392f8aab93b44619364577845c83f5346c1ff10da28a282454d2a16da7e7d82a

Sharing

Copy URL Twitter E-mail

General

Target

392f8aab93b44619364577845c83f5346c1ff10da28a282454d2a16da7e7d82a
Size

1.3MB
MD5

578b923627f213c8302dbbb932421b78
SHA1

1997653e997cc3dac31f583695162b5c87165600
SHA256

392f8aab93b44619364577845c83f5346c1ff10da28a282454d2a16da7e7d82a
SHA512

215ff5d89143ddf4d79994437bb590a711a50b25effe3ff50e150d69c2488d51faf35d0158c1c1b0fad503eba1850303c111108c8ee55d98f070fdc2e46baae3
SSDEEP

24576:osbrZ3BI5XHu409omnnRRCwhNS4HTgMvEkqawk0gWsnS+Zg5GxyTxJP6WJUiC:ZM5XY9omnRzhNBHFvEJawk0psnS+Zgsh

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/MKX_2030759330064N¿.exe

Files

392f8aab93b44619364577845c83f5346c1ff10da28a282454d2a16da7e7d82a
.zip
MKX_2030759330064N¿.exe
.exe windows:6 windows x64 arch:x64

93b4ab7731590c304a7730c8976eb3b6

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

qalefarebirisukibikasuhu.pdb

Imports

api-ms-win-core-synch-l1-2-0

WakeByAddressAll
WakeByAddressSingle
WaitOnAddress

bcryptprimitives

ProcessPrng

bcrypt

BCryptGenRandom

advapi32

RegCloseKey
SystemFunction036
RegOpenKeyExW
RegQueryValueExW

kernel32

SetHandleInformation
GetProcAddress
CreateIoCompletionPort
GetModuleHandleW
GetLastError
FormatMessageW
PostQueuedCompletionStatus
SetFileCompletionNotificationModes
HeapFree
FreeEnvironmentStringsW
DeleteProcThreadAttributeList
CompareStringOrdinal
AddVectoredExceptionHandler
SetThreadStackGuarantee
GetCurrentThread
SwitchToThread
WaitForSingleObject
QueryPerformanceCounter
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetLastError
GetCurrentDirectoryW
GetEnvironmentStringsW
GetEnvironmentVariableW
HeapAlloc
SetFileInformationByHandle
GetCurrentProcess
DuplicateHandle
GetProcessHeap
GetStdHandle
GetCurrentProcessId
WriteFileEx
SleepEx
TerminateProcess
QueryPerformanceFrequency
UnhandledExceptionFilter
HeapReAlloc
lstrlenW
ReleaseMutex
FindNextFileW
FindClose
CreateFileW
GetFileInformationByHandle
GetFileInformationByHandleEx
CreateDirectoryW
FindFirstFileW
GetFinalPathNameByHandleW
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
GetConsoleMode
GetCurrentThreadId
GetModuleFileNameW
CreateNamedPipeW
ReadFileEx
GetFullPathNameW
GetSystemDirectoryW
GetWindowsDirectoryW
CreateProcessW
GetFileAttributesW
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
MultiByteToWideChar
WriteConsoleW
WideCharToMultiByte
CreateThread
GetModuleHandleA
GetSystemTimeAsFileTime
InitializeSListHead
WaitForSingleObjectEx
LoadLibraryA
CreateMutexA
IsDebuggerPresent
CloseHandle
GetQueuedCompletionStatusEx

ws2_32

send
recv
shutdown
getsockopt
ioctlsocket
connect
bind
WSASocketW
WSASend
getsockname
getpeername
setsockopt
WSAIoctl
WSAGetLastError
freeaddrinfo
getaddrinfo
WSAStartup
WSACleanup
closesocket

secur32

InitializeSecurityContextW
FreeContextBuffer
AcceptSecurityContext
EncryptMessage
ApplyControlToken
DeleteSecurityContext
QueryContextAttributesW
DecryptMessage
AcquireCredentialsHandleA
FreeCredentialsHandle

crypt32

CertGetCertificateChain
CertCloseStore
CertFreeCertificateChain
CertOpenStore
CertVerifyCertificateChainPolicy
CertDuplicateCertificateChain
CertDuplicateStore
CertEnumCertificatesInStore
CertAddCertificateContextToStore
CertDuplicateCertificateContext
CertFreeCertificateContext

ntdll

RtlNtStatusToDosError
NtWriteFile
NtCancelIoFileEx
NtDeviceIoControlFile
NtCreateFile

vcruntime140

memset
_CxxThrowException
__C_specific_handler
__current_exception
__current_exception_context
memcmp
memmove
__CxxFrameHandler3
memcpy

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-heap-l1-1-0

malloc
free
_set_new_mode

api-ms-win-crt-runtime-l1-1-0

_get_initial_narrow_environment
_configure_narrow_argv
terminate
_initterm
_initterm_e
exit
_exit
__p___argc
__p___argv
_set_app_type
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_initialize_onexit_table
_register_onexit_function
_seh_filter_exe
_crt_atexit
_initialize_narrow_environment

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode
_set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sections

.text
Size: 2.1MB - Virtual size: 2.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 963KB - Virtual size: 962KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 99KB - Virtual size: 99KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 15KB - Virtual size: 15KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

93b4ab7731590c304a7730c8976eb3b6

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

api-ms-win-core-synch-l1-2-0

bcryptprimitives

bcrypt

advapi32

kernel32

ws2_32

secur32

crypt32

ntdll

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

Sections

.text Size: 2.1MB - Virtual size: 2.1MB

.rdata Size: 963KB - Virtual size: 962KB

.data Size: 12KB - Virtual size: 13KB

.pdata Size: 99KB - Virtual size: 99KB

.reloc Size: 15KB - Virtual size: 15KB

.text
Size: 2.1MB - Virtual size: 2.1MB

.rdata
Size: 963KB - Virtual size: 962KB

.data
Size: 12KB - Virtual size: 13KB

.pdata
Size: 99KB - Virtual size: 99KB

.reloc
Size: 15KB - Virtual size: 15KB