1c5f3a3f1b7d1a79e902710995697c18ac537ec843285dd7489a5f

Sharing

Copy URL Twitter E-mail

General

Target

b1a3ae2dbc1c5f3a3f1b7d1a79e902710995697c18ac537ec843285dd7489a5f
Size

230KB
MD5

16a98dcae3a8ff4cd5713e419d4db6b7
SHA1

c3b71610d9d916d123cfe16eb1a8b17fd7ce10b9
SHA256

b1a3ae2dbc1c5f3a3f1b7d1a79e902710995697c18ac537ec843285dd7489a5f
SHA512

14a12a47716f9673154d51f0d928405255d059a10ae84e110fe13aac1504c52f0d1177d2592d27a29a9fdbcb503ba8f1f698cc853be602b92187de92f767b67d
SSDEEP

6144:8qo+IWgr1pun9lhqOUebINWVyyrjDDf0tdvb42h:bLG1puM1Iqv

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b1a3ae2dbc1c5f3a3f1b7d1a79e902710995697c18ac537ec843285dd7489a5f

Files

b1a3ae2dbc1c5f3a3f1b7d1a79e902710995697c18ac537ec843285dd7489a5f
.exe windows:6 windows x64 arch:x64

cd5e4038ab96833db36fb7d8d87d4fa0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

si_start.pdb

Imports

api-ms-win-core-synch-l1-2-0

WakeByAddressAll
WaitOnAddress
WakeByAddressSingle

bcryptprimitives

ProcessPrng

kernel32

ReleaseMutex
SetUnhandledExceptionFilter
UnhandledExceptionFilter
InitializeSListHead
GetSystemTimeAsFileTime
HeapFree
HeapReAlloc
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCurrentThread
GetCommandLineW
CloseHandle
GetLastError
GetStdHandle
GetConsoleMode
WaitForSingleObject
MultiByteToWideChar
WriteConsoleW
GetModuleHandleA
GetProcAddress
SetLastError
GetModuleHandleW
FormatMessageW
lstrlenW
GetEnvironmentVariableW
GetModuleFileNameW
CreateFileW
SetFileInformationByHandle
GetFullPathNameW
IsDebuggerPresent
GetEnvironmentStringsW
FreeEnvironmentStringsW
CompareStringOrdinal
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
GetCurrentProcess
DuplicateHandle
CreateThread
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
DeleteProcThreadAttributeList
GetCurrentProcessId
CreateNamedPipeW
WriteFileEx
SleepEx
ReadFileEx
HeapAlloc
GetProcessHeap
GetCurrentDirectoryW
RtlCaptureContext
RtlLookupFunctionEntry
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
IsProcessorFeaturePresent
RtlVirtualUnwind
WideCharToMultiByte
GetCurrentThreadId
QueryPerformanceCounter

ntdll

RtlNtStatusToDosError
NtWriteFile

vcruntime140

__current_exception_context
__CxxFrameHandler3
memcpy
memcmp
_CxxThrowException
memset
memmove
__C_specific_handler
__current_exception

api-ms-win-crt-runtime-l1-1-0

_initterm
__p___argc
__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_get_initial_narrow_environment
_initterm_e
_configure_narrow_argv
_initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
_initialize_narrow_environment
_set_app_type
exit
_seh_filter_exe
_exit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode
free

Sections

.text
Size: 170KB - Virtual size: 169KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 46KB - Virtual size: 45KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 752B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 5KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 1024B - Virtual size: 872B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

cd5e4038ab96833db36fb7d8d87d4fa0

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

ntdll

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

Sections

.text Size: 170KB - Virtual size: 169KB

.rdata Size: 46KB - Virtual size: 45KB

.data Size: 512B - Virtual size: 752B

.pdata Size: 7KB - Virtual size: 6KB

.rsrc Size: 5KB - Virtual size: 4KB

.reloc Size: 1024B - Virtual size: 872B

.text
Size: 170KB - Virtual size: 169KB

.rdata
Size: 46KB - Virtual size: 45KB

.data
Size: 512B - Virtual size: 752B

.pdata
Size: 7KB - Virtual size: 6KB

.rsrc
Size: 5KB - Virtual size: 4KB

.reloc
Size: 1024B - Virtual size: 872B