2a0f7dd6f2a9c6b371339f95587c70ccb28593b28cc48342f06be0616cafd1e4N[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

2a0f7dd6f2a9c6b371339f95587c70ccb28593b28cc48342f06be0616cafd1e4N.exe
Size

360KB
MD5

9f2a79ca31dc8bc18a7e51b40f63aa90
SHA1

fbe5cb2cf0d16a405a4ecb20e3f568cb6df0db15
SHA256

2a0f7dd6f2a9c6b371339f95587c70ccb28593b28cc48342f06be0616cafd1e4
SHA512

6568f0a88aa2d3fbabf0f8c8c96439b513402d6da2dd21f1caaa1ac563c54fef57f3d8574b12f49e0eb2be9e0dca8bcd0fb6ae065f63d37bd2a645d9763b38cb
SSDEEP

6144:pOFauWAtQakFMzYWR55OARSAHWTICRsY+cn9kXol0KzKcjsSpRqp/:N6QxFrWRDS1TIq9nfl084p/

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2a0f7dd6f2a9c6b371339f95587c70ccb28593b28cc48342f06be0616cafd1e4N.exe

Files

2a0f7dd6f2a9c6b371339f95587c70ccb28593b28cc48342f06be0616cafd1e4N.exe
.dll windows:4 windows x86 arch:x86

61c1f6954336b62be791f914a4ea44a9

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

libgcc_s_dw2-1

__deregister_frame_info
__divdi3
__divmoddi4
__register_frame_info

kernel32

CloseHandle
CreateDirectoryA
CreateFileA
CreateFileMappingA
DeleteCriticalSection
DeleteFileA
EnterCriticalSection
FindClose
FindFirstFileA
FindNextFileA
FlushFileBuffers
FormatMessageA
FreeLibrary
GetFileAttributesA
GetFileAttributesExA
GetFileSizeEx
GetLastError
GetLocalTime
GetModuleHandleA
GetModuleHandleW
GetProcAddress
GetSystemTimeAsFileTime
GetTempPathA
InitializeCriticalSection
IsDBCSLeadByteEx
LeaveCriticalSection
LoadLibraryA
LocalFree
LockFile
MapViewOfFile
MoveFileA
MultiByteToWideChar
ReadFile
RemoveDirectoryA
ReplaceFileA
SetFilePointerEx
Sleep
TlsGetValue
UnlockFile
UnmapViewOfFile
VirtualProtect
VirtualQuery
WideCharToMultiByte
WriteFile

msvcrt

__mb_cur_max
_amsg_exit
_errno
_initterm
_iob
_lock
_splitpath_s
_strdup
_unlock
abort
atoi
calloc
fclose
fflush
fopen
fputc
free
fwrite
getenv
localeconv
malloc
memcpy
memmove
memset
memcmp
realloc
setlocale
strchr
strerror
strlen
strncmp
strrchr
vfprintf
wcslen

libwinpthread-1

nanosleep
pthread_mutex_destroy
pthread_mutex_init
pthread_mutex_lock
pthread_mutex_unlock
pthread_self

