6ceb87834d4311d744d08a083185bf1ceddd624ae64bae4c2d03c0d5eb8d37f0N[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

6ceb87834d4311d744d08a083185bf1ceddd624ae64bae4c2d03c0d5eb8d37f0N.exe
Size

523KB
MD5

d9c7f6a0e838a60a33d151ace86cc500
SHA1

ecf8c1eac0c270d2683973830725bf0a3a2a037c
SHA256

6ceb87834d4311d744d08a083185bf1ceddd624ae64bae4c2d03c0d5eb8d37f0
SHA512

ffc58960b50f59804d9c0e608447eac513eb94b096edc9f88e80546124af564c220f0ebecf8fbff1c363a218381f1fd5cdb67c064095101bfeb0a275ca464c22
SSDEEP

12288:VZt0TZ2J8Xd413Z1+RUtCLcEcfOqBbBjvrEH7S:bYXdq/+FczGmhrEH7S

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6ceb87834d4311d744d08a083185bf1ceddd624ae64bae4c2d03c0d5eb8d37f0N.exe

Files

6ceb87834d4311d744d08a083185bf1ceddd624ae64bae4c2d03c0d5eb8d37f0N.exe
.exe windows:5 windows x86 arch:x86

952269c05bc69baf9f42d1e45b75825b

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

D:\MyProject\CTAudPf (20200312 v3.97.09)\Src\Release\CTAudSvc.pdb

Imports

kernel32

VirtualFree
VirtualAlloc
GetStdHandle
GetModuleFileNameA
InitializeCriticalSectionAndSpinCount
FreeEnvironmentStringsA
GetEnvironmentStrings
FreeEnvironmentStringsW
GetEnvironmentStringsW
SetHandleCount
GetFileType
GetStartupInfoA
QueryPerformanceCounter
GetTickCount
GetSystemTimeAsFileTime
LCMapStringA
LCMapStringW
GetStringTypeA
GetStringTypeW
GetLocaleInfoA
HeapCreate
GetConsoleCP
GetConsoleMode
SetStdHandle
WriteConsoleA
GetConsoleOutputCP
WriteConsoleW
CreateFileA
OutputDebugStringW
OutputDebugStringA
GetProcessHeap
lstrcpynW
lstrcatA
lstrcpyA
OpenFile
lstrcpynA
IsValidCodePage
LoadLibraryExW
GetOEMCP
GetACP
GetCPInfo
HeapSize
CreateThread
lstrlenW
HeapReAlloc
RaiseException
RtlUnwind
GetCommandLineA
ExitProcess
HeapAlloc
HeapFree
IsDebuggerPresent
SetUnhandledExceptionFilter
UnhandledExceptionFilter
TerminateProcess
GetPrivateProfileStringW
WritePrivateProfileStringW
GetPrivateProfileIntW
GetCurrentThread
ConvertDefaultLocale
EnumResourceLanguagesW
GetLocaleInfoW
InterlockedExchange
GetModuleHandleA
CreateFileW
FlushFileBuffers
SetFilePointer
GlobalFlags
GlobalAddAtomW
GlobalFindAtomW
GlobalDeleteAtom
LoadLibraryW
LoadLibraryA
lstrcmpW
GetVersionExA
lstrlenA
lstrcmpA
InterlockedIncrement
WaitForSingleObject
GetCurrentThreadId
MultiByteToWideChar
WideCharToMultiByte
GetCurrentProcessId
FreeLibrary
FindResourceW
LoadResource
LockResource
SizeofResource
InterlockedDecrement
GetModuleHandleW
GetProcAddress
TlsFree
DeleteCriticalSection
LocalReAlloc
TlsSetValue
TlsAlloc
InitializeCriticalSection
GlobalAlloc
GlobalHandle
GlobalUnlock
GlobalReAlloc
GlobalLock
EnterCriticalSection
TlsGetValue
LeaveCriticalSection
LocalAlloc
SetLastError
LocalFree
SetConsoleCtrlHandler
GlobalFree
GetModuleFileNameW
FormatMessageW
Sleep
GetCommandLineW
CloseHandle
WaitForMultipleObjects
CreateEventW
ResetEvent
GetLastError
DisconnectNamedPipe
ReadFile
WriteFile
CreateNamedPipeW
ConnectNamedPipe
SetEvent
GetCurrentProcess
SetPriorityClass
lstrcpyW
lstrcatW
lstrcmpiW

