cfb5e6045d087d9208ce4b4efa3f4ec3a39e242003d15b9c83a8d6a3b8ab56e8

Sharing

Copy URL Twitter E-mail

General

Target

cfb5e6045d087d9208ce4b4efa3f4ec3a39e242003d15b9c83a8d6a3b8ab56e8
Size

22KB
MD5

94d87ccb73d0c60c4a98697672789c98
SHA1

d08ecc93c9c77e563489416dcfa7485343b4359c
SHA256

cfb5e6045d087d9208ce4b4efa3f4ec3a39e242003d15b9c83a8d6a3b8ab56e8
SHA512

6d1e7fcd69de59fa5aa0222c8a8ce66954704d404f9401a7fd753071a6e341ecc8ccbe4dfa007d1b5ae5984148df7ee6361a1f493de734b441aee52337d79d6a
SSDEEP

384:afnTETNsq21+tJWVeg5jT8fZWkH6c16PCWf4+sg4:aTETm9ugjUYktmzA+st

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cfb5e6045d087d9208ce4b4efa3f4ec3a39e242003d15b9c83a8d6a3b8ab56e8

Files

cfb5e6045d087d9208ce4b4efa3f4ec3a39e242003d15b9c83a8d6a3b8ab56e8
.exe windows:6 windows x64 arch:x64

4ddf7bcfc5f8f29248ed18e4d80c69fa

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED

Imports

kernel32

CreateFileW
ReadFile
WriteFile
GetTempPathW
CloseHandle
HeapAlloc
HeapFree
GetProcessHeap
GetLastError
SetCriticalSectionSpinCount
MultiByteToWideChar
ConvertDefaultLocale
SleepEx
GetCurrentProcess
GetConsoleWindow
lstrlenA
lstrlenW
IsProcessorFeaturePresent
GetStartupInfoW
SetUnhandledExceptionFilter
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW

user32

GetWindowLongPtrW
IsDialogMessageW
GetWindowContextHelpId
wsprintfW
RegisterClassW
IsWindowVisible
ShowWindow
MessageBoxA

vcruntime140

__current_exception
memcpy
__current_exception_context
memset
__std_type_info_destroy_list
__C_specific_handler

api-ms-win-crt-utility-l1-1-0

srand
rand

api-ms-win-crt-string-l1-1-0

strcat_s
toupper
strcpy_s

api-ms-win-crt-heap-l1-1-0

free
malloc
realloc
_set_new_mode

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__stdio_common_vfprintf
__p__commode
__acrt_iob_func

api-ms-win-crt-runtime-l1-1-0

__p___argv
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
__p___argc
_get_initial_narrow_environment
_set_app_type
exit
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_crt_at_quick_exit
terminate
_exit
_seh_filter_exe
_initterm_e
_configure_narrow_argv
_initialize_narrow_environment
_seh_filter_dll
_initterm

api-ms-win-crt-time-l1-1-0

_time32

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 6KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 1024B - Virtual size: 804B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

4ddf7bcfc5f8f29248ed18e4d80c69fa

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

vcruntime140

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 12KB - Virtual size: 12KB

.rdata Size: 6KB - Virtual size: 6KB

.data Size: 512B - Virtual size: 9KB

.pdata Size: 1024B - Virtual size: 804B

.reloc Size: 512B - Virtual size: 44B

.text
Size: 12KB - Virtual size: 12KB

.rdata
Size: 6KB - Virtual size: 6KB

.data
Size: 512B - Virtual size: 9KB

.pdata
Size: 1024B - Virtual size: 804B

.reloc
Size: 512B - Virtual size: 44B