libstdc++-6

_ZNKSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE5rfindEcj
_ZNSo3putEc
_ZNSo9_M_insertImEERSoT_
_ZNSo9_M_insertIyEERSoT_
_ZNSolsEi
_ZNSt18condition_variable10notify_allEv
_ZNSt18condition_variable10notify_oneEv
_ZNSt18condition_variable4waitERSt11unique_lockISt5mutexE
_ZNSt18condition_variableC1Ev
_ZNSt18condition_variableD1Ev
_ZNSt6localeC1Ev
_ZNSt6localeD1Ev
_ZNSt6thread15_M_start_threadESt10unique_ptrINS_6_StateESt14default_deleteIS1_EEPFvvE
_ZNSt6thread6_StateD2Ev
_ZNSt6thread6detachEv
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE10_M_replaceEjjPKcj
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE4swapERS4_
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE6resizeEjc
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE7reserveEj
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE9_M_appendEPKcj
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE9_M_assignERKS4_
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE9_M_createERjj
_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEE9_M_mutateEjjPKcj
_ZNSt8ios_baseC2Ev
_ZNSt8ios_baseD2Ev
_ZNSt9basic_iosIcSt11char_traitsIcEE4initEPSt15basic_streambufIcS1_E
_ZSt16__ostream_insertIcSt11char_traitsIcEERSt13basic_ostreamIT_T0_ES6_PKS3_i
_ZSt17__throw_bad_allocv
_ZSt18_Rb_tree_decrementPSt18_Rb_tree_node_base
_ZSt18_Rb_tree_incrementPKSt18_Rb_tree_node_base
_ZSt18_Rb_tree_incrementPSt18_Rb_tree_node_base
_ZSt19__throw_logic_errorPKc
_ZSt20__throw_length_errorPKc
_ZSt20__throw_system_errori
_ZSt28_Rb_tree_rebalance_for_erasePSt18_Rb_tree_node_baseRS_
_ZSt28__throw_bad_array_new_lengthv
_ZSt29_Rb_tree_insert_and_rebalancebPSt18_Rb_tree_node_baseS0_RS_
_ZSt9terminatev
_ZTTNSt7__cxx1118basic_stringstreamIcSt11char_traitsIcESaIcEEE
_ZTTNSt7__cxx1119basic_ostringstreamIcSt11char_traitsIcESaIcEEE
_ZTVNSt7__cxx1115basic_stringbufIcSt11char_traitsIcESaIcEEE
_ZTVNSt7__cxx1118basic_stringstreamIcSt11char_traitsIcESaIcEEE
_ZTVNSt7__cxx1119basic_ostringstreamIcSt11char_traitsIcESaIcEEE
_ZTVSt15basic_streambufIcSt11char_traitsIcEE
_ZTVSt9basic_iosIcSt11char_traitsIcEE
_ZdaPv
_ZdlPv
_Znaj
_Znwj
__cxa_guard_acquire
__cxa_guard_release

