5353dfa03c763063856c96d3bdc205fa8177d8f93287e10be01a4af55e680a48

Sharing

Copy URL

Twitter E-mail

General

Target

5353dfa03c763063856c96d3bdc205fa8177d8f93287e10be01a4af55e680a48
Size

1.4MB
MD5

9fb9c8cad91a0893f47272d3a80e7150
SHA1

d345429fb96b8dfb097649ca11307f2b99050c03
SHA256

5353dfa03c763063856c96d3bdc205fa8177d8f93287e10be01a4af55e680a48
SHA512

1f001269a68d05fa077adf69b112a128749583322d2fd1f90ac92a50f5881a65e34b3d739526c0607663241378a8ca9610d6d87ee46e1b03956685c099ab64a2
SSDEEP

24576:ko3JsiRZxsyB9Wz0eXLbA6WR3Az5MGxe7by1jeVeMzq1:ZsiRZxsyB9Wz0eXLbA61I0je4Mzq

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

Processes:

resource
5353dfa03c763063856c96d3bdc205fa8177d8f93287e10be01a4af55e680a48

Files

5353dfa03c763063856c96d3bdc205fa8177d8f93287e10be01a4af55e680a48
.exe windows:6 windows x64 arch:x64

516d402a64146c10887874c5046283a0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

advapi32

SystemFunction036
OpenSCManagerW
OpenServiceW
CloseServiceHandle
RevertToSelf
RegDisablePredefinedCache
RegOpenKeyExW
RegCloseKey
GetTokenInformation
OpenProcessToken
DuplicateTokenEx
OpenThreadToken
SetTokenInformation
LookupPrivilegeValueW
CreateRestrictedToken
AdjustTokenPrivileges
CreateProcessAsUserW
SetThreadToken
FreeSid
IsValidSid
GetLengthSid
ConvertStringSidToSidW
ConvertSidToStringSidW
EqualSid
GetAce
IsValidSecurityDescriptor
GetSecurityDescriptorControl
GetSecurityDescriptorOwner
GetSecurityDescriptorGroup
GetSecurityDescriptorDacl
GetSecurityDescriptorSacl
GetNamedSecurityInfoW
GetSecurityInfo
SetSecurityInfo
MapGenericMask
AccessCheck
IsValidAcl
InitializeAcl
AddMandatoryAce
BuildTrusteeWithSidW
SetEntriesInAclW
RegCreateKeyExW
RegQueryValueExW

dbghelp

SymFromAddr
SymSetOptions
SymSetSearchPathW
SymInitialize
SymGetSearchPathW
SymCleanup
SymGetLineFromAddr64

ntdll

RtlCaptureContext
RtlUnwind
RtlUnwindEx
RtlPcToFileHeader
NtWriteFile
RtlNtStatusToDosError
RtlCaptureStackBackTrace
RtlVirtualUnwind
RtlInitUnicodeString
RtlLookupFunctionEntry
NtReadFile

oleaut32

GetErrorInfo
SysStringLen
SysFreeString

shell32

SHGetKnownFolderPath

userenv

CreateAppContainerProfile
GetUserProfileDirectoryW
DeriveAppContainerSidFromAppContainerName

winmm

timeGetTime

api-ms-win-core-errorhandling-l1-1-1

AddVectoredExceptionHandler

api-ms-win-core-processthreads-l1-1-0

GetThreadId
GetStartupInfoW
TlsGetValue
GetCurrentProcessId
GetCurrentProcess
CreateRemoteThread
DeleteProcThreadAttributeList
SetThreadStackGuarantee
InitializeProcThreadAttributeList
SwitchToThread
ExitProcess
UpdateProcThreadAttribute
TerminateProcess
GetCurrentThread
GetCurrentThreadId
TlsAlloc
TlsFree
TlsSetValue
CreateThread

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter
GetLastError
SetLastError
SetUnhandledExceptionFilter
RaiseException

api-ms-win-core-heap-l1-1-0

HeapSetInformation
HeapReAlloc
HeapFree
GetProcessHeaps
HeapDestroy
GetProcessHeap
HeapAlloc
HeapSize

api-ms-win-core-errorhandling-l1-1-3

SetThreadErrorMode

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
AddDllDirectory
GetModuleFileNameW
GetModuleHandleA
GetProcAddress
SetDefaultDllDirectories
FreeLibrary
LoadLibraryExW
LoadLibraryExA
GetModuleHandleW

api-ms-win-core-handle-l1-1-0

DuplicateHandle
SetHandleInformation
CloseHandle

api-ms-win-core-synch-l1-1-0

CreateMutexA
TryAcquireSRWLockExclusive
AcquireSRWLockShared
ReleaseMutex
ReleaseSRWLockExclusive
WaitForSingleObject
ReleaseSRWLockShared
InitializeCriticalSectionAndSpinCount
CreateEventW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
CreateMutexW
SetEvent
WaitForSingleObjectEx
AcquireSRWLockExclusive

api-ms-win-core-processenvironment-l1-1-0

GetCommandLineW
ExpandEnvironmentStringsW
SetCurrentDirectoryW
SetEnvironmentVariableW
GetStdHandle
GetEnvironmentVariableW
GetCommandLineA
SetStdHandle
GetCurrentDirectoryW
GetEnvironmentStringsW
FreeEnvironmentStringsW

api-ms-win-core-console-l1-1-0

GetConsoleMode
ReadConsoleW
AllocConsole
GetConsoleOutputCP
WriteConsoleW

api-ms-win-core-string-l1-1-0

CompareStringW
GetStringTypeW
MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-profile-l1-1-0

