27cf8001a2aa92cb3d3f1cd3141dd2015c1e3436962540634f8098aeec4c6b99

Sharing

Copy URL

Twitter E-mail

General

Target

27cf8001a2aa92cb3d3f1cd3141dd2015c1e3436962540634f8098aeec4c6b99
Size

2.0MB
MD5

6d89fc5f40f976076f9540431b0696d9
SHA1

f2578263e20f83967fdfeec9a9b302cad77766ea
SHA256

27cf8001a2aa92cb3d3f1cd3141dd2015c1e3436962540634f8098aeec4c6b99
SHA512

9ed2e98c78ce71331b57ed95bc2ba6243f2e97d99a993ac41dcca5a242bdbe73c9d5d572f148486e5e628e3e426c66226f58db816a7ce0284ca1b55d8adb270b
SSDEEP

49152:tPK8mJYTerDjfJ2313e1mP1MdnUBLNiXicJFFRGNzj3:j7wRGpj3

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
27cf8001a2aa92cb3d3f1cd3141dd2015c1e3436962540634f8098aeec4c6b99

Files

27cf8001a2aa92cb3d3f1cd3141dd2015c1e3436962540634f8098aeec4c6b99
.exe windows:10 windows x64 arch:x64

eab07e7c0e3b2e90cb8ca29010c4764f

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB Paths

vssvc.pdb

Imports

msvcrt

_lock
iswspace
??1type_info@@UEAA@XZ
?terminate@@YAXXZ
_commode
_fmode
_wcmdln
_initterm
__setusermatherr
_cexit
_exit
exit
__set_app_type
__wgetmainargs
_amsg_exit
_XcptFilter
_CxxThrowException
??0exception@@QEAA@AEBQEBDH@Z
_callnewh
?what@exception@@UEBAPEBDXZ
??0exception@@QEAA@AEBQEBD@Z
wcsstr
_unlock
wcstok
_errno
wcsrchr
_beginthreadex
wcstoul
towupper
wcsncmp
_wcsicmp
_wcsnicmp
iswdigit
_vsnprintf
_purecall
wcscat_s
_vsnprintf_s
malloc
realloc
free
??0exception@@QEAA@XZ
memmove_s
memcpy_s
??0exception@@QEAA@AEBV0@@Z
??1exception@@UEAA@XZ
_vsnwprintf
__dllonexit
_onexit
memset
_vscwprintf
__CxxFrameHandler3
memcmp
qsort
memcpy
__C_specific_handler
memmove
wcscmp

oleaut32

GetErrorInfo
LoadRegTypeLi
VarUI4FromStr
SysFreeString
SysStringLen
SysAllocStringLen
SysAllocString
VariantClear
VariantCopy
VariantChangeType
VariantInit

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-synch-l1-1-0

WaitForSingleObject
DeleteCriticalSection
ReleaseSRWLockExclusive
InitializeCriticalSection
ReleaseSRWLockShared
EnterCriticalSection
InitializeCriticalSectionAndSpinCount
ReleaseSemaphore
SetWaitableTimer
CancelWaitableTimer
CreateEventW
LeaveCriticalSection
CreateWaitableTimerExW
WaitForMultipleObjectsEx
CreateMutexExW
CreateSemaphoreExW
OpenSemaphoreW
ResetEvent
InitializeCriticalSectionEx
AcquireSRWLockShared
AcquireSRWLockExclusive
WaitForSingleObjectEx
ReleaseMutex
SetEvent

api-ms-win-core-errorhandling-l1-1-0

SetErrorMode
GetLastError
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RaiseException
SetLastError

api-ms-win-core-synch-l1-2-0

InitOnceComplete
InitOnceBeginInitialize
Sleep

api-ms-win-core-processthreads-l1-1-0

OpenProcessToken
TerminateProcess
GetCurrentProcess
GetCurrentProcessId
GetCurrentThreadId
SetThreadPriority
OpenThread
GetStartupInfoW
ResumeThread
GetCurrentThread
OpenThreadToken
CreateThread