user32

CharLowerBuffA
wsprintfA
wsprintfW
SetCursor
PostQuitMessage
GrayStringW
DrawTextExW
DrawTextW
TabbedTextOutW
GetDesktopWindow
ClientToScreen
ShowWindow
SetWindowTextW
PostMessageW
RegisterWindowMessageW
UnregisterDeviceNotification
RegisterDeviceNotificationW
LoadIconW
WinHelpW
GetCapture
GetClassLongW
GetClassNameW
SetPropW
GetPropW
RemovePropW
IsWindow
GetForegroundWindow
GetDlgItem
GetTopWindow
DestroyWindow
GetMessageTime
GetMessagePos
MapWindowPoints
SetMenu
SetForegroundWindow
GetClientRect
CreateWindowExW
GetClassInfoExW
UnhookWindowsHookEx
MessageBoxW
EnableWindow
IsWindowEnabled
GetLastActivePopup
GetWindowLongW
GetParent
SendMessageW
DestroyMenu
GetWindowThreadProcessId
GetSubMenu
GetMenuItemCount
GetMenuItemID
GetMenuState
ValidateRect
GetCursorPos
PeekMessageW
GetClassInfoW
RegisterClassW
AdjustWindowRectEx
GetDlgCtrlID
DefWindowProcW
CallWindowProcW
CopyRect
PtInRect
GetMenu
SetWindowLongW
SetWindowPos
SystemParametersInfoA
IsIconic
GetWindowPlacement
GetWindowRect
GetWindow
SetMenuItemBitmaps
GetMenuCheckMarkDimensions
LoadBitmapW
GetFocus
ModifyMenuW
EnableMenuItem
CheckMenuItem
GetWindowTextW
LoadCursorW
GetSystemMetrics
GetDC
ReleaseDC
GetSysColor
GetSysColorBrush
SetWindowsHookExW
CallNextHookEx
GetMessageW
TranslateMessage
DispatchMessageW
GetActiveWindow
IsWindowVisible
GetKeyState

gdi32

DeleteDC
ScaleWindowExtEx
SetWindowExtEx
ScaleViewportExtEx
SetViewportExtEx
SetViewportOrgEx
SelectObject
Escape
TextOutW
RectVisible
PtVisible
GetDeviceCaps
CreateBitmap
GetClipBox
SetTextColor
SetBkColor
DeleteObject
OffsetViewportOrgEx
ExtTextOutW
SaveDC
RestoreDC
SetMapMode
GetStockObject

winspool.drv

ClosePrinter
OpenPrinterW
DocumentPropertiesW

advapi32

StartServiceCtrlDispatcherW
CreateServiceW
RegSetValueExW
RegEnumKeyA
RegOpenKeyA
RegOpenKeyExA
RegQueryValueExA
RegEnumKeyW
RegQueryValueW
RegOpenKeyW
ControlService
ReportEventW
SetServiceStatus
QueryServiceStatus
DeregisterEventSource
RegisterServiceCtrlHandlerExW
OpenServiceW
RegisterEventSourceW
OpenSCManagerW
DeleteService
CloseServiceHandle
RegEnumValueW
RegDeleteValueW
RegOpenKeyExW
RegEnumKeyExW
RegCloseKey
InitializeSecurityDescriptor
ConvertStringSecurityDescriptorToSecurityDescriptorW
RegCreateKeyExW
RegQueryValueExW
RegQueryInfoKeyW
RegDeleteKeyW

shell32

CommandLineToArgvW

ole32

StringFromGUID2
PropVariantClear
CoInitialize
CoUninitialize
CoTaskMemAlloc
CoTaskMemFree
CLSIDFromString
StringFromCLSID
CoCreateInstance

oleaut32

VariantInit
VariantClear
VariantChangeType

dsound

ord11

shlwapi

PathFindExtensionW
PathRemoveFileSpecW
PathCombineW
PathFileExistsW
PathAppendW
StrStrIW
PathFindFileNameW
PathRemoveExtensionW
PathIsFileSpecW

oleacc

LresultFromObject
CreateStdAccessibleObject

winmm

mmioAdvance
waveOutRestart
waveOutClose
waveOutReset
waveOutWrite
waveOutPause
waveOutPrepareHeader
waveOutOpen
waveOutUnprepareHeader
mmioGetInfo
mmioSeek
mmioDescend
mmioSetInfo
mmioAscend
timeGetTime
waveOutGetNumDevs
waveOutGetDevCapsW
mmioRead
mmioWrite
mmioOpenW
mmioCreateChunk
mmioClose

crypt32

CertCloseStore
CertGetNameStringA

Sections

.text
Size: 325KB - Virtual size: 324KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 108KB - Virtual size: 108KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 11KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

952269c05bc69baf9f42d1e45b75825b

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

gdi32

winspool.drv

advapi32

shell32

ole32

oleaut32

dsound

shlwapi

oleacc

winmm

crypt32

Sections

.text Size: 325KB - Virtual size: 324KB

.rdata Size: 108KB - Virtual size: 108KB

.data Size: 11KB - Virtual size: 34KB

.rsrc Size: 1KB - Virtual size: 1KB

.text
Size: 325KB - Virtual size: 324KB

.rdata
Size: 108KB - Virtual size: 108KB

.data
Size: 11KB - Virtual size: 34KB

.rsrc
Size: 1KB - Virtual size: 1KB