86e8265d6b499bae9046d4530e26fe0565f8b58f3b8269064ffe6a908018b354[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

86e8265d6b499bae9046d4530e26fe0565f8b58f3b8269064ffe6a908018b354.exe
Size

14.2MB
MD5

c5d36c7404a03ec6df8024737d97a0c8
SHA1

9a213e487337376c38e0cfdac240dc6ffb5fdc1e
SHA256

86e8265d6b499bae9046d4530e26fe0565f8b58f3b8269064ffe6a908018b354
SHA512

812a21f479c56716d892df32a1f910b41310f74de13641d93654a0a722705fb90e114081f2af2ef8c4717febb05715183c0d6deb36bb135f819553c9a9e49216
SSDEEP

196608:MUehdkSzJ4bvuLE5rUSW9rWWsPbWIBMWRlHbLVb4zH:M94x5r1CrWWsTWIfN8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
86e8265d6b499bae9046d4530e26fe0565f8b58f3b8269064ffe6a908018b354.exe

Files

86e8265d6b499bae9046d4530e26fe0565f8b58f3b8269064ffe6a908018b354.exe
.exe windows:6 windows x64 arch:x64

a0f58d96494ecd8101f0c759318da60c

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

version

VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW

advapi32

RegCloseKey
RegEnumKeyExA
GetUserNameW
OpenProcessToken
RegOpenKeyExA
RegOpenKeyExW
RegQueryInfoKeyA
RegQueryValueExA
RegQueryValueExW

ws2_32

closesocket
getaddrinfo
freeaddrinfo
socket
ntohl
WSAStartup
gethostname

userenv

GetUserProfileDirectoryW

kernel32

WaitForSingleObject
WakeAllConditionVariable
WriteFile
GetTimeZoneInformation
GetDynamicTimeZoneInformation
MultiByteToWideChar
GetLocaleInfoA
GetGeoInfoA
GetUserGeoID
GetUserDefaultLCID
SetLastError
SetHandleInformation
GetFileSizeEx
ReadFile
SetFilePointerEx
FindClose
FindFirstFileW
FindNextFileW
GetDriveTypeW
GetFileAttributesW
GetFileAttributesExW
GetFileInformationByHandle
GetFullPathNameW
GlobalMemoryStatusEx
DeviceIoControl
FormatMessageW
VirtualQuery
GetEnvironmentStrings
GetEnvironmentStringsW
FreeEnvironmentStringsA
FreeEnvironmentStringsW
WaitForMultipleObjects
GetProcessTimes
GetCurrentProcessId
TerminateProcess
GetExitCodeProcess
OpenProcess
GetHandleInformation
CreatePipe
CreateProcessW
GetProcessId
WideCharToMultiByte
GetConsoleWindow
GetFileType
PeekNamedPipe
GetNumberOfConsoleInputEvents
PeekConsoleInputA
GetSystemTimeAsFileTime
GetProcessAffinityMask
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
IsProcessorFeaturePresent
InitializeSListHead
IsDebuggerPresent
GetModuleHandleW
GetWindowsDirectoryW
GetVersionExA
GetTempPathW
GetSystemInfo
GetSystemDirectoryW
GetStdHandle
GetProcAddress
GetModuleHandleA
GetModuleFileNameW
GetLastError
GetCurrentThreadId
GetCurrentThread
VirtualProtect
VirtualFree
VirtualAlloc
UnmapViewOfFile
SwitchToThread
SleepConditionVariableCS
Sleep
SetEvent
ResetEvent
QueryPerformanceFrequency
QueryPerformanceCounter
GetCurrentProcess
GetCurrentDirectoryW
FlushFileBuffers
EnterCriticalSection
DuplicateHandle
CreateFileW
CreateFileMappingW
CreateEventA
CloseHandle
AddVectoredContinueHandler
LoadLibraryA
LeaveCriticalSection
InitializeCriticalSection
GetModuleHandleExW
InitializeConditionVariable

vcruntime140

memcpy
__current_exception
wcschr
__C_specific_handler
memset
__current_exception_context

api-ms-win-crt-runtime-l1-1-0

_exit
_set_app_type
exit
terminate
_register_onexit_function
_initialize_onexit_table
_seh_filter_exe
_errno
_register_thread_local_exe_atexit_callback
_c_exit
_cexit
__p___argv
__p___argc
_initterm_e
_initterm
_get_initial_narrow_environment
_initialize_narrow_environment
_configure_narrow_argv
_beginthreadex
_crt_atexit

