Unpacked Deobfuscated By Str1ve[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Unpacked Deobfuscated By Str1ve.exe
Size 108.4MB
Sample260924-fmryraed49
SHA256 f98f9b8df482fb70f5ead4303e392f16a1674f43b1324d41279724598d796090
MD5 0c5607b71615cae123460c92bec93ad3
SHA1 1c9619ccbf6ff29373ac911777459612a421098e
SHA512 01e448009b7ec9c3afe97a349d84501af56412d8f88ef1e6b3779e1bf963a801a69c40c3a306523085e831cacaa6799be320fbdeeab663d4348e2477cf4fd7cb
SSDEEP 393216:D4te3qawNpLO4IDtpkN4LUfmaJr7pRcX8HsE6JyLewYf8XFmV9KSCfpkNl5o:D4DAD2xTr7cXrpJMd68YV9KY0
TLSH
T10848E763EEF3C3D0C09AB93EC37DB223EA217A1DDA39B3AF5B57950121792419164B11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Unpacked Deobfuscated By Str1ve.exe

File Explorer

Unpacked Deobfuscated By Str1ve.exe

.exe 108.4MB

Unpacked Deobfuscated By Str1ve.exe

IMPHASH 0ed6c1909787d487ba3b368a26e55468
SHA256 f98f9b8df482fb70f5ead4303e392f16a1674f43b1324d41279724598d796090
MD5 0c5607b71615cae123460c92bec93ad3
SHA1 1c9619ccbf6ff29373ac911777459612a421098e
SHA512 01e448009b7ec9c3afe97a349d84501af56412d8f88ef1e6b3779e1bf963a801a69c40c3a306523085e831cacaa6799be320fbdeeab663d4348e2477cf4fd7cb
SSDEEP 393216:D4te3qawNpLO4IDtpkN4LUfmaJr7pRcX8HsE6JyLewYf8XFmV9KSCfpkNl5o:D4DAD2xTr7cXrpJMd68YV9KY0
TLSH
T10848E763EEF3C3D0C09AB93EC37DB223EA217A1DDA39B3AF5B57950121792419164B11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

113630928

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

CryptReleaseContext SetServiceStatus FreeSid StartServiceCtrlDispatcherW RegDeleteKeyW EqualSid DeregisterEventSource ReportEventW LookupPrivilegeValueW InitializeSecurityDescriptor SetServiceObjectSecurity InitiateShutdownW ControlService CryptGenRandom RegCloseKey QueryServiceObjectSecurity OpenServiceW RegGetValueW StartServiceW ChangeServiceConfigW AdjustTokenPrivileges RegisterServiceCtrlHandlerExW OpenSCManagerW DeleteService CryptAcquireContextA CryptAcquireContextW QueryServiceConfigW RegQueryValueExW CreateProcessAsUserW RegDeleteKeyValueW BuildSecurityDescriptorW QueryServiceStatus OpenProcessToken RegCreateKeyExW DuplicateTokenEx GetTokenInformation SetSecurityDescriptorDacl SystemFunction036 RegOpenKeyExW SetTokenInformation RegisterEventSourceW CreateServiceW AllocateAndInitializeSid RegSetValueExW CloseServiceHandle

kernel32

OpenProcess GetStartupInfoW TlsFree GetProcessHeap Process32FirstW SwitchToFiber SetFilePointerEx IsValidCodePage ResumeThread CreateProcessW HeapReAlloc CreateEventW HeapAlloc GetFullPathNameW FreeEnvironmentStringsW SetConsoleCtrlHandler MoveFileExW CreateToolhelp32Snapshot ReadConsoleA ReleaseSRWLockExclusive CopyFileW FlsSetValue GetFileType HeapSize CreateJobObjectW AcquireSRWLockExclusive SetThreadPriority LoadLibraryA TlsSetValue QueryPerformanceFrequency SleepConditionVariableSRW WTSGetActiveConsoleSessionId GetLocaleInfoEx PeekNamedPipe OpenEventW FindClose TryAcquireSRWLockExclusive GetModuleHandleExW GetTimeFormatW VerifyVersionInfoW VirtualProtect FormatMessageW DeleteFiber GetCommandLineA GetEnvironmentStringsW QueryPerformanceCounter SetConsoleMode GetSystemWindowsDirectoryW GetTimeZoneInformation GetModuleFileNameA FreeLibrary SetPriorityClass CreateFiber GetCurrentProcess GetStringTypeW DebugBreak SetEvent GetExitCodeThread WriteFile AllocConsole ExitThread GetCurrentProcessId GetWindowsDirectoryW SetUnhandledExceptionFilter LoadLibraryW TlsAlloc GetConsoleMode InterlockedPushEntrySList K32GetProcessImageFileNameW DeleteProcThreadAttributeList GetACP CreateDirectoryW FindFirstFileExW GetConsoleOutputCP AssignProcessToJobObject GetLocaleInfoW GetSystemTimeAsFileTime GetExitCodeProcess EnterCriticalSection GetTickCount GetFileInformationByHandleEx GetFileInformationByHandle GetModuleHandleW GetFileAttributesW GetDriveTypeW TlsGetValue ProcessIdToSessionId GetSystemTime FreeLibraryAndExitThread MultiByteToWideChar InitOnceBeginInitialize HeapFree OutputDebugStringW GetFinalPathNameByHandleW GetCPInfo GetFileTime GetConsoleScreenBufferInfo WaitForSingleObject GetModuleFileNameW GetEnvironmentVariableA VirtualAlloc ReadFile CompareStringW InitOnceComplete SetInformationJobObject AcquireSRWLockShared GetFileAttributesExW WakeAllConditionVariable LCMapStringEx InitializeProcThreadAttributeList MoveFileExA GetProcAddress SetStdHandle RaiseException SetEndOfFile SystemTimeToFileTime GetDateFormatW SetEnvironmentVariableW FlsGetValue GetSystemDirectoryA WriteConsoleW ReleaseSRWLockShared CreateMutexW DeleteCriticalSection InitializeCriticalSectionEx GetCommandLineW EncodePointer GetUserDefaultLCID DecodePointer CreateNamedPipeW GetSystemFirmwareTable GetLastError LeaveCriticalSection GetStdHandle CreateThread SystemTimeToTzSpecificLocalTime WaitForSingleObjectEx UpdateProcThreadAttribute IsValidLocale UnhandledExceptionFilter SetFilePointer TerminateProcess ConnectNamedPipe GetSystemTimes InitializeCriticalSection ExitProcess WideCharToMultiByte TryEnterCriticalSection GetFileSizeEx IsProcessorFeaturePresent FlsFree DeleteFileW GlobalMemoryStatusEx LocalFree Sleep Process32NextW FindFirstFileW SleepEx GetCurrentThreadId FileTimeToSystemTime GetEnvironmentVariableW AreFileApisANSI SetLastError EnumSystemLocalesW GetOEMCP DisconnectNamedPipe LCMapStringW FlushFileBuffers CloseHandle CreateEventA GetModuleHandleA SetFileInformationByHandle InitializeSListHead FindNextFileW FlsAlloc CreateFileW InitializeCriticalSectionAndSpinCount ReadConsoleW GetTickCount64 ConvertThreadToFiber ConvertFiberToThread IsDebuggerPresent FormatMessageA HeapQueryInformation VirtualFree WaitForMultipleObjects SetConsoleTextAttribute GetCurrentDirectoryW LoadLibraryExW

