94f8381d594aba6c3e437775705df6eba8a728403b8063a58b7da54b7ebd00e4N[.]exe

Sharing

Copy URL

Twitter E-mail

General

Target

94f8381d594aba6c3e437775705df6eba8a728403b8063a58b7da54b7ebd00e4N.exe
Size

643KB
MD5

512487411fc46cb1df352576c326c1b0
SHA1

4f8ebee58fe1a34e44f14d3d5b82c115b62a31eb
SHA256

94f8381d594aba6c3e437775705df6eba8a728403b8063a58b7da54b7ebd00e4
SHA512

32125555f8bc434f79c40d824fb4a451358fc2f0e838f73a658215ed8d4f978d8939e8e4ccab94e49aecf3a1900beb5a248c8d4bc882fe56fd4993ba55970028
SSDEEP

12288:oj32cnr9X6oq8UtOhVUAS/5M74xSkEoedy9cHN5H1dCTD+:A2cnr9X7ZhKASBuPkEoUEINF7

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
94f8381d594aba6c3e437775705df6eba8a728403b8063a58b7da54b7ebd00e4N.exe

Files

94f8381d594aba6c3e437775705df6eba8a728403b8063a58b7da54b7ebd00e4N.exe
.exe windows:10 windows x86 arch:x86

63b6d640ef299e8f8898cea09b8aa342

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

cmd.pdb

Imports

msvcrt

??1type_info@@UAE@XZ
memmove
_local_unwind4
_setjmp3
memcmp
memmove_s
_purecall
_wpopen
_controlfp
?terminate@@YAXXZ
__CxxFrameHandler3
_except_handler4_common
_onexit
__dllonexit
_unlock
_lock
_initterm
__setusermatherr
__p__fmode
_cexit
longjmp
??3@YAXPAX@Z
_wcsnicmp
__set_app_type
__getmainargs
wcstol
_get_osfhandle
_amsg_exit
_getch
__p__commode
_XcptFilter
calloc
free
_wcslwr
qsort
_dup2
_dup
_close
_open_osfhandle
_ultoa
swscanf
_ultoa_s
_pipe
wcsncmp
_setmode
towupper
exit
iswxdigit
time
srand
_wtol
memcpy_s
fflush
wcsstr
iswalpha
wcstoul
feof
wcsspn
_tell
_errno
??_V@YAXPAX@Z
printf
rand
fprintf
wcsrchr
realloc
towlower
_exit
setlocale
_wcsupr
iswdigit
_wcsicmp
iswspace
wcschr
fgets
_pclose
_vsnwprintf
ferror
__iob_func
malloc
_callnewh
??0exception@@QAE@ABQBD@Z
??0exception@@QAE@ABQBDH@Z
??0exception@@QAE@ABV0@@Z
??1exception@@UAE@XZ
?what@exception@@UBEPBDXZ
_CxxThrowException
memcpy
memset

ntdll

NtOpenProcessToken
NtQueryInformationToken
NtClose
NtOpenThreadToken
NtFsControlFile
RtlDosPathNameToNtPathName_U
RtlFindLeastSignificantBit
RtlFreeHeap
RtlReleaseRelativeName
NtOpenFile
RtlDosPathNameToRelativeNtPathName_U_WithStatus
NtSetInformationFile
NtQueryVolumeInformationFile
NtSetInformationProcess
NtQueryInformationProcess
RtlNtStatusToDosError
NtCancelSynchronousIoFile
RtlCreateUnicodeStringFromAsciiz
RtlFreeUnicodeString

api-ms-win-core-kernel32-legacy-l1-1-0

GetConsoleWindow
CopyFileW

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW
GetProcAddress
GetModuleFileNameW
LoadLibraryExW
GetModuleHandleExW
GetModuleFileNameA

api-ms-win-core-synch-l1-1-0

ReleaseMutex
CreateSemaphoreExW
ReleaseSRWLockExclusive
InitializeCriticalSection
TryAcquireSRWLockExclusive
DeleteCriticalSection
InitializeCriticalSectionEx
LeaveCriticalSection
ReleaseSemaphore
AcquireSRWLockExclusive
WaitForSingleObjectEx
EnterCriticalSection
OpenSemaphoreW
AcquireSRWLockShared
ReleaseSRWLockShared
CreateMutexExW
WaitForSingleObject

api-ms-win-core-heap-l1-1-0

GetProcessHeap
HeapReAlloc
HeapFree
HeapSize
HeapAlloc
HeapSetInformation

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter
UnhandledExceptionFilter
SetErrorMode
GetLastError
SetLastError

api-ms-win-core-threadpool-l1-2-0

CloseThreadpoolTimer
SetThreadpoolTimer
CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks

api-ms-win-core-processthreads-l1-1-0

TerminateProcess
CreateProcessW
CreateProcessAsUserW
GetStartupInfoW
OpenThread
UpdateProcThreadAttribute
InitializeProcThreadAttributeList
GetExitCodeProcess
GetCurrentProcessId
GetCurrentThreadId
DeleteProcThreadAttributeList
ResumeThread
GetCurrentProcess