Exports

Exports

_ZN7leveldb10ComparatorD0Ev
_ZN7leveldb10ComparatorD1Ev
_ZN7leveldb10ComparatorD2Ev
_ZN7leveldb10EnvWrapperD0Ev
_ZN7leveldb10EnvWrapperD1Ev
_ZN7leveldb10EnvWrapperD2Ev
_ZN7leveldb10WriteBatch3PutERKNS_5SliceES3_
_ZN7leveldb10WriteBatch5ClearEv
_ZN7leveldb10WriteBatch6AppendERKS0_
_ZN7leveldb10WriteBatch6DeleteERKNS_5SliceE
_ZN7leveldb10WriteBatch7HandlerD0Ev
_ZN7leveldb10WriteBatch7HandlerD1Ev
_ZN7leveldb10WriteBatch7HandlerD2Ev
_ZN7leveldb10WriteBatchC1Ev
_ZN7leveldb10WriteBatchC2Ev
_ZN7leveldb10WriteBatchD1Ev
_ZN7leveldb10WriteBatchD2Ev
_ZN7leveldb11NewLRUCacheEj
_ZN7leveldb12FilterPolicyD0Ev
_ZN7leveldb12FilterPolicyD1Ev
_ZN7leveldb12FilterPolicyD2Ev
_ZN7leveldb12TableBuilder10WriteBlockEPNS_12BlockBuilderEPNS_11BlockHandleE
_ZN7leveldb12TableBuilder13ChangeOptionsERKNS_7OptionsE
_ZN7leveldb12TableBuilder13WriteRawBlockERKNS_5SliceENS_15CompressionTypeEPNS_11BlockHandleE
_ZN7leveldb12TableBuilder3AddERKNS_5SliceES3_
_ZN7leveldb12TableBuilder5FlushEv
_ZN7leveldb12TableBuilder6FinishEv
_ZN7leveldb12TableBuilder7AbandonEv
_ZN7leveldb12TableBuilderC1ERKNS_7OptionsEPNS_12WritableFileE
_ZN7leveldb12TableBuilderC2ERKNS_7OptionsEPNS_12WritableFileE
_ZN7leveldb12TableBuilderD1Ev
_ZN7leveldb12TableBuilderD2Ev
_ZN7leveldb12WritableFileD0Ev
_ZN7leveldb12WritableFileD1Ev
_ZN7leveldb12WritableFileD2Ev
_ZN7leveldb14SequentialFileD0Ev
_ZN7leveldb14SequentialFileD1Ev
_ZN7leveldb14SequentialFileD2Ev
_ZN7leveldb16NewEmptyIteratorEv
_ZN7leveldb16NewErrorIteratorERKNS_6StatusE
_ZN7leveldb16RandomAccessFileD0Ev
_ZN7leveldb16RandomAccessFileD1Ev
_ZN7leveldb16RandomAccessFileD2Ev
_ZN7leveldb16ReadFileToStringEPNS_3EnvERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEPS7_
_ZN7leveldb17WriteStringToFileEPNS_3EnvERKNS_5SliceERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEE
_ZN7leveldb18BytewiseComparatorEv
_ZN7leveldb20NewBloomFilterPolicyEi
_ZN7leveldb2DB3PutERKNS_12WriteOptionsERKNS_5SliceES6_
_ZN7leveldb2DB4OpenERKNS_7OptionsERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEPPS0_
_ZN7leveldb2DB6DeleteERKNS_12WriteOptionsERKNS_5SliceE
_ZN7leveldb2DBD0Ev
_ZN7leveldb2DBD1Ev
_ZN7leveldb2DBD2Ev
_ZN7leveldb3Env10DeleteFileERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEE
_ZN7leveldb3Env10RemoveFileERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEE
_ZN7leveldb3Env17NewAppendableFileERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEPPNS_12WritableFileE
_ZN7leveldb3Env7DefaultEv
_ZN7leveldb3Env9DeleteDirERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEE
_ZN7leveldb3Env9RemoveDirERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEE
_ZN7leveldb3EnvC1Ev
_ZN7leveldb3EnvC2Ev
_ZN7leveldb3EnvD0Ev
_ZN7leveldb3EnvD1Ev
_ZN7leveldb3EnvD2Ev
_ZN7leveldb5CacheD0Ev
_ZN7leveldb5CacheD1Ev
_ZN7leveldb5CacheD2Ev
_ZN7leveldb5Table10ReadFilterERKNS_5SliceE
_ZN7leveldb5Table11BlockReaderEPvRKNS_11ReadOptionsERKNS_5SliceE
_ZN7leveldb5Table11InternalGetERKNS_11ReadOptionsERKNS_5SliceEPvPFvS7_S6_S6_E
_ZN7leveldb5Table4OpenERKNS_7OptionsEPNS_16RandomAccessFileEyPPS0_
_ZN7leveldb5Table8ReadMetaERKNS_6FooterE
_ZN7leveldb5TableD1Ev
_ZN7leveldb5TableD2Ev
_ZN7leveldb6LoggerD0Ev
_ZN7leveldb6LoggerD1Ev
_ZN7leveldb6LoggerD2Ev
_ZN7leveldb6Status9CopyStateEPKc
_ZN7leveldb6StatusC1ENS0_4CodeERKNS_5SliceES4_
_ZN7leveldb6StatusC1ERKS0_
_ZN7leveldb6StatusC2ENS0_4CodeERKNS_5SliceES4_
_ZN7leveldb6StatusC2ERKS0_
_ZN7leveldb6StatusaSEOS0_
_ZN7leveldb6StatusaSERKS0_
_ZN7leveldb7OptionsC1Ev
_ZN7leveldb7OptionsC2Ev
_ZN7leveldb8DumpFileEPNS_3EnvERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEEPNS_12WritableFileE
_ZN7leveldb8FileLockD0Ev
_ZN7leveldb8FileLockD1Ev
_ZN7leveldb8FileLockD2Ev
_ZN7leveldb8Iterator15RegisterCleanupEPFvPvS1_ES1_S1_
_ZN7leveldb8IteratorC1Ev
_ZN7leveldb8IteratorC2Ev
_ZN7leveldb8IteratorD0Ev
_ZN7leveldb8IteratorD1Ev
_ZN7leveldb8IteratorD2Ev
_ZN7leveldb8RepairDBERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEERKNS_7OptionsE
_ZN7leveldb8SnapshotD0Ev
_ZN7leveldb8SnapshotD1Ev
_ZN7leveldb8SnapshotD2Ev
_ZN7leveldb9DestroyDBERKNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEERKNS_7OptionsE
_ZN7leveldb9NewMemEnvEPNS_3EnvE
_ZNK7leveldb10WriteBatch15ApproximateSizeEv
_ZNK7leveldb10WriteBatch7IterateEPNS0_7HandlerE
_ZNK7leveldb12TableBuilder10NumEntriesEv
_ZNK7leveldb12TableBuilder6statusEv
_ZNK7leveldb12TableBuilder8FileSizeEv
_ZNK7leveldb5Slice7compareERKS0_
_ZNK7leveldb5Table11NewIteratorERKNS_11ReadOptionsE
_ZNK7leveldb5Table19ApproximateOffsetOfERKNS_5SliceE
_ZNK7leveldb6Status8ToStringB5cxx11Ev
_ZTVN7leveldb10ComparatorE
_ZTVN7leveldb10EnvWrapperE
_ZTVN7leveldb10WriteBatch7HandlerE
_ZTVN7leveldb12FilterPolicyE
_ZTVN7leveldb12WritableFileE
_ZTVN7leveldb14SequentialFileE
_ZTVN7leveldb16RandomAccessFileE
_ZTVN7leveldb2DBE
_ZTVN7leveldb3EnvE
_ZTVN7leveldb5CacheE
_ZTVN7leveldb6LoggerE
_ZTVN7leveldb8FileLockE
_ZTVN7leveldb8IteratorE
_ZTVN7leveldb8SnapshotE
leveldb_approximate_sizes
leveldb_cache_create_lru
leveldb_cache_destroy
leveldb_close
leveldb_compact_range
leveldb_comparator_create
leveldb_comparator_destroy
leveldb_create_default_env
leveldb_create_iterator
leveldb_create_snapshot
leveldb_delete
leveldb_destroy_db
leveldb_env_destroy
leveldb_env_get_test_directory
leveldb_filterpolicy_create
leveldb_filterpolicy_create_bloom
leveldb_filterpolicy_destroy
leveldb_free
leveldb_get
leveldb_iter_destroy
leveldb_iter_get_error
leveldb_iter_key
leveldb_iter_next
leveldb_iter_prev
leveldb_iter_seek
leveldb_iter_seek_to_first
leveldb_iter_seek_to_last
leveldb_iter_valid
leveldb_iter_value
leveldb_major_version
leveldb_minor_version
leveldb_open
leveldb_options_create
leveldb_options_destroy
leveldb_options_set_block_restart_interval
leveldb_options_set_block_size
leveldb_options_set_cache
leveldb_options_set_comparator
leveldb_options_set_compression
leveldb_options_set_create_if_missing
leveldb_options_set_env
leveldb_options_set_error_if_exists
leveldb_options_set_filter_policy
leveldb_options_set_info_log
leveldb_options_set_max_file_size
leveldb_options_set_max_open_files
leveldb_options_set_paranoid_checks
leveldb_options_set_write_buffer_size
leveldb_property_value
leveldb_put
leveldb_readoptions_create
leveldb_readoptions_destroy
leveldb_readoptions_set_fill_cache
leveldb_readoptions_set_snapshot
leveldb_readoptions_set_verify_checksums
leveldb_release_snapshot
leveldb_repair_db
leveldb_write
leveldb_writebatch_append
leveldb_writebatch_clear
leveldb_writebatch_create
leveldb_writebatch_delete
leveldb_writebatch_destroy
leveldb_writebatch_iterate
leveldb_writebatch_put
leveldb_writeoptions_create
leveldb_writeoptions_destroy
leveldb_writeoptions_set_sync

