b57d9908e76d7874fff5bb71da519e5c012b152ab21c7d364f4898ed170a5238

Sharing

Copy URL Twitter E-mail

General

Target

b57d9908e76d7874fff5bb71da519e5c012b152ab21c7d364f4898ed170a5238
Size

4.2MB
MD5

a5749a46961413b3cb03a07fc5f0fb6e
SHA1

7f911695cdb5ec7eaa92a0b9db77dd78856d6309
SHA256

b57d9908e76d7874fff5bb71da519e5c012b152ab21c7d364f4898ed170a5238
SHA512

215f3f930d64a43bdc678bbe92c8e67275df99e7d2cea7b5ea34f1deaa33c922cf623f8958202935628cdc27b26bf7a248edb5453cd400a3962c836bbe34a44a
SSDEEP

49152:0QDSzho8WkoiBPcsnSOHdZengUcK+pg6nsfzQF8vGrOCGZIS5GezaEP0PpIvYmio:/aho8rBA47pwqGP5GnPpIvN

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b57d9908e76d7874fff5bb71da519e5c012b152ab21c7d364f4898ed170a5238

Files

b57d9908e76d7874fff5bb71da519e5c012b152ab21c7d364f4898ed170a5238
.exe windows:5 windows x64 arch:x64

4a825a8d3f0df8719f6984162e126095

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

VirtualQuery
PeekNamedPipe
SetLastError
GetFileInformationByHandle
GetDriveTypeW
CreateFileW
GetModuleHandleExW
OutputDebugStringW
GetStartupInfoW
IsDebuggerPresent
InitializeSListHead
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
CreateEventW
WaitForSingleObjectEx
ReadConsoleW
ReadConsoleA
SetConsoleMode
GetConsoleMode
GetSystemTimeAsFileTime
GetLastError
CreateProcessA
ExitProcess
CloseHandle
VirtualAlloc
VirtualFree
AreFileApisANSI
GetModuleFileNameA
QueryPerformanceCounter
GetACP
GetEnvironmentVariableW
GetModuleHandleW
WriteFile
GetFileType
GetStdHandle
FindNextFileW
FindFirstFileW
FindClose
SystemTimeToFileTime
GetSystemTime
VirtualProtect
FormatMessageA
LoadLibraryA
FreeLibrary
GetSystemDirectoryA
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
GetCurrentProcessId
InitializeCriticalSectionEx
UnmapViewOfFile
SwitchToThread
AcquireSRWLockShared
ReleaseSRWLockShared
MultiByteToWideChar
CreateFileMappingA
lstrlenA
GetProcAddress
GetModuleHandleA
MapViewOfFileEx
GetFileSize
CreateFileA
Sleep
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
WideCharToMultiByte
GetCurrentThreadId
CreateEventA
WaitForSingleObject
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
InitializeSRWLock
GetProcessHeap
HeapSize
HeapFree
HeapReAlloc
HeapAlloc
HeapDestroy

ws2_32

WSASetLastError
shutdown
setsockopt
send
select
WSAIoctl
WSAStringToAddressA
getaddrinfo
htons
inet_ntop
bind
socket
WSAStartup
WSACleanup
connect
recv
WSACloseEvent
WSACreateEvent
WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
WSAWaitForMultipleEvents
inet_addr
inet_ntoa
gethostbyaddr
gethostbyname
getservbyport
getservbyname
htonl
getsockopt
getsockname
getpeername
ioctlsocket
closesocket
__WSAFDIsSet
freeaddrinfo
ntohs
WSAGetLastError

crypt32

CertFreeCertificateContext
CertOpenStore
CertCloseStore
CertEnumCertificatesInStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertGetCertificateContextProperty

shlwapi

StrChrA

winmm

timeGetDevCaps
timeBeginPeriod
timeGetTime
timeEndPeriod

bcrypt

BCryptGenRandom

msvcrt

strcspn
strspn
strncpy
_setmode
setvbuf
ftell
fseek
fread
_fileno
fflush
ferror
strtoul
strcmp
qsort
atoi
fgets
feof
fclose
strncmp
abort
_beginthreadex
_wfopen
realloc
_errno
calloc
malloc
free
_localtime64
_time64
_mktime64
wcsrchr
__CxxFrameHandler
wcsstr
memchr
strrchr
strchr
strstr
memcmp
_CxxThrowException
memset
memmove
memcpy
__C_specific_handler
isspace
raise
getenv
strtol
fputs
signal
tolower
isdigit
_initterm
_callnewh
__pctype_func
___mb_cur_max_func
wcstol
_ismbblead
fopen
_gmtime64
_lock
_unlock
_iob
_getdrive
__doserrno
wcspbrk
_clearfp
log10
ceil
_sys_nerr
_sys_errlist
_strtoui64
_isatty
mbtowc
_msize
?terminate@@YAXXZ
_commode
_wcsicmp
___lc_handle_func
_fmode
_acmdln
__getmainargs
__set_app_type
_XcptFilter
___lc_codepage_func
_wfullpath
?_set_new_mode@@YAHH@Z
_amsg_exit