api-ms-win-crt-string-l1-1-0

strcmp
wcscpy
isdigit
wcscmp
iswctype
strcpy
_strdup
wcsncat
towupper
wcsncmp
wcslen
_wcsupr
strlen
wcscat

api-ms-win-crt-environment-l1-1-0

_wgetdcwd
_wgetenv
_wgetcwd

api-ms-win-crt-heap-l1-1-0

malloc
free
_set_new_mode
calloc

api-ms-win-crt-convert-l1-1-0

wcstombs
strtoull

api-ms-win-crt-stdio-l1-1-0

_set_fmode
__acrt_iob_func
__stdio_common_vfprintf
__stdio_common_vsprintf
fputs
__stdio_common_vswprintf
__p__commode

api-ms-win-crt-filesystem-l1-1-0

_wfullpath

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

iphlpapi

ConvertLengthToIpv4Mask
ConvertInterfaceLuidToNameW
ConvertInterfaceNameToLuidW
GetIfEntry2
GetUnicastIpAddressTable
GetAnycastIpAddressTable
FreeMibTable

Exports

Exports

IsolateEnterStub__CEntryPointNativeFunctions__attachThread__LWiahz8fydJWgxqffuaEC2
IsolateEnterStub__CEntryPointNativeFunctions__createIsolate__aVxZJEvxfd8FslyQXMlHNI
IsolateEnterStub__CEntryPointNativeFunctions__detachAllThreadsAndTearDownIsolate__OPBluFOA7k6a9G1cqb6TTL
IsolateEnterStub__CEntryPointNativeFunctions__detachThread__vZogK8TBGAIeNIWWaZu2QH
IsolateEnterStub__CEntryPointNativeFunctions__getCurrentThread__p19YkdKU3I3cgUmQuiiTd0
IsolateEnterStub__CEntryPointNativeFunctions__getIsolate__4JMPcmfHydBLuvj7ff2do8
IsolateEnterStub__CEntryPointNativeFunctions__tearDownIsolate__I3DVyDKs6z4vL79kJC9BEE
IsolateEnterStub__JNIInvocationInterface_0024Exports__JNI__CreateJavaVM__zfv8XhXAFhERNPUoh38uvF
IsolateEnterStub__JNIInvocationInterface_0024Exports__JNI__GetCreatedJavaVMs__jTTCq2UmbC48XDHPdLhle5
IsolateEnterStub__JNIInvocationInterface_0024Exports__JNI__GetDefaultJavaVMInitArgs__8P9gtUmW2O2BqcAmkyOH99
IsolateEnterStub__JavaMainWrapper__run__cXbfAhOWcF90761nQYco7L
JNI_CreateJavaVM
JNI_GetCreatedJavaVMs
JNI_GetDefaultJavaVMInitArgs
__svm_code_section
__svm_version_info
__svm_vm_java_version
__svm_vm_target_ccompiler
__svm_vm_target_libc
__svm_vm_target_libraries
__svm_vm_target_platform
__svm_vm_target_staticlibraries
graal_attach_thread
graal_create_isolate
graal_detach_all_threads_and_tear_down_isolate
graal_detach_thread
graal_get_current_thread
graal_get_isolate
graal_tear_down_isolate
main

Sections

.text
Size: 7.1MB - Virtual size: 7.1MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 8KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rodata
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.svm_hea
Size: 6.9MB - Virtual size: 6.9MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 44KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

a0f58d96494ecd8101f0c759318da60c

Headers

DLL Characteristics

File Characteristics

Imports

version

advapi32

ws2_32

userenv

kernel32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

iphlpapi

Exports

Exports

Sections

.text Size: 7.1MB - Virtual size: 7.1MB

.rdata Size: 32KB - Virtual size: 30KB

.data Size: 8KB - Virtual size: 9KB

.pdata Size: 4KB - Virtual size: 2KB

.rodata Size: 44KB - Virtual size: 40KB

.svm_hea Size: 6.9MB - Virtual size: 6.9MB

.reloc Size: 44KB - Virtual size: 40KB

.text
Size: 7.1MB - Virtual size: 7.1MB

.rdata
Size: 32KB - Virtual size: 30KB

.data
Size: 8KB - Virtual size: 9KB

.pdata
Size: 4KB - Virtual size: 2KB

.rodata
Size: 44KB - Virtual size: 40KB

.svm_hea
Size: 6.9MB - Virtual size: 6.9MB

.reloc
Size: 44KB - Virtual size: 40KB