c6cf98ed61b7f6295f61c9349cad7f4b04d3431a3f92a0252df7aaf154439cccN

Sharing

Copy URL Twitter E-mail

General

Target

c6cf98ed61b7f6295f61c9349cad7f4b04d3431a3f92a0252df7aaf154439cccN
Size

1.4MB
MD5

4d42a35f4404e1b2e7a6db331a4767f0
SHA1

60816057f8ee69cf0996836f74093b8d6bd8597e
SHA256

c6cf98ed61b7f6295f61c9349cad7f4b04d3431a3f92a0252df7aaf154439ccc
SHA512

3ab04d8aad6d352ccb02ba9ae9edb7fda55a974bf0cdb6521f79a7750d658b256a92a4894e5e206e3b1bdfaf2d6a09dd950caa745f3fb22011b63e6b567ad42e
SSDEEP

12288:Z+Iuy6c18q/vrxnMaXVV60hzZCY4DuduYybnH+1IbgJNDRqG+VKD+M7+K4o1bI/h:YNc18qXFM/qzIY4DudOH9bgJnui8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c6cf98ed61b7f6295f61c9349cad7f4b04d3431a3f92a0252df7aaf154439cccN

Files

c6cf98ed61b7f6295f61c9349cad7f4b04d3431a3f92a0252df7aaf154439cccN
.exe windows:6 windows x64 arch:x64

f165b30dc89f2bb4a447c183c1571c7d

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

hw_crossplatform.pdb

Imports

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle
WakeByAddressAll
WaitOnAddress

kernel32

K32GetPerformanceInfo
GetSystemFirmwareTable
FormatMessageW
GetLastError
HeapFree
GetCurrentThreadId
GetSystemTimeAsFileTime
HeapAlloc
IsDebuggerPresent
UnhandledExceptionFilter
CloseHandle
WaitForSingleObject
FreeLibrary
GetProcAddress
LoadLibraryExA
ReadProcessMemory
SetUnhandledExceptionFilter
GetProcessHeap
GetSystemInfo
CreateMutexA
LoadLibraryA
VirtualQueryEx
OpenProcess
GetSystemTimes
GetProcessTimes
GetVolumeInformationA
GetCurrentProcessId
GetProcessIoCounters
GlobalMemoryStatusEx
GetDiskFreeSpaceExA
GetLogicalDriveStringsW
WaitForSingleObjectEx
GetLogicalProcessorInformation
LocalFree
InitializeSListHead
GetModuleHandleA
CreateThread
WideCharToMultiByte
WriteConsoleW
MultiByteToWideChar
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCurrentThread
SwitchToThread
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetLastError
GetCurrentDirectoryW
GetEnvironmentVariableW
GetCurrentProcess
GetModuleHandleW
GetConsoleMode
GetStdHandle
GetSystemTimePreciseAsFileTime
HeapReAlloc
lstrlenW
ReleaseMutex
IsProcessorFeaturePresent

ole32

CoCreateInstance
CoSetProxyBlanket
CoInitializeSecurity
CoInitializeEx

oleaut32

SafeArrayAccessData
SafeArrayGetUBound
SafeArrayGetLBound
VariantClear
GetErrorInfo
SysFreeString
SysAllocStringLen
SysStringLen
SafeArrayUnaccessData

api-ms-win-shcore-scaling-l1-1-1

GetDpiForMonitor

user32

GetMonitorInfoW
EnumDisplayMonitors
EnumDisplaySettingsExW

psapi

GetModuleFileNameExW

ntdll

NtQueryInformationProcess
RtlNtStatusToDosError
NtWriteFile
NtQuerySystemInformation
RtlGetVersion

powrprof

CallNtPowerInformation

advapi32

IsValidSid
GetLengthSid
OpenProcessToken
RegCloseKey
RegOpenKeyExW
RegQueryValueExW
CopySid
GetTokenInformation

pdh

PdhCloseQuery
PdhAddEnglishCounterW
PdhGetFormattedCounterValue
PdhRemoveCounter
PdhCollectQueryData
PdhOpenQueryA

shell32

CommandLineToArgvW

vcruntime140

memcmp
_CxxThrowException
__current_exception_context
__current_exception
memmove
memset
memcpy
__CxxFrameHandler3
__C_specific_handler

api-ms-win-crt-heap-l1-1-0

free
_set_new_mode

api-ms-win-crt-string-l1-1-0

wcslen

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___argv
_seh_filter_exe
_set_app_type
_initialize_onexit_table
_exit
exit
_crt_atexit
terminate
__p___argc
_register_onexit_function
_configure_narrow_argv
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 1.1MB - Virtual size: 1.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 305KB - Virtual size: 305KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 944B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 86KB - Virtual size: 86KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

f165b30dc89f2bb4a447c183c1571c7d

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

bcryptprimitives

api-ms-win-core-synch-l1-2-0

kernel32

ole32

oleaut32

api-ms-win-shcore-scaling-l1-1-1

user32

psapi

ntdll

powrprof

advapi32

pdh

shell32

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 1.1MB - Virtual size: 1.1MB

.rdata Size: 305KB - Virtual size: 305KB

.data Size: 512B - Virtual size: 944B

.pdata Size: 86KB - Virtual size: 86KB

.reloc Size: 4KB - Virtual size: 3KB

.text
Size: 1.1MB - Virtual size: 1.1MB

.rdata
Size: 305KB - Virtual size: 305KB

.data
Size: 512B - Virtual size: 944B

.pdata
Size: 86KB - Virtual size: 86KB

.reloc
Size: 4KB - Virtual size: 3KB