user32

GetProcessWindowStation
GetUserObjectInformationW
TranslateMessage
MsgWaitForMultipleObjects
MessageBoxW
DispatchMessageA
PeekMessageA

advapi32

CryptCreateHash
RegisterEventSourceW
ReportEventW
CryptAcquireContextW
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
DeregisterEventSource
CryptDecrypt
CryptExportKey

Exports

Exports

LZ4_attach_dictionary
LZ4_compress
LZ4_compressBound
LZ4_compress_continue
LZ4_compress_default
LZ4_compress_destSize
LZ4_compress_fast
LZ4_compress_fast_continue
LZ4_compress_fast_extState
LZ4_compress_limitedOutput
LZ4_compress_limitedOutput_continue
LZ4_compress_limitedOutput_withState
LZ4_compress_withState
LZ4_create
LZ4_createStream
LZ4_createStreamDecode
LZ4_decoderRingBufferSize
LZ4_decompress_fast
LZ4_decompress_fast_continue
LZ4_decompress_fast_usingDict
LZ4_decompress_fast_withPrefix64k
LZ4_decompress_safe
LZ4_decompress_safe_continue
LZ4_decompress_safe_partial
LZ4_decompress_safe_partial_usingDict
LZ4_decompress_safe_usingDict
LZ4_decompress_safe_withPrefix64k
LZ4_freeStream
LZ4_freeStreamDecode
LZ4_initStream
LZ4_loadDict
LZ4_loadDictSlow
LZ4_resetStream
LZ4_resetStreamState
LZ4_resetStream_fast
LZ4_saveDict
LZ4_setStreamDecode
LZ4_sizeofState
LZ4_sizeofStreamState
LZ4_slideInputBuffer
LZ4_uncompress
LZ4_uncompress_unknownOutputSize
LZ4_versionNumber
LZ4_versionString
llhttp_errno_name
llhttp_execute
llhttp_finish
llhttp_get_errno
llhttp_get_error_pos
llhttp_get_error_reason
llhttp_get_http_major
llhttp_get_http_minor
llhttp_get_method
llhttp_get_status_code
llhttp_get_type
llhttp_get_upgrade
llhttp_init
llhttp_message_needs_eof
llhttp_method_name
llhttp_pause
llhttp_reset
llhttp_resume
llhttp_resume_after_upgrade
llhttp_set_error_reason
llhttp_set_lenient_chunked_length
llhttp_set_lenient_data_after_close
llhttp_set_lenient_headers
llhttp_set_lenient_keep_alive
llhttp_set_lenient_optional_cr_before_lf
llhttp_set_lenient_optional_crlf_after_chunk
llhttp_set_lenient_optional_lf_after_cr
llhttp_set_lenient_spaces_after_chunk_size
llhttp_set_lenient_transfer_encoding
llhttp_set_lenient_version
llhttp_settings_init
llhttp_should_keep_alive
llhttp_status_name

Sections

.text
Size: 2.0MB - Virtual size: 2.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 29KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 114KB - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.gehcont
Size: 512B - Virtual size: 4B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.textshe
Size: 723KB - Virtual size: 723KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.reloc
Size: 39KB - Virtual size: 38KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.rsrc
Size: 73KB - Virtual size: 76KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4a825a8d3f0df8719f6984162e126095

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

ws2_32

crypt32

shlwapi

winmm

bcrypt

msvcrt

user32

advapi32

Exports

Exports

Sections

.text Size: 2.0MB - Virtual size: 2.0MB

.rdata Size: 1.3MB - Virtual size: 1.3MB

.data Size: 29KB - Virtual size: 39KB

.pdata Size: 114KB - Virtual size: 114KB

.gehcont Size: 512B - Virtual size: 4B

.textshe Size: 723KB - Virtual size: 723KB

.reloc Size: 39KB - Virtual size: 38KB

.rsrc Size: 73KB - Virtual size: 76KB

.text
Size: 2.0MB - Virtual size: 2.0MB

.rdata
Size: 1.3MB - Virtual size: 1.3MB

.data
Size: 29KB - Virtual size: 39KB

.pdata
Size: 114KB - Virtual size: 114KB

.gehcont
Size: 512B - Virtual size: 4B

.textshe
Size: 723KB - Virtual size: 723KB

.reloc
Size: 39KB - Virtual size: 38KB

.rsrc
Size: 73KB - Virtual size: 76KB