683f1cd2d0b806dd8f7900e4904f972483a557173f540a55512094eed9ba3787N

Sharing

Copy URL Twitter E-mail

General

Target

683f1cd2d0b806dd8f7900e4904f972483a557173f540a55512094eed9ba3787N
Size

274KB
MD5

9370ca8dffaf3e657b05b1ed78523ff0
SHA1

bf0e21c522f477fe8520fdb5b521ad865aed3896
SHA256

683f1cd2d0b806dd8f7900e4904f972483a557173f540a55512094eed9ba3787
SHA512

b98d93e93aeebb517fbbf3efb665a430d00e07cf51d208483931278788c6c4fdef7329fde68f2c34ee7a11b05ee546ed4acb80db148239f8ba2dccd09cde60da
SSDEEP

6144:BaH7iaH7TaH7BaH7QaH7GaH7UjaomLPwu2Pzp7P6:obBbebobbb9b23mZqVi

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
683f1cd2d0b806dd8f7900e4904f972483a557173f540a55512094eed9ba3787N

Files

683f1cd2d0b806dd8f7900e4904f972483a557173f540a55512094eed9ba3787N
.exe windows:6 windows x86 arch:x86

ed4425cf217058da6bdf611263e571dd

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

DrvInst.pdb

Imports

msvcrt

memset
_vsnwprintf
wcschr
__wgetmainargs
_cexit
_exit
_XcptFilter
exit
_initterm
_amsg_exit
wcsrchr
toupper
memmove
memcpy
_wcsicmp
_vsnprintf
_resetstkoflw
swscanf
_controlfp
?terminate@@YAXXZ
_except_handler4_common
__set_app_type
__p__fmode
__p__commode
__setusermatherr

ntdll

EtwEventRegister
EtwEventUnregister
EtwTraceMessage
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle
EtwRegisterTraceGuidsW
EtwUnregisterTraceGuids
RtlNtStatusToDosError
NtSetInformationFile
NtQueryInformationFile
DbgPrintEx
NtQueryInformationProcess
EtwEventWrite
WinSqmSetDWORD
WinSqmSetString
WinSqmEndSession
WinSqmStartSession
RtlUpcaseUnicodeString
RtlInitUnicodeStringEx
NtQuerySystemInformation

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
SetLastError
SetErrorMode
SetUnhandledExceptionFilter

api-ms-win-core-file-l1-1-0

FileTimeToSystemTime
WriteFile
CreateFileW

api-ms-win-core-handle-l1-1-0

DuplicateHandle
CloseHandle

api-ms-win-core-heap-l1-1-0

HeapSetInformation

api-ms-win-core-interlocked-l1-1-0

InterlockedCompareExchange
InterlockedExchange

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-libraryloader-l1-1-0

FreeLibrary
GetProcAddress
GetModuleHandleW
LoadLibraryExA
GetModuleHandleA

api-ms-win-core-localregistry-l1-1-0

RegCloseKey
RegSetValueExW
RegOpenKeyExW
RegQueryValueExW

api-ms-win-core-memory-l1-1-0

MapViewOfFile
UnmapViewOfFile

api-ms-win-core-misc-l1-1-0

lstrcmpiW
lstrlenW
LocalAlloc
LocalFree
Sleep

api-ms-win-core-processthreads-l1-1-0

ExitProcess
OpenProcessToken
SetThreadToken
OpenThreadToken
GetCurrentProcess
ExitThread
GetCurrentThreadId
CreateThread
TerminateProcess
GetExitCodeThread
GetCurrentProcessId

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-string-l1-1-0

CompareStringOrdinal

api-ms-win-core-synch-l1-1-0

SetEvent
OpenEventW
WaitForMultipleObjectsEx
CreateEventW
OpenProcess
ReleaseMutex
WaitForSingleObjectEx
CreateMutexW

