dc05cd23fdedaa09cea1afbae9cdcd594ef250d021164e0ff84a5fed372baa3a

Sharing

Copy URL

Twitter E-mail

General

Target

dc05cd23fdedaa09cea1afbae9cdcd594ef250d021164e0ff84a5fed372baa3a
Size

1.0MB
MD5

f49c938f6dd8b2a0e19e8fcb304324ae
SHA1

fd8eba7d32f46db8b4864c5e2b7345fcaf0bc94f
SHA256

dc05cd23fdedaa09cea1afbae9cdcd594ef250d021164e0ff84a5fed372baa3a
SHA512

65b61b2c54bb91f70f75b0f9510dbf89a67044410a597e025083029e69ea2cbb02f9d8e53bfc30b4d8b6b4b2a425a84a24d1eec4dd16a280ef07f2f2360f766b
SSDEEP

24576:CQK0NaCk/WNcr+vQVWX1wFhJrzV5hiZQ29mErqQoT0z6x0Cp0:hNpkWNcCvQVU1wFR5hipEErqQg

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dc05cd23fdedaa09cea1afbae9cdcd594ef250d021164e0ff84a5fed372baa3a

Files

dc05cd23fdedaa09cea1afbae9cdcd594ef250d021164e0ff84a5fed372baa3a
.exe windows:6 windows x64 arch:x64

fa757d0a7e486d6dc7cb31e507543b18

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

D:\jenkins\workspace\CR-CLIENT-12.0.0\CR-MetaBuild-Win\cr-win-client\dist\msvs_win32\Release\x64\sym\CRWindowsClientService\CRProcessMonitor\Adobe Crash Processor.pdb

Imports

kernel32

HeapDestroy
DeleteCriticalSection
GetProcessHeap
SizeofResource
LockResource
FindResourceExW
LoadResource
FindResourceW
WideCharToMultiByte
MultiByteToWideChar
CloseHandle
CreateFileW
GetFileAttributesExW
DeleteFileW
LoadLibraryW
GetProcAddress
FreeLibrary
HeapAlloc
HeapReAlloc
GetLastError
Sleep
HeapSize
OpenProcess
WaitForSingleObject
InitializeCriticalSectionEx
CreateMutexW
GetCommandLineW
GetDiskFreeSpaceW
HeapFree
InitializeSListHead
GetStartupInfoW
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
FlushFileBuffers
GetTickCount
QueryPerformanceCounter
MapViewOfFile
CreateFileMappingW
FormatMessageA
GetSystemTime
GetSystemTimeAsFileTime
SystemTimeToFileTime
GetCurrentProcessId
GetFileSize
LockFileEx
LocalFree
UnlockFile
HeapCompact
GetSystemInfo
DeleteFileA
WaitForSingleObjectEx
LoadLibraryA
CreateFileA
FlushViewOfFile
OutputDebugStringW
GetFileAttributesA
GetDiskFreeSpaceA
FormatMessageW
GetTempPathA
HeapValidate
UnmapViewOfFile
GetFileAttributesW
GetTempPathW
UnlockFileEx
SetEndOfFile
GetFullPathNameA
SetFilePointer
LockFile
OutputDebugStringA
WriteFile
GetFullPathNameW
HeapCreate
ReadFile
AreFileApisANSI
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
TryEnterCriticalSection
GetCurrentThreadId
GetModuleHandleW
IsDebuggerPresent
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
GetCurrentProcess

shell32

CommandLineToArgvW
SHCreateDirectoryExW
SHGetKnownFolderPath

shlwapi

PathAppendW
PathFileExistsW

wininet

InternetCloseHandle
InternetConnectW
InternetOpenW
HttpSendRequestW
HttpQueryInfoW
HttpOpenRequestW

msvcp140

?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
_Xtime_get_ticks
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?uncaught_exception@std@@YA_NXZ
_Thrd_join
_Thrd_detach
_Thrd_id
_Cnd_do_broadcast_at_thread_exit
?_Xlength_error@std@@YAXPEBD@Z
?_Throw_C_error@std@@YAXH@Z
?_Xout_of_range@std@@YAXPEBD@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Throw_Cpp_error@std@@YAXH@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcmp
memcpy
memmove
_CxxThrowException
memset
strrchr
__C_specific_handler
__current_exception
__std_exception_destroy
__std_exception_copy
__std_terminate
__current_exception_context

api-ms-win-crt-runtime-l1-1-0

_cexit
_seh_filter_exe
_set_app_type
_configure_wide_argv
_initialize_wide_environment
_get_wide_winmain_command_line
_crt_atexit
_initterm_e
exit
_exit
_register_thread_local_exe_atexit_callback
_beginthreadex
_initialize_onexit_table
terminate
_errno
_initterm
_endthreadex
_invalid_parameter_noinfo_noreturn
_invalid_parameter_noinfo
_register_onexit_function
_c_exit

api-ms-win-crt-convert-l1-1-0

strtoul
atoi

api-ms-win-crt-heap-l1-1-0

_msize
free
calloc
malloc
_recalloc
_callnewh
realloc
_set_new_mode

api-ms-win-crt-string-l1-1-0

wmemcpy_s
wcsnlen
strcspn
strncmp
strcmp

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s
__stdio_common_vswprintf
__p__commode
_set_fmode
__stdio_common_vswprintf_s

api-ms-win-crt-time-l1-1-0

strftime
_localtime64_s
_gmtime64_s

api-ms-win-crt-math-l1-1-0

__setusermatherr
ceilf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

ole32

CoTaskMemFree

Sections

.text
Size: 869KB - Virtual size: 868KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 122KB - Virtual size: 121KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 14KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 37KB - Virtual size: 36KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 2KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fa757d0a7e486d6dc7cb31e507543b18

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

shell32

shlwapi

wininet

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

ole32

Sections

.text Size: 869KB - Virtual size: 868KB

.rdata Size: 122KB - Virtual size: 121KB

.data Size: 14KB - Virtual size: 16KB

.pdata Size: 37KB - Virtual size: 36KB

.rsrc Size: 2KB - Virtual size: 1KB

.reloc Size: 3KB - Virtual size: 3KB

.text
Size: 869KB - Virtual size: 868KB

.rdata
Size: 122KB - Virtual size: 121KB

.data
Size: 14KB - Virtual size: 16KB

.pdata
Size: 37KB - Virtual size: 36KB

.rsrc
Size: 2KB - Virtual size: 1KB

.reloc
Size: 3KB - Virtual size: 3KB