api-ms-win-core-com-l1-1-0

CoCreateGuid
CoSetProxyBlanket
CoRevertToSelf
CoRegisterClassObject
CoTaskMemFree
CoRevokeClassObject
CoGetClassObject
CoTaskMemAlloc
CoDisconnectContext
StringFromCLSID
CoCreateInstance
CoUninitialize
CoGetCallContext
CoGetObjectContext
CLSIDFromString
CoTaskMemRealloc
CoInitializeEx
CoImpersonateClient
CoFreeUnusedLibraries
CoInitializeSecurity

api-ms-win-core-string-l1-1-0

CompareStringW
MultiByteToWideChar

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-memory-l1-1-0

VirtualQuery
VirtualAlloc
VirtualProtect

api-ms-win-core-sysinfo-l1-1-0

GetComputerNameExW
GetTickCount64
GetTickCount
GetSystemDirectoryW
GetVersionExW
GetSystemInfo
GetSystemTimeAsFileTime
GetSystemWindowsDirectoryW

api-ms-win-core-debug-l1-1-0

DebugBreak
IsDebuggerPresent
OutputDebugStringW

api-ms-win-core-heap-l1-1-0

HeapAlloc
GetProcessHeap
HeapFree
HeapSetInformation

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleExW
FreeLibrary
LoadLibraryExW
SizeofResource
GetModuleFileNameA
LoadResource
GetProcAddress
GetModuleFileNameW
GetModuleHandleW
LoadStringW
FindResourceExW

api-ms-win-core-threadpool-l1-2-0

CreateThreadpoolTimer
WaitForThreadpoolTimerCallbacks
CloseThreadpoolTimer
SetThreadpoolTimer

api-ms-win-core-string-l2-1-0

CharPrevW
CharNextW

api-ms-win-core-registry-l1-1-0

RegCreateKeyExW
RegSetValueExW
RegDeleteValueW
RegCloseKey
RegEnumKeyExW
RegDeleteTreeW
RegOpenKeyExW
RegQueryValueExW
RegQueryInfoKeyW
RegEnumValueW

api-ms-win-core-string-obsolete-l1-1-0

lstrcpynW
lstrcmpiW

ntdll

RtlNtStatusToDosError
RtlAdjustPrivilege
EtwTraceMessage
NtThawRegistry
NtFreezeRegistry
NtQueryInformationProcess
NtClose
NtCreateSymbolicLinkObject
RtlInitUnicodeString
NtThawTransactions
NtFreezeTransactions
NtQuerySystemInformation
RtlNtStatusToDosErrorNoTeb
NtQueryVolumeInformationFile
EtwUnregisterTraceGuids
EtwRegisterTraceGuidsW
EtwGetTraceEnableFlags
EtwGetTraceEnableLevel
EtwGetTraceLoggerHandle

api-ms-win-service-core-l1-1-0

StartServiceCtrlDispatcherW
SetServiceStatus
RegisterServiceCtrlHandlerExW

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW
GetEnvironmentVariableW
GetCommandLineW

api-ms-win-core-heap-l2-1-0

LocalAlloc
LocalFree

api-ms-win-core-file-l1-1-0

FindFirstVolumeW
FindNextVolumeW
FindFirstFileW
CreateDirectoryW
SetFileAttributesW
GetVolumeInformationW
GetDriveTypeW
WriteFile
GetFileAttributesW
GetDiskFreeSpaceW
DeleteFileW
ReadFile
QueryDosDeviceW
CreateFileW
FindVolumeClose
DeleteVolumeMountPointW
FindClose
FindNextFileW
DefineDosDeviceW
FlushFileBuffers
GetVolumePathNameW

api-ms-win-core-io-l1-1-0

GetOverlappedResult
DeviceIoControl

api-ms-win-core-file-l1-2-0

GetVolumeNameForVolumeMountPointW
GetVolumePathNamesForVolumeNameW

api-ms-win-security-base-l1-1-0

GetLengthSid
InitializeAcl
FreeSid
CheckTokenMembership
PrivilegeCheck
GetTokenInformation
InitializeSecurityDescriptor
AdjustTokenPrivileges
CreateWellKnownSid
SetSecurityDescriptorOwner
CopySid
DuplicateToken
GetAclInformation
GetAce
AddAce
AddAccessDeniedAceEx
AddAccessAllowedAceEx
IsValidSid
AccessCheck
GetSidSubAuthorityCount
EqualDomainSid
SetSecurityDescriptorDacl
EqualSid
AddAccessAllowedAce
AllocateAndInitializeSid
SetSecurityDescriptorGroup

