dbd415a77badee76361a182fbaaf4a7273a0bd9c9ac71d9650259a0acc0e95ca

Sharing

Copy URL

Twitter E-mail

General

Target

dbd415a77badee76361a182fbaaf4a7273a0bd9c9ac71d9650259a0acc0e95ca
Size

6.3MB
MD5

f4de4c331ddb04e6887380c6fde654dd
SHA1

15fd0d91cd23cc1197ac69ea3946f1ebe0f1fee0
SHA256

dbd415a77badee76361a182fbaaf4a7273a0bd9c9ac71d9650259a0acc0e95ca
SHA512

3291d7a4efd249966bc392eb769c22250b75f3150a9e9cb6ed8ce0c64d66938d6583de6e27c98a3f03f9e4a00c9cf8f182f9771707e37dc2f0cf86dea5a287f8
SSDEEP

49152:Na0uKq3CSqAB4Ia8nCsrnviRuRpjVJJb+XDVRCoiAuH9FnXBZ3Oql0HVFJMjn5bt:cKqVrviRuRpjN6XDVEHnXB2EqIZp16c

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dbd415a77badee76361a182fbaaf4a7273a0bd9c9ac71d9650259a0acc0e95ca

Files

dbd415a77badee76361a182fbaaf4a7273a0bd9c9ac71d9650259a0acc0e95ca
.exe windows:6 windows x64 arch:x64

6d845b3157d327700ead65e382faec7c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

version

GetFileVersionInfoW
VerQueryValueW
GetFileVersionInfoSizeW

advapi32

GetUserNameW
OpenProcessToken

ws2_32

WSAStartup
socket
closesocket

userenv

GetUserProfileDirectoryW

kernel32

GetModuleHandleA
GetProcAddress
GetStdHandle
GetSystemDirectoryW
GetSystemInfo
GetTempPathW
GetVersionExA
GetWindowsDirectoryW
GlobalMemoryStatusEx
InitializeConditionVariable
InitializeCriticalSection
LeaveCriticalSection
LoadLibraryA
QueryPerformanceCounter
QueryPerformanceFrequency
ResetEvent
SetEvent
Sleep
SleepConditionVariableCS
SwitchToThread
UnmapViewOfFile
VirtualAlloc
VirtualFree
VirtualProtect
VirtualQuery
WaitForSingleObject
WakeAllConditionVariable
WriteFile
FindClose
FindFirstFileW
GetDriveTypeW
GetLastError
FormatMessageW
GetModuleHandleExW
GetSystemTimeAsFileTime
GetProcessAffinityMask
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
GetCurrentProcessId
InitializeSListHead
GetCurrentThreadId
GetModuleHandleW
GetCurrentThread
GetCurrentProcess
GetCurrentDirectoryW
FlushFileBuffers
EnterCriticalSection
DuplicateHandle
CreateFileW
CreateFileMappingW
CreateEventA
CloseHandle
AddVectoredContinueHandler
GetModuleFileNameW
IsDebuggerPresent

vcruntime140

memset
memcpy
wcschr
__C_specific_handler
__current_exception
__current_exception_context

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function
_crt_atexit
terminate
_initialize_narrow_environment
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
_initialize_onexit_table
_beginthreadex
_exit
__p___argc
_get_initial_narrow_environment
exit
_initterm
_configure_narrow_argv
_seh_filter_exe
_initterm_e
_set_app_type
__p___argv
_errno

api-ms-win-crt-string-l1-1-0

isdigit
strcmp
strlen
wcslen
wcsncat
iswctype
wcscat
_strdup
towupper
wcsncmp
wcscpy