Sections

.text
Size: 273KB - Virtual size: 273KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 76B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 17KB - Virtual size: 17KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

/4
Size: 47KB - Virtual size: 46KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 2KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 8KB - Virtual size: 8KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 44B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 8B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

61c1f6954336b62be791f914a4ea44a9

Headers

DLL Characteristics

File Characteristics

Imports

libgcc_s_dw2-1

kernel32

msvcrt

libwinpthread-1

libstdc++-6

Exports

Exports

Sections

.text Size: 273KB - Virtual size: 273KB

.data Size: 512B - Virtual size: 76B

.rdata Size: 17KB - Virtual size: 17KB

/4 Size: 47KB - Virtual size: 46KB

.bss Size: - Virtual size: 2KB

.edata Size: 8KB - Virtual size: 8KB

.idata Size: 5KB - Virtual size: 5KB

.CRT Size: 512B - Virtual size: 44B

.tls Size: 512B - Virtual size: 8B

.reloc Size: 6KB - Virtual size: 5KB

.text
Size: 273KB - Virtual size: 273KB

.data
Size: 512B - Virtual size: 76B

.rdata
Size: 17KB - Virtual size: 17KB

/4
Size: 47KB - Virtual size: 46KB

.bss
Size: - Virtual size: 2KB

.edata
Size: 8KB - Virtual size: 8KB

.idata
Size: 5KB - Virtual size: 5KB

.CRT
Size: 512B - Virtual size: 44B

.tls
Size: 512B - Virtual size: 8B

.reloc
Size: 6KB - Virtual size: 5KB