api-ms-win-core-localization-l1-2-0

SetThreadLocale
GetUserDefaultLCID
GetACP
GetCPInfo
GetLocaleInfoW
GetThreadLocale
FormatMessageW

api-ms-win-core-debug-l1-1-0

DebugBreak
OutputDebugStringW
IsDebuggerPresent

api-ms-win-core-handle-l1-1-0

CloseHandle
DuplicateHandle

api-ms-win-core-memory-l1-1-0

VirtualAlloc
VirtualFree
VirtualQuery
ReadProcessMemory

api-ms-win-core-console-l1-1-0

ReadConsoleW
WriteConsoleW
GetConsoleMode
SetConsoleMode
SetConsoleCtrlHandler
GetConsoleOutputCP

api-ms-win-core-file-l1-1-0

FindFirstFileW
FindNextFileW
FlushFileBuffers
SetFileAttributesW
GetFileAttributesExW
GetFullPathNameW
FindClose
GetDriveTypeW
CreateFileW
FileTimeToLocalFileTime
WriteFile
SetFilePointer
GetFileAttributesW
ReadFile
SetEndOfFile
SetFileTime
GetVolumePathNameW
GetFileSize
CreateDirectoryW
GetFileType
FindFirstFileExW
GetDiskFreeSpaceExW
GetVolumeInformationW
CompareFileTime
RemoveDirectoryW
SetFilePointerEx
DeleteFileW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar
WideCharToMultiByte

api-ms-win-core-processenvironment-l1-1-0

GetStdHandle
ExpandEnvironmentStringsW
SearchPathW
GetEnvironmentVariableW
SetEnvironmentVariableW
GetCurrentDirectoryW
SetEnvironmentStringsW
GetCommandLineW
GetEnvironmentStringsW
SetCurrentDirectoryW
FreeEnvironmentStringsW

api-ms-win-core-console-l2-1-0

FillConsoleOutputCharacterW
SetConsoleCursorPosition
SetConsoleTextAttribute
FillConsoleOutputAttribute
GetConsoleScreenBufferInfo
FlushConsoleInputBuffer
ScrollConsoleScreenBufferW

api-ms-win-security-base-l1-1-0

GetFileSecurityW
RevertToSelf
GetSecurityDescriptorOwner

api-ms-win-core-sysinfo-l1-1-0

SetLocalTime
GetLocalTime
GetSystemTime
GetTickCount
GetSystemTimeAsFileTime
GetVersion
GetWindowsDirectoryW

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime
SystemTimeToFileTime

api-ms-win-core-datetime-l1-1-0

GetTimeFormatW
GetDateFormatW

api-ms-win-core-systemtopology-l1-1-0

GetNumaNodeProcessorMaskEx
GetNumaHighestNodeNumber

api-ms-win-core-console-l2-2-0

GetConsoleTitleW
SetConsoleTitleW

api-ms-win-core-processenvironment-l1-2-0

NeedCurrentDirectoryForExePathW

api-ms-win-core-registry-l1-1-0

RegSetValueExW
RegCreateKeyExW
RegDeleteValueW
RegDeleteKeyExW
RegEnumKeyExW
RegQueryValueExW
RegCloseKey
RegOpenKeyExW

api-ms-win-core-file-l2-1-0

MoveFileExW
CreateSymbolicLinkW
MoveFileWithProgressW
CreateHardLinkW
GetFileInformationByHandleEx

api-ms-win-core-heap-l2-1-0

GlobalFree
LocalFree
GlobalAlloc

api-ms-win-core-io-l1-1-0

DeviceIoControl

api-ms-win-core-winrt-l1-1-0

RoUninitialize
RoInitialize

api-ms-win-core-processtopology-l1-1-0

GetThreadGroupAffinity

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW
lstrcmpW

api-ms-win-core-processtopology-obsolete-l1-1-0

SetProcessAffinityMask

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Sections

.text
Size: 189KB - Virtual size: 189KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 512B - Virtual size: 109KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 10KB - Virtual size: 9KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 72B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 33KB - Virtual size: 33KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 408KB - Virtual size: 1004KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

63b6d640ef299e8f8898cea09b8aa342

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

ntdll

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-console-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-console-l2-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-datetime-l1-1-0

api-ms-win-core-systemtopology-l1-1-0

api-ms-win-core-console-l2-2-0

api-ms-win-core-processenvironment-l1-2-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-file-l2-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-winrt-l1-1-0

api-ms-win-core-processtopology-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

api-ms-win-core-processtopology-obsolete-l1-1-0

api-ms-win-core-apiquery-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

Sections

.text Size: 189KB - Virtual size: 189KB

.data Size: 512B - Virtual size: 109KB

.idata Size: 10KB - Virtual size: 9KB

.didat Size: 512B - Virtual size: 72B

.rsrc Size: 33KB - Virtual size: 33KB

.reloc Size: 408KB - Virtual size: 1004KB

.text
Size: 189KB - Virtual size: 189KB

.data
Size: 512B - Virtual size: 109KB

.idata
Size: 10KB - Virtual size: 9KB

.didat
Size: 512B - Virtual size: 72B

.rsrc
Size: 33KB - Virtual size: 33KB

.reloc
Size: 408KB - Virtual size: 1004KB