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo
GetTickCount
GetSystemTimeAsFileTime

api-ms-win-security-base-l1-1-0

CheckTokenMembership
DuplicateTokenEx
GetTokenInformation
FreeSid
IsValidSid
AllocateAndInitializeSid
InitializeAcl
AdjustTokenPrivileges
GetKernelObjectSecurity
CopySid
GetLengthSid
EqualSid
SetSecurityDescriptorDacl
InitializeSecurityDescriptor
AddAccessAllowedAceEx

setupapi

SetupDiSetDevicePropertyW
SetupDiEnumDeviceInfo
SetupDiGetClassDevsW
pSetupDiGetStrongNameForDriverNode
SetupDiGetDriverInfoDetailW
SetupDiGetSelectedDriverW
CM_Get_DevNode_Status
SetupDiCallClassInstaller
SetupDiSetDriverInstallParamsW
SetupDiGetDriverInstallParamsW
SetupDiEnumDriverInfoW
SetupDiGetClassPropertyW
SetupDefaultQueueCallbackW
SetupOpenInfFileW
SetupDiGetINFClassW
SetupFindNextMatchLineW
SetupDiDestroyDriverInfoList
SetupDiGetDeviceInstanceIdW
SetupDiSetSelectedDriverW
SetupDiSetDeviceInstallParamsW
SetupDiGetDeviceInstallParamsW
pGetDriverPackageHash
SetupGetInfDriverStoreLocationW
SetupDiInstallClassW
SetupDiSetClassPropertyW
pSetupStringFromGuid
SetupDiReportAdditionalSoftwareRequested
SetupDiReportGenericDriverInstalled
SetupDiReportPnPDeviceProblem
pSetupDiCrimsonLogDeviceInstall
SetupCloseFileQueue
SetupUninstallNewlyCopiedInfs
SetupTermDefaultQueueCallback
SetupGetFileQueueFlags
SetupPromptReboot
SetupCommitFileQueueW
SetupInitDefaultQueueCallbackEx
SetupScanFileQueueW
SetupSetFileQueueFlags
SetupOpenFileQueue
CM_Set_DevNode_Problem
SetupDiReportDriverNotFoundError
SetupDiOpenDevRegKey
SetupDiBuildDriverInfoList
SetupCopyOEMInfW
SetupInstallLogCloseEventGroup
pSetupSetGlobalFlags
pSetupGetGlobalFlags
SetupInstallLogCreateEventGroup
SetupDiGetClassInstallParamsW
SetupDiSetClassInstallParamsW
SetupVerifyInfFileW
SetupDiEnumDeviceInterfaces
SetupDiGetDeviceInterfaceDetailW
SetupDiGetClassDevsExW
CM_Setup_DevNode
SetupDiRemoveDevice
SetupFindFirstLineW
SetupGetStringFieldW
SetupDiGetActualModelsSectionW
SetupGetFieldCount
SetupFindNextLine
SetupCloseInfFile
pSetupSetDriverPackageRestorePoint
pSetupValidateDriverPackage
SetupGetNonInteractiveMode
SetupSetThreadLogToken
SetupDiCreateDeviceInfoList
SetupDiOpenDeviceInfoW
pSetupDiBuildInfoDataFromStrongName
SetupDiReportDeviceInstallError
SetupDiGetDevicePropertyW
SetupDiDestroyDeviceInfoList
SetupGetThreadLogToken
SetupWriteTextLog
pSetupDoLastKnownGoodBackup

kernel32

CompareStringW
GetThreadLocale
HeapAlloc
HeapReAlloc
HeapFree
GetProcessHeap
RegEnumValueW
FlushFileBuffers
SetFilePointer
GetVersionExW
GetLocalTime
GetFileSize
DeleteFileW
GetFileInformationByHandle
CreateHardLinkW
FindClose
FindNextFileW
SetFileAttributesW
lstrcmpW
FindFirstFileW
MoveFileExW
GetCommandLineA
CreateFileMappingW
SetEndOfFile
CreateDirectoryW
GetFileAttributesW
GetFullPathNameW
LoadLibraryExW
GetCurrentThread
GetModuleFileNameA
GetSystemWindowsDirectoryW
RaiseException
FileTimeToLocalFileTime
lstrlenA
WideCharToMultiByte
DelayLoadFailureHook
GetSystemWow64DirectoryW
LoadLibraryW
GetCommandLineW
LCMapStringW

Sections

.text
Size: 237KB - Virtual size: 237KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 33KB - Virtual size: 34KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

ed4425cf217058da6bdf611263e571dd

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-core-debug-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-libraryloader-l1-1-0

api-ms-win-core-localregistry-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-misc-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-security-base-l1-1-0

setupapi

kernel32

Sections

.text Size: 237KB - Virtual size: 237KB

.data Size: 512B - Virtual size: 1KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 33KB - Virtual size: 34KB

.text
Size: 237KB - Virtual size: 237KB

.data
Size: 512B - Virtual size: 1KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 33KB - Virtual size: 34KB