api-ms-win-crt-environment-l1-1-0

_wgetcwd
_wgetenv
_wgetdcwd

api-ms-win-crt-heap-l1-1-0

malloc
free
calloc
_set_new_mode

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-stdio-l1-1-0

fputs
__p__commode
__acrt_iob_func
_set_fmode

api-ms-win-crt-filesystem-l1-1-0

_wfullpath

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Exports

Exports

IsolateEnterStub__CEntryPointNativeFunctions__attachThread__fe8e89788bae97cf98065b8b062da14102a906b7__f6667de81ba3372976bb88a1ffd53978a14e5062
IsolateEnterStub__CEntryPointNativeFunctions__createIsolate__c5b5663bc8e51fac8eb7cc2a6c1952957d7e49f1__d9d51255c13e1e63932724fc45c8d9d7d992f5cb
IsolateEnterStub__CEntryPointNativeFunctions__detachAllThreadsAndTearDownIsolate__803a26f98b4febfb61e3b676ead8b433cc2f21b3__d04f70c150119a1a6df693cde53c8a58128d5e2b
IsolateEnterStub__CEntryPointNativeFunctions__detachThread__573569b4c2b1f6ab146362c4435fcfe4abea4692__e8b0041f4e89ff307dd3640c69c109d0d8139b8e
IsolateEnterStub__CEntryPointNativeFunctions__getCurrentThread__669b6d90f89f02f4f21a6830554f612197337b86__1cff6a2f13f336178f12f2558128228775e047f6
IsolateEnterStub__CEntryPointNativeFunctions__getIsolate__75d5a57aa8fca0d2471ea17ca517f44cfdf0f2fc__e18826d035036aa5606c61e869f37df97fe5892f
IsolateEnterStub__CEntryPointNativeFunctions__tearDownIsolate__fa8c10625da916d6c43ee2eea372e6d2349f2fa0__7f4c88f0402ae949ca8b3e2b3a3e6235b49772f0
IsolateEnterStub__JNIInvocationInterface_0024Exports__JNI__CreateJavaVM__ba182be51e30552971cbbdb9960f52a7ebc17ff8__62fa6fcb73a0e0d2fda77bdbf26359facfbaa734
IsolateEnterStub__JNIInvocationInterface_0024Exports__JNI__GetCreatedJavaVMs__8349780683d23085ca6fca3423ec245733e16c32__3abce4986f080175b20b8a8b5e7458bfdda881e4
IsolateEnterStub__JNIInvocationInterface_0024Exports__JNI__GetDefaultJavaVMInitArgs__8fe7b7a26fde0b5d6373df2756c2f2545cfc5fed__2c881359d3c4c7f4c4da4479a1cee5896becfb6b
IsolateEnterStub__JavaMainWrapper__run__5087f5482cc9a6abc971913ece43acb471d2631b__092e385b15f846acab22b8180eb675720c49e4f8
JNI_CreateJavaVM
JNI_GetCreatedJavaVMs
JNI_GetDefaultJavaVMInitArgs
__svm_code_section
__svm_version_info
__svm_vm_java_version
__svm_vm_target_ccompiler
__svm_vm_target_libc
__svm_vm_target_libraries
__svm_vm_target_platform
__svm_vm_target_staticlibraries
graal_attach_thread
graal_create_isolate
graal_detach_all_threads_and_tear_down_isolate
graal_detach_thread
graal_get_current_thread
graal_get_isolate
graal_tear_down_isolate
main

Sections

.text
Size: 3.0MB - Virtual size: 3.0MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 16KB - Virtual size: 13KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 912B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rodata
Size: 24KB - Virtual size: 20KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.svm_hea
Size: 3.2MB - Virtual size: 3.2MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 4KB - Virtual size: 384B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 20KB - Virtual size: 18KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6d845b3157d327700ead65e382faec7c

Headers

DLL Characteristics

File Characteristics

Imports

version

advapi32

ws2_32

userenv

kernel32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

Exports

Exports

Sections

.text Size: 3.0MB - Virtual size: 3.0MB

.rdata Size: 16KB - Virtual size: 13KB

.data Size: 8KB - Virtual size: 8KB

.pdata Size: 4KB - Virtual size: 912B

.rodata Size: 24KB - Virtual size: 20KB

.svm_hea Size: 3.2MB - Virtual size: 3.2MB

.rsrc Size: 4KB - Virtual size: 384B

.reloc Size: 20KB - Virtual size: 18KB

.text
Size: 3.0MB - Virtual size: 3.0MB

.rdata
Size: 16KB - Virtual size: 13KB

.data
Size: 8KB - Virtual size: 8KB

.pdata
Size: 4KB - Virtual size: 912B

.rodata
Size: 24KB - Virtual size: 20KB

.svm_hea
Size: 3.2MB - Virtual size: 3.2MB

.rsrc
Size: 4KB - Virtual size: 384B

.reloc
Size: 20KB - Virtual size: 18KB