141a8bb7fb4f33472df972dd54d796958fbca553d7dd9caf8f8222e6d3b71b5f[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

141a8bb7fb4f33472df972dd54d796958fbca553d7dd9caf8f8222e6d3b71b5f.exe
Size

1.0MB
MD5

5136a20716f19ac6f59fcb6b8b9ec785
SHA1

e070dc15cb25504244d5d217ae44151d7803842e
SHA256

141a8bb7fb4f33472df972dd54d796958fbca553d7dd9caf8f8222e6d3b71b5f
SHA512

08a6f13fee1b00bb54b1950e6f6e1c5d74d585f553bdbaf9d3c4e53d2484507292d519e79b9d7a2e44bafd8a5621c3250139713be49207b8b2bf1c62b7c3e5f1
SSDEEP

12288:3yf/+MKnXNSfVuguJ18Bmebm9kwjjLOU80kQhDTIkc/KnMgaY15N/70/1swqw737:o/50zYl69kwqU8QTpc/KnMgaYNKVZ

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
141a8bb7fb4f33472df972dd54d796958fbca553d7dd9caf8f8222e6d3b71b5f.exe

Files

141a8bb7fb4f33472df972dd54d796958fbca553d7dd9caf8f8222e6d3b71b5f.exe
.exe windows:6 windows x86 arch:x86

49f1933818ec3cc96ce56aee47def171

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\Omnia\Debug\Client.pdb

Imports

user32

SetThreadDpiAwarenessContext
GetSystemMetrics

gdi32

SelectObject
BitBlt
CreateCompatibleBitmap
CreateCompatibleDC
CreateDCW
DeleteDC
DeleteObject
GetDIBits

msvcp140d

?uncaught_exceptions@std@@YAHXZ
_Xtime_get_ticks
_Query_perf_counter
_Query_perf_frequency
_Mbrtowc
?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ
?_Getdays@_Locinfo@std@@QBEPBDXZ
?_Getmonths@_Locinfo@std@@QBEPBDXZ
?flags@ios_base@std@@QBEHXZ
?_W_Getdays@_Locinfo@std@@QBEPBGXZ
?_W_Getmonths@_Locinfo@std@@QBEPBGXZ
?width@ios_base@std@@QBE_JXZ
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?_Xbad_function_call@std@@YAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?width@ios_base@std@@QAE_J_J@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?good@ios_base@std@@QBE_NXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Xlength_error@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
??1_Lockit@std@@QAE@XZ
??0_Lockit@std@@QAE@H@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?fill@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDXZ
?rdbuf@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_streambuf@DU?$char_traits@D@std@@@2@XZ
?tie@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEPAV?$basic_ostream@DU?$char_traits@D@std@@@2@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z

vcruntime140d

memchr
memcmp
strstr
__vcrt_LoadLibraryExW
__vcrt_GetModuleHandleW
strrchr
__vcrt_GetModuleFileNameW
_purecall
memcpy
memmove
memset
__std_exception_copy
__std_exception_destroy
_CxxThrowException
__CxxFrameHandler3
__current_exception
__current_exception_context
_except_handler4_common
__std_type_info_destroy_list
strchr

ucrtbased

_wsplitpath_s
_wmakepath_s
_controlfp_s
__stdio_common_vsprintf_s
strcat_s
strcpy_s
terminate
__p__commode
_set_new_mode
_configthreadlocale
_register_thread_local_exe_atexit_callback
_c_exit
__p___argv
__p___argc
_set_fmode
_exit
exit
_initterm_e
_initterm
_get_initial_narrow_environment
__setusermatherr
_set_app_type
_seh_filter_exe
_except1
_CrtDbgReportW
_cexit
_crt_at_quick_exit
_crt_atexit
_execute_onexit_table
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
_seh_filter_dll
_free_dbg
malloc
_callnewh
strlen
wcslen
ceil
_CrtDbgReport
_calloc_dbg
_invalid_parameter
calloc
free
realloc
wcscpy_s
strcpy
__sys_errlist
__sys_nerr
wcstombs
__acrt_iob_func
fread
fwrite
fseek
strcmp
strcspn
strncmp
fclose
fputs
qsort
_time64
__stdio_common_vswprintf
feof
ftell
strtol
strtoul
strpbrk
strspn
__stdio_common_vsscanf
fputc
__stdio_common_vsprintf
atoi
fflush
fopen
_access
_open
_stat64
strtoll
fgets
_gmtime64
_fstat64
_beginthreadex
_lseeki64
strncpy
_fseeki64
strftime
_strdup
_unlink
_read
_write
_fdopen
_fileno
_close
_errno