QueryPerformanceFrequency
QueryPerformanceCounter

api-ms-win-core-localization-l1-2-0

GetACP
GetUserDefaultLangID
IsValidCodePage
EnumSystemLocalesW
GetCPInfo
LCMapStringEx
GetUserDefaultLCID
FormatMessageW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetOEMCP
GetUserDefaultLocaleName

api-ms-win-core-libraryloader-l1-2-1

LoadLibraryA
LoadLibraryW

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-file-l1-1-0

FindFirstFileExW
FlushFileBuffers
SetFilePointerEx
GetLongPathNameW
GetFileAttributesW
GetFileSizeEx
WriteFile
ReadFile
FindNextFileW
CreateFileW
SetFileInformationByHandle
GetFullPathNameW
CreateDirectoryW
GetFileInformationByHandle
GetFileType
FindFirstFileW
FindClose
GetFinalPathNameByHandleW

api-ms-win-core-file-l2-1-0

GetFileInformationByHandleEx

bcrypt

BCryptGenRandom

api-ms-win-core-console-l1-2-0

AttachConsole

api-ms-win-core-io-l1-1-0

CreateIoCompletionPort
PostQueuedCompletionStatus
GetQueuedCompletionStatus

api-ms-win-core-job-l2-1-0

SetInformationJobObject
CreateJobObjectW

api-ms-win-core-localization-l1-2-1

EnumSystemLocalesEx

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime
GetLocalTime
GetVersionExW
GetTickCount

api-ms-win-core-kernel32-legacy-l1-1-0

RegisterWaitForSingleObject

api-ms-win-core-threadpool-legacy-l1-1-0

UnregisterWaitEx

api-ms-win-core-synch-l1-2-0

SleepConditionVariableSRW
Sleep
WakeAllConditionVariable

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent
DebugBreak
OutputDebugStringA

api-ms-win-core-processthreads-l1-1-2

SetThreadInformation

api-ms-win-core-memory-l1-1-0

CreateFileMappingW
VirtualAllocEx
VirtualFree
MapViewOfFile
VirtualProtectEx
VirtualFreeEx
ReadProcessMemory
WriteProcessMemory
UnmapViewOfFile

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent
GetProcessHandleCount
GetCurrentProcessorNumber
GetProcessMitigationPolicy
SetProcessMitigationPolicy

api-ms-win-core-sysinfo-l1-2-0

GetProductInfo
GetNativeSystemInfo

api-ms-win-core-wow64-l1-1-0

IsWow64Process

api-ms-win-core-processtopology-obsolete-l1-1-0

SetThreadAffinityMask

api-ms-win-core-heap-l2-1-0

LocalFree

user32

GetUserObjectInformationW
CreateDesktopW
SetProcessWindowStation
GetThreadDesktop
CreateWindowStationW
GetProcessWindowStation
CloseWindowStation
CloseDesktop
MessageBoxA

kernel32

TerminateJobObject
QueryInformationJobObject
QueryDosDeviceW

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-util-l1-1-0

DecodePointer
EncodePointer

api-ms-win-core-fibers-l1-1-0

FlsAlloc
FlsSetValue
FlsFree
FlsGetValue

Exports

Exports

GetHandleVerifier
IsSandboxedProcess

Sections

.text
Size: 836KB - Virtual size: 836KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 228KB - Virtual size: 228KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 5KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 39KB - Virtual size: 39KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 309KB - Virtual size: 309KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 7KB - Virtual size: 6KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

516d402a64146c10887874c5046283a0

Headers

DLL Characteristics

File Characteristics

Imports

advapi32

dbghelp

ntdll

oleaut32

shell32

userenv

winmm

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-3

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-libraryloader-l1-2-1

api-ms-win-core-file-l1-2-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-file-l2-1-0

bcrypt

api-ms-win-core-console-l1-2-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-job-l2-1-0

api-ms-win-core-localization-l1-2-1

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-memory-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-sysinfo-l1-2-0

api-ms-win-core-wow64-l1-1-0

api-ms-win-core-processtopology-obsolete-l1-1-0

api-ms-win-core-heap-l2-1-0

user32

kernel32

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-fibers-l1-1-0

Exports

Exports

Sections

.text Size: 836KB - Virtual size: 836KB

.rdata Size: 228KB - Virtual size: 228KB

.data Size: 5KB - Virtual size: 19KB

.pdata Size: 39KB - Virtual size: 39KB

.rsrc Size: 309KB - Virtual size: 309KB

.reloc Size: 7KB - Virtual size: 6KB

.text
Size: 836KB - Virtual size: 836KB

.rdata
Size: 228KB - Virtual size: 228KB

.data
Size: 5KB - Virtual size: 19KB

.pdata
Size: 39KB - Virtual size: 39KB

.rsrc
Size: 309KB - Virtual size: 309KB

.reloc
Size: 7KB - Virtual size: 6KB