da95dcf7e867cbb1224ed941a215a2eb352d41e8133ec10d1001a8cbdb8e9c41

Sharing

Copy URL Twitter E-mail

General

Target

da95dcf7e867cbb1224ed941a215a2eb352d41e8133ec10d1001a8cbdb8e9c41
Size

1.4MB
MD5

4d3cc485ab753a066b4b1848bdbf7b32
SHA1

0c5b3cfdd922fee56f2a41f6ee62b96820d6254c
SHA256

da95dcf7e867cbb1224ed941a215a2eb352d41e8133ec10d1001a8cbdb8e9c41
SHA512

96af6fb8ab9b9e6e4a68e3654542cb74f72d61a20bda46727fd6267823df1ba285e0e1b98035f1a9c237762fba7d031d028a147d08bccf279a3f3769be73d829
SSDEEP

24576:iuBb7OIPGadO+HJsv6tWKFdu9C8V3KygscfyrHkFlfrMVDs3GUXvTj:ikXFPGWJsv6tWKFdu9CTsGy6M5s3BvT

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
da95dcf7e867cbb1224ed941a215a2eb352d41e8133ec10d1001a8cbdb8e9c41

Files

da95dcf7e867cbb1224ed941a215a2eb352d41e8133ec10d1001a8cbdb8e9c41
.exe windows:6 windows x64 arch:x64

523c86feca5189152ad274fac78a6be7

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

ole32

CoInitialize
CoUninitialize
CoCreateInstance

netapi32

NetShareEnum
NetApiBufferFree

msvcp140

?_Xlength_error@std@@YAXPEBD@Z

kernel32

GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
QueryPerformanceCounter
GetCurrentProcessId
GetLastError
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
DeleteCriticalSection
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
GetCurrentDirectoryW
CreateDirectoryW
CreateFileW
DeleteFileW
FindClose
FindFirstFileW
GetFileAttributesW
GetFileAttributesExW
GetFileInformationByHandle
GetFullPathNameW
GetLogicalDrives
RemoveDirectoryW
SetFileTime
CloseHandle
FindNextFileW
SetErrorMode
DeviceIoControl
CopyFileW
MoveFileW
MoveFileExW
TzSpecificLocalTimeToSystemTime
FileTimeToSystemTime
SystemTimeToFileTime
LocalFree
FormatMessageW
FlushFileBuffers
GetFileType
ReadFile
SetEndOfFile
SetFilePointerEx
WriteFile
GetSystemInfo
CreateFileMappingW
MapViewOfFile
UnmapViewOfFile
GetModuleHandleW
GetProcAddress
FindFirstFileExW
EnterCriticalSection

vcruntime140

_CxxThrowException
strchr
memcmp
memchr
__C_specific_handler
__current_exception
__current_exception_context
__std_exception_destroy
memcpy
memmove
memset
_purecall
__std_exception_copy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-stdio-l1-1-0

_close
fwrite
fseek
_read
_write
_fileno
fgets
_open_osfhandle
feof
__stdio_common_vsnprintf_s
fclose
_get_osfhandle
_set_fmode
__stdio_common_vsprintf
fflush
_lseek
ftell
__stdio_common_vfprintf
fputc
__acrt_iob_func
__p__commode
fread

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback
_initialize_onexit_table
_errno
_configure_narrow_argv
_register_onexit_function
_invalid_parameter_noinfo_noreturn
__p___argv
__p___argc
exit
_set_app_type
_crt_atexit
_get_initial_narrow_environment
_initterm
_cexit
_initterm_e
_exit
terminate
_c_exit
_seh_filter_exe
_initialize_narrow_environment
strerror

api-ms-win-crt-heap-l1-1-0

_set_new_mode
_callnewh
realloc
malloc
free

api-ms-win-crt-string-l1-1-0

strncmp
strncpy

api-ms-win-crt-math-l1-1-0

__setusermatherr
_dclass

api-ms-win-crt-locale-l1-1-0

_free_locale
_create_locale
_configthreadlocale

api-ms-win-crt-time-l1-1-0

_get_tzname
_get_timezone
_tzset
_localtime64_s
_mktime64

api-ms-win-crt-filesystem-l1-1-0

_waccess
_wchmod

api-ms-win-crt-environment-l1-1-0

getenv_s

Sections

.text
Size: 253KB - Virtual size: 253KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 558KB - Virtual size: 558KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 2KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 16KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 568KB - Virtual size: 572KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

523c86feca5189152ad274fac78a6be7

Headers

DLL Characteristics

File Characteristics

Imports

ole32

netapi32

msvcp140

kernel32

vcruntime140

vcruntime140_1

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-environment-l1-1-0

Sections

.text Size: 253KB - Virtual size: 253KB

.rdata Size: 558KB - Virtual size: 558KB

.data Size: 2KB - Virtual size: 4KB

.pdata Size: 16KB - Virtual size: 15KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 568KB - Virtual size: 572KB

.text
Size: 253KB - Virtual size: 253KB

.rdata
Size: 558KB - Virtual size: 558KB

.data
Size: 2KB - Virtual size: 4KB

.pdata
Size: 16KB - Virtual size: 15KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 568KB - Virtual size: 572KB