wldap32

ord35
ord33
ord79
ord30
ord200
ord301
ord143
ord217
ord46
ord211
ord60
ord45
ord50
ord41
ord22
ord26
ord27
ord32

crypt32

CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertOpenStore
CertGetCertificateChain
CertFreeCertificateChain
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertFreeCertificateContext
CryptStringToBinaryA
PFXImportCertStore
CryptDecodeObjectEx
CertFindExtension
CertAddCertificateContextToStore
CertFreeCertificateChainEngine

ws2_32

gethostname
ioctlsocket
getpeername
recvfrom
freeaddrinfo
getaddrinfo
recv
listen
htonl
getsockname
connect
bind
accept
select
__WSAFDIsSet
socket
htons
WSAIoctl
setsockopt
WSACleanup
WSAStartup
ntohs
WSAGetLastError
WSASetLastError
closesocket
WSAWaitForMultipleEvents
WSASetEvent
WSAResetEvent
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
send
getsockopt
sendto

normaliz

IdnToAscii
IdnToUnicode

kernel32

SleepEx
GetProcessHeap
FreeLibrary
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
TryAcquireSRWLockExclusive
HeapFree
HeapAlloc
GetLastError
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
QueryPerformanceCounter
WideCharToMultiByte
MultiByteToWideChar
RaiseException
GetModuleHandleW
GetStartupInfoW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
GetCurrentThreadId
SleepConditionVariableSRW
WakeAllConditionVariable
TryAcquireSRWLockShared
Sleep
GetProcAddress
SetLastError
FormatMessageW
GetTickCount
CloseHandle
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
GetFileSizeEx
CreateFileA
VerifyVersionInfoW
VerSetConditionMask
VirtualQuery
WaitForMultipleObjects
PeekNamedPipe
ReadFile
GetFileType
GetStdHandle
GetEnvironmentVariableA
WaitForSingleObjectEx
MoveFileExA
LoadLibraryA
GetModuleHandleA
GetSystemDirectoryA
QueryPerformanceFrequency
CreateEventA
WaitForSingleObject
SetEvent

advapi32

CryptImportKey
CryptEncrypt
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA

bcrypt

BCryptGenRandom

Sections

.textbss
Size: - Virtual size: 444KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.text
Size: 929KB - Virtual size: 928KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 26KB - Virtual size: 26KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 71KB - Virtual size: 72KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 10KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.msvcjmc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 1024B - Virtual size: 777B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.00cfg
Size: 512B - Virtual size: 270B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 28KB - Virtual size: 28KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

49f1933818ec3cc96ce56aee47def171

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

user32

gdi32

msvcp140d

vcruntime140d

ucrtbased

wldap32

crypt32

ws2_32

normaliz

kernel32

advapi32

bcrypt

Sections

.textbss Size: - Virtual size: 444KB

.text Size: 929KB - Virtual size: 928KB

.rdata Size: 26KB - Virtual size: 26KB

.data Size: 71KB - Virtual size: 72KB

.idata Size: 10KB - Virtual size: 10KB

.msvcjmc Size: 1KB - Virtual size: 1KB

.tls Size: 1024B - Virtual size: 777B

.00cfg Size: 512B - Virtual size: 270B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 28KB - Virtual size: 28KB

.textbss
Size: - Virtual size: 444KB

.text
Size: 929KB - Virtual size: 928KB

.rdata
Size: 26KB - Virtual size: 26KB

.data
Size: 71KB - Virtual size: 72KB

.idata
Size: 10KB - Virtual size: 10KB

.msvcjmc
Size: 1KB - Virtual size: 1KB

.tls
Size: 1024B - Virtual size: 777B

.00cfg
Size: 512B - Virtual size: 270B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 28KB - Virtual size: 28KB