api-ms-win-core-kernel32-legacy-l1-1-1

SetVolumeMountPointW

api-ms-win-eventing-provider-l1-1-0

EventWriteTransfer
EventUnregister
EventSetInformation
EventRegister

rpcrt4

RpcStringFreeW
I_RpcBindingInqLocalClientPID
UuidToStringW

devobj

DevObjDestroyDeviceInfoList
DevObjCreateDeviceInfoList
DevObjUninstallDevice
DevObjGetDeviceRegistryProperty
DevObjEnumDeviceInterfaces
DevObjGetClassDevs
DevObjEnumDeviceInfo
DevObjGetDeviceInterfaceDetail

api-ms-win-core-file-l2-1-0

MoveFileExW

api-ms-win-service-private-l1-1-0

I_ScUnregisterDeviceNotification
I_ScRegisterDeviceNotification

api-ms-win-core-kernel32-legacy-l1-1-0

GetComputerNameW

api-ms-win-core-rtlsupport-l1-1-0

RtlCaptureContext
RtlVirtualUnwind
RtlLookupFunctionEntry

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

vssapi

LoadVssSnapshotSetDescription
VssFreeSnapshotPropertiesInternal
CreateWriterEx
CreateVssSnapshotSetDescription
CreateWriter

vsstrace

ord10
ord11
ord3
ord1
ord2
ord5
ord9
ord6
ord7
ord8
ord4

api-ms-win-eventlog-legacy-l1-1-0

DeregisterEventSource
ReportEventW
RegisterEventSourceW

authz

AuthzRegisterSecurityEventSource
AuthzUnregisterSecurityEventSource
AuthzReportSecurityEventFromParams

api-ms-win-core-processthreads-l1-1-1

OpenProcess

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-timezone-l1-1-0

GetTimeZoneInformation

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

virtdisk

GetStorageDependencyInformation

bcd

BcdCloseObject
BcdForciblyUnloadStore
BcdOpenSystemStore
BcdCloseStore
BcdGetElementData
BcdOpenObject

api-ms-win-core-util-l1-1-0

EncodePointer

Sections

.text
Size: 989KB - Virtual size: 989KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 415KB - Virtual size: 415KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 30KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.didat
Size: 512B - Virtual size: 336B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 568KB - Virtual size: 572KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

Files

eab07e7c0e3b2e90cb8ca29010c4764f

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

msvcrt

oleaut32

api-ms-win-core-localization-l1-2-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-threadpool-l1-2-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

ntdll

api-ms-win-service-core-l1-1-0

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-heap-l2-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-io-l1-1-0

api-ms-win-core-file-l1-2-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-1

api-ms-win-eventing-provider-l1-1-0

rpcrt4

devobj

api-ms-win-core-file-l2-1-0

api-ms-win-service-private-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-profile-l1-1-0

vssapi

vsstrace

api-ms-win-eventlog-legacy-l1-1-0

authz

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

virtdisk

bcd

api-ms-win-core-util-l1-1-0

Sections

.text Size: 989KB - Virtual size: 989KB

.rdata Size: 415KB - Virtual size: 415KB

.data Size: 1KB - Virtual size: 5KB

.pdata Size: 30KB - Virtual size: 30KB

.didat Size: 512B - Virtual size: 336B

.rsrc Size: 20KB - Virtual size: 19KB

.reloc Size: 568KB - Virtual size: 572KB

.text
Size: 989KB - Virtual size: 989KB

.rdata
Size: 415KB - Virtual size: 415KB

.data
Size: 1KB - Virtual size: 5KB

.pdata
Size: 30KB - Virtual size: 30KB

.didat
Size: 512B - Virtual size: 336B

.rsrc
Size: 20KB - Virtual size: 19KB

.reloc
Size: 568KB - Virtual size: 572KB