27bcc1f2fd0372b20686016684c5203d572046a7aa405ed350cc442dffa58ee3

Sharing

Copy URL Twitter E-mail

General

Target

27bcc1f2fd0372b20686016684c5203d572046a7aa405ed350cc442dffa58ee3
Size

4.3MB
MD5

f9f9699ad841d75d7011c4ad0330de0b
SHA1

74c5cdfd91cf90909e90289152109750b589a154
SHA256

27bcc1f2fd0372b20686016684c5203d572046a7aa405ed350cc442dffa58ee3
SHA512

78b7138ef73efc11acf3c353740e9bf41385210319b1d1df029796cd3e414edcd1711d3817975bd5d3ed47765206a4d0094d0f2ae345515a0bcd589209c587ab
SSDEEP

49152:c1ijz2azaO2ahRte6/SJbZxpUVLsQNfnWMBzjDenoOkfr+bJPeMvmx+4etDdmcWZ:cAjzhV/qKOeS+rAPeM7PK85SI+A3G

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
27bcc1f2fd0372b20686016684c5203d572046a7aa405ed350cc442dffa58ee3

Files

27bcc1f2fd0372b20686016684c5203d572046a7aa405ed350cc442dffa58ee3
.exe windows:6 windows x64 arch:x64

6618c0fd8f2e2fa52da362d4e703eb01

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

crypt32

CertDuplicateCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertFreeCertificateContext
CertGetCertificateContextProperty
CertOpenStore

ws2_32

WSAIoctl
getpeername
__WSAFDIsSet
WSAStringToAddressA
getaddrinfo
freeaddrinfo
WSAWaitForMultipleEvents
WSAResetEvent
WSACloseEvent
socket
setsockopt
connect
inet_ntop
bind
shutdown
send
recv
WSASetLastError
getservbyname
getservbyport
gethostbyname
gethostbyaddr
ntohs
inet_ntoa
inet_addr
htons
htonl
WSAGetLastError
WSACleanup
WSAStartup
select
getsockopt
getsockname
ioctlsocket
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
closesocket

bcrypt

BCryptGenRandom

kernel32

CreateEventA
ResetEvent
HeapDestroy
EnterCriticalSection
WakeAllConditionVariable
LeaveCriticalSection
InitializeCriticalSection
DeleteCriticalSection
WaitForSingleObject
GetLastError
CloseHandle
SetLastError
InitializeSRWLock
ReleaseSRWLockExclusive
ReleaseSRWLockShared
AcquireSRWLockExclusive
AcquireSRWLockShared
GetCurrentThreadId
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
QueryPerformanceCounter
GetCurrentProcessId
GetSystemTimeAsFileTime
VirtualFree
Sleep
MultiByteToWideChar
WideCharToMultiByte
GetEnvironmentVariableW
GetACP
GetStdHandle
GetFileType
WriteFile
GetModuleHandleW
GetProcAddress
GetSystemDirectoryA
FreeLibrary
LoadLibraryA
FormatMessageA
FindClose
FindFirstFileW
FindNextFileW
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
SetEvent
CreateEventW
QueryPerformanceFrequency
GetCurrentThread
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
SleepConditionVariableSRW
IsDebuggerPresent
GetStartupInfoW
RtlUnwindEx
InterlockedPushEntrySList
RtlPcToFileHeader
RaiseException
EncodePointer
InitializeCriticalSectionAndSpinCount
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ReadFile
CreateFileW
GetDriveTypeW
GetFileInformationByHandle
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
ExitProcess
SetConsoleCtrlHandler
GetModuleFileNameW
GetCommandLineA
GetCommandLineW
HeapAlloc
HeapFree
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
CompareStringW
LCMapStringW
HeapReAlloc
FlushFileBuffers
GetConsoleOutputCP
SetFilePointerEx
GetFileSizeEx
SetStdHandle
GetCurrentDirectoryW
GetFullPathNameW
HeapSize
OutputDebugStringW
FindFirstFileExW
IsValidCodePage
GetOEMCP
GetCPInfo
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetStringTypeW
GetProcessHeap
GetTimeZoneInformation
WriteConsoleW
SetEndOfFile
CreateFileA
GetFileSize
MapViewOfFileEx
GetModuleHandleA
lstrlenA
CreateFileMappingA
SwitchToThread
GetLocalTime
UnmapViewOfFile
FindResourceExW
LoadResource
LockResource
SizeofResource
FindResourceW
LoadLibraryW
InitializeSListHead
DecodePointer
InitializeCriticalSectionEx
TryAcquireSRWLockExclusive

user32

DispatchMessageA
TranslateMessage
MsgWaitForMultipleObjects
GetProcessWindowStation
GetUserObjectInformationW
MessageBoxW
PeekMessageA

advapi32

DeregisterEventSource
CryptReleaseContext
CryptDestroyKey
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
CryptExportKey
SystemFunction036
ReportEventW
RegisterEventSourceW
CryptAcquireContextW
CryptEnumProvidersW
CryptSignHashW
CryptDestroyHash
CryptCreateHash
CryptDecrypt

shlwapi

StrChrA

winmm

timeGetTime

Sections

.text
Size: 2.8MB - Virtual size: 2.8MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 1.3MB - Virtual size: 1.3MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 28KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 114KB - Virtual size: 114KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 40KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

6618c0fd8f2e2fa52da362d4e703eb01

Headers

DLL Characteristics

File Characteristics

Imports

crypt32

ws2_32

bcrypt

kernel32

user32

advapi32

shlwapi

winmm

Sections

.text Size: 2.8MB - Virtual size: 2.8MB

.rdata Size: 1.3MB - Virtual size: 1.3MB

.data Size: 28KB - Virtual size: 46KB

.pdata Size: 114KB - Virtual size: 114KB

.reloc Size: 40KB - Virtual size: 39KB

.text
Size: 2.8MB - Virtual size: 2.8MB

.rdata
Size: 1.3MB - Virtual size: 1.3MB

.data
Size: 28KB - Virtual size: 46KB

.pdata
Size: 114KB - Virtual size: 114KB

.reloc
Size: 40KB - Virtual size: 39KB