094005ce2324d2894aadd68bf8c2c3bce6ec33163266ad926a9354e16a544d47N[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

094005ce2324d2894aadd68bf8c2c3bce6ec33163266ad926a9354e16a544d47N.exe
Size

1.2MB
MD5

75e5843166d3050e3d16a1705428d920
SHA1

f44a9be547aa3eac90333ae3733af30df9a8f425
SHA256

094005ce2324d2894aadd68bf8c2c3bce6ec33163266ad926a9354e16a544d47
SHA512

d8ad7c8c19118f53737b0b023ebd984208ab03a423cdc261f69594801b0786d3ae98803e7f1c8fe53ba389687818f364fd3f4170eeb7d09f3a0dab6ff9f49af9
SSDEEP

24576:Dl3ythr1wNw0YvOIk/v69MI/d01UkBHz237sefTy:DwtpqNvlq9MIS1NzO7sef

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
094005ce2324d2894aadd68bf8c2c3bce6ec33163266ad926a9354e16a544d47N.exe

Files

094005ce2324d2894aadd68bf8c2c3bce6ec33163266ad926a9354e16a544d47N.exe
.exe windows:6 windows x64 arch:x64

7eebe5e0ece1cf6217993dd20532ad17

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

nvrla.pdb

Imports

kernel32

GetCurrentProcessId
VerifyVersionInfoW
QueryPerformanceCounter
AllocConsole
CreateFileW
CreateDirectoryW
InitializeCriticalSection
EnterCriticalSection
LeaveCriticalSection
FreeLibrary
GetProcAddress
GetFileAttributesW
GetFullPathNameW
SetLastError
GetSystemDirectoryW
GetModuleFileNameW
GetModuleHandleW
LoadLibraryExW
VerSetConditionMask
WriteConsoleW
HeapSize
DeleteFileW
GetProcessHeap
SetEnvironmentVariableW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineA
GetOEMCP
GetACP
IsValidCodePage
FindNextFileW
FindFirstFileExW
FindClose
GetTimeZoneInformation
GetCurrentDirectoryW
SetEndOfFile
SetStdHandle
GetFileAttributesExW
HeapReAlloc
FlushFileBuffers
EnumSystemLocalesW
LocalFree
ResetEvent
CloseHandle
SetEvent
AttachConsole
GetLastError
CreateEventW
LocalAlloc
WaitForSingleObject
WaitForMultipleObjects
SetConsoleTitleA
GetCommandLineW
SetDefaultDllDirectories
GetModuleFileNameA
Sleep
FileTimeToSystemTime
OutputDebugStringA
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
HeapFree
HeapAlloc
GetConsoleOutputCP
ReadConsoleW
GetConsoleMode
WriteFile
SetFilePointerEx
SystemTimeToTzSpecificLocalTime
GetFileInformationByHandle
GetDriveTypeW
SetConsoleCtrlHandler
FreeLibraryAndExitThread
ExitThread
CreateThread
GetModuleHandleExW
ExitProcess
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
InitializeCriticalSectionAndSpinCount
RtlPcToFileHeader
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
FormatMessageW
GetTickCount
InitializeCriticalSectionEx
DeleteCriticalSection
QueryPerformanceFrequency
GetSystemDirectoryA
GetModuleHandleA
LoadLibraryA
MultiByteToWideChar
WideCharToMultiByte
MoveFileExA
WaitForSingleObjectEx
GetEnvironmentVariableA
GetStdHandle
GetFileType
ReadFile
PeekNamedPipe
SleepEx
CreateFileA
GetFileSizeEx
RaiseException
GetSystemInfo
VirtualProtect
VirtualQuery
LoadLibraryExA
GetCurrentThreadId
GetExitCodeThread
GetStringTypeW
EncodePointer
DecodePointer
GetLocaleInfoEx
LCMapStringEx
WakeAllConditionVariable
SleepConditionVariableSRW
GetSystemTimeAsFileTime
CompareStringEx
GetCPInfo
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
RtlUnwindEx
RtlUnwind

ole32

CoTaskMemFree

normaliz

IdnToAscii

wldap32

ord143
ord46
ord211
ord60
ord45
ord50
ord41
ord22
ord26
ord27
ord32
ord33
ord35
ord79
ord30
ord200
ord301
ord217

crypt32

CertFreeCertificateChain
CertGetCertificateChain
CertFreeCertificateChainEngine
CertCreateCertificateChainEngine
CryptQueryObject
CertGetNameStringA
CertFindExtension
CertAddCertificateContextToStore
CryptDecodeObjectEx
PFXImportCertStore
CryptStringToBinaryA
CertFreeCertificateContext
CertFindCertificateInStore
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore

ws2_32

WSASetLastError
ntohs
WSAGetLastError
closesocket
WSAWaitForMultipleEvents
WSACleanup
WSAEventSelect
WSAEnumNetworkEvents
WSACreateEvent
WSACloseEvent
send
getsockopt
WSAStartup
setsockopt
WSAIoctl
htons
socket
__WSAFDIsSet
select
accept
bind
connect
getsockname
htonl
listen
recv
getaddrinfo
freeaddrinfo
recvfrom
getpeername
sendto
gethostname
ioctlsocket
WSAResetEvent

Sections

.text
Size: 929KB - Virtual size: 929KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 215KB - Virtual size: 215KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 13KB - Virtual size: 44KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 40KB - Virtual size: 40KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

_RDATA
Size: 512B - Virtual size: 500B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 6KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

.zero
Size: 8KB - Virtual size: 4KB

IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

7eebe5e0ece1cf6217993dd20532ad17

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

ole32

normaliz

wldap32

crypt32

ws2_32

Sections

.text Size: 929KB - Virtual size: 929KB

.rdata Size: 215KB - Virtual size: 215KB

.data Size: 13KB - Virtual size: 44KB

.pdata Size: 40KB - Virtual size: 40KB

.didat Size: 512B - Virtual size: 480B

_RDATA Size: 512B - Virtual size: 500B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 6KB - Virtual size: 5KB

.zero Size: 8KB - Virtual size: 4KB

.text
Size: 929KB - Virtual size: 929KB

.rdata
Size: 215KB - Virtual size: 215KB

.data
Size: 13KB - Virtual size: 44KB

.pdata
Size: 40KB - Virtual size: 40KB

.didat
Size: 512B - Virtual size: 480B

_RDATA
Size: 512B - Virtual size: 500B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 6KB - Virtual size: 5KB

.zero
Size: 8KB - Virtual size: 4KB