ole32

CoUninitialize CoInitializeEx CoCreateInstance CoTaskMemFree

crypt32

CertCloseStore CryptMsgClose CryptMsgGetParam CertVerifyTimeValidity CryptQueryObject

wintrust

WTHelperGetProvSignerFromChain WinVerifyTrust WTHelperProvDataFromStateData

bcrypt

BCryptGenRandom

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

iphlpapi

GetIpNetTable GetBestRoute

wtsapi32

WTSQueryUserToken WTSSendMessageW WTSEnumerateSessionsW WTSFreeMemory

shell32

ShellExecuteExW SHGetKnownFolderPath CommandLineToArgvW

user32

ExitWindowsEx wsprintfW GetProcessWindowStation GetUserObjectInformationW MessageBoxW

ws2_32

recv getsockopt WSASetLastError gethostname WSAEnumNetworkEvents ioctlsocket htonl ntohs WSAIoctl select inet_addr getaddrinfo WSAWaitForMultipleEvents getsockname WSACreateEvent send accept shutdown WSAStartup recvfrom bind setsockopt WSAGetLastError gethostbyaddr connect WSAEventSelect freeaddrinfo socket htons sendto listen inet_ntoa gethostbyname getservbyname WSAResetEvent __WSAFDIsSet WSACloseEvent getservbyport WSACleanup closesocket ntohl

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

wldap32

ord46 ord60 ord30 ord50 ord35 ord211 ord32 ord33 ord79 ord301 ord143 ord26 ord27 ord22 ord41 ord200

ntdll

NtAllocateVirtualMemory NtCreateFile RtlLookupFunctionEntry NtQueryVirtualMemory RtlPcToFileHeader NtTerminateProcess NtFreeVirtualMemory NtReadVirtualMemory NtDeviceIoControlFile NtFsControlFile NtWriteVirtualMemory RtlVirtualUnwind NtQueryInformationFile NtTerminateThread NtWriteFile NtMapViewOfSection NtUnmapViewOfSection NtClose RtlAddFunctionTable NtProtectVirtualMemory RtlUnwindEx VerSetConditionMask NtCreateEvent RtlUnwind NtCreateSection NtWaitForSingleObject RtlDeleteFunctionTable NtFlushBuffersFile RtlCaptureContext NtCreateThreadEx NtReadFile LdrLoadDll RtlAddVectoredContinueHandler ZwQuerySystemInformation

Name

.text

Size

4.4MB

Virtual Size

4.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

61KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

172KB

Virtual Size

172KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.toir

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.grfn1

Size

94.7MB

Virtual Size

94.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.riot0

Size

1.5MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.riot1

Size

6.4MB

Virtual Size

6.4MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_WRITE

generic

count=210, id=261, version=33145,

count=26, id=260, version=33145,

count=11, id=259, version=33145,

count=7, id=253, version=35207,

count=19, id=260, version=35207,

count=12, id=259, version=35207,

count=102, id=261, version=35207,

count=4, id=261, version=35225,

count=1, id=262, version=33145,

count=31, id=257, version=33145,

count=410, id=1, productName=Unmarked objects,

count=1, id=260, version=35222,

count=1, id=259, version=24234,

count=41, id=261, version=33135,

count=1, id=259, version=33135,

count=6, id=260, version=33135,

count=32, productName=Unmarked objects (old),

count=762, id=260, version=30153,

count=119, id=260, version=34120,

count=23, id=261, version=34120,

count=52, id=260, version=33523,

count=39, id=265, version=35225,

count=1, id=259, version=35225,

count=1, id=255, version=35225,

count=1, id=151,

count=1, id=258, version=35225,