c2aa78dbda2c24a9264132a487577cb79e741095c4bff13f5eb5bfdf71659d64

Sharing

Copy URL Twitter E-mail

General

Target

c2aa78dbda2c24a9264132a487577cb79e741095c4bff13f5eb5bfdf71659d64
Size

59KB
MD5

ec0a8c1dab7f0ebb72155f5577743da6
SHA1

2be944a89a88a6baca40a6b8361d5a387c2fa1fa
SHA256

c2aa78dbda2c24a9264132a487577cb79e741095c4bff13f5eb5bfdf71659d64
SHA512

a4072bd5bd70e0371cd94b98617446e80d95598c67501567f6507a92972dd91a17c1b1636954f477f2b3ed9aeeb42575868e5699b4a6eaaa2ad5d19df2b75f44
SSDEEP

768:sSg1YTpbKkmj6u79BfG//GCr/20d0iNAH5xs7EwOJZHt7lSDkHm:sSg2N2Xjz7XfG2QU1Ds7EwCZHpO

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c2aa78dbda2c24a9264132a487577cb79e741095c4bff13f5eb5bfdf71659d64

Files

c2aa78dbda2c24a9264132a487577cb79e741095c4bff13f5eb5bfdf71659d64
.exe windows:6 windows x64 arch:x64

2d7a5ae96aea3a4fc6faaf2ca00dbd18

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

Unlocker_276.pdb

Imports

kernel32

WriteProcessMemory
GetConsoleScreenBufferInfo
SetLastError
SetPriorityClass
VirtualFree
GetCommandLineW
SetConsoleTitleA
SetConsoleScreenBufferSize
GetStdHandle
WriteFile
VirtualAlloc
TerminateProcess
WaitForSingleObject
CreateFileW
GetFileAttributesW
OpenProcess
CreateToolhelp32Snapshot
Sleep
FormatMessageW
GetLastError
Process32NextW
DeleteFileW
Process32FirstW
CloseHandle
CreateThread
Module32FirstW
VirtualAllocEx
LocalFree
GetFileSize
ReadProcessMemory
GetCurrentProcessId
CreateProcessW
GetConsoleWindow
CreateRemoteThread
Module32NextW
QueryFullProcessImageNameW
GetExitCodeProcess
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
RtlCaptureContext
GetCurrentProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetModuleHandleW
QueryPerformanceCounter
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead

user32

GetForegroundWindow
MessageBoxW
MessageBoxA
GetKeyState
GetAsyncKeyState

shell32

CommandLineToArgvW

msvcp140

?_Xout_of_range@std@@YAXPEBD@Z
?_Xlength_error@std@@YAXPEBD@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memset
__current_exception_context
__current_exception
_CxxThrowException
__C_specific_handler
memmove
wcschr
__std_exception_copy
__std_exception_destroy
memcpy

api-ms-win-crt-stdio-l1-1-0

_wfopen
fclose
__stdio_common_vfprintf_s
__acrt_iob_func
__stdio_common_vfwprintf_s
fgets
__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale
setlocale

api-ms-win-crt-heap-l1-1-0

_callnewh
malloc
_set_new_mode
free

api-ms-win-crt-convert-l1-1-0

strtoul
wcstol

api-ms-win-crt-string-l1-1-0

isspace
towlower

api-ms-win-crt-runtime-l1-1-0

_initterm
_initterm_e
exit
_exit
_get_initial_narrow_environment
__p___argc
__p___argv
_set_app_type
_crt_atexit
_seh_filter_exe
_invalid_parameter_noinfo_noreturn
terminate
_cexit
_register_onexit_function
_configure_narrow_argv
_initialize_narrow_environment
_c_exit
system
_initialize_onexit_table
_register_thread_local_exe_atexit_callback

api-ms-win-crt-math-l1-1-0

__setusermatherr

Sections

.text
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 18KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 488B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

2d7a5ae96aea3a4fc6faaf2ca00dbd18

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

shell32

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

Sections

.text Size: 37KB - Virtual size: 36KB

.rdata Size: 18KB - Virtual size: 17KB

.data Size: 512B - Virtual size: 1KB

.pdata Size: 2KB - Virtual size: 1KB

.rsrc Size: 512B - Virtual size: 488B

.reloc Size: 512B - Virtual size: 104B

.text
Size: 37KB - Virtual size: 36KB

.rdata
Size: 18KB - Virtual size: 17KB

.data
Size: 512B - Virtual size: 1KB

.pdata
Size: 2KB - Virtual size: 1KB

.rsrc
Size: 512B - Virtual size: 488B

.reloc
Size: 512B - Virtual size: 104B