e5ceb42928a16190aeb1a9893c89e808a756a30193ccd542f63c726da7d9fa5c

Sharing

Copy URL Twitter E-mail

General

Target
e5ceb42928a16190aeb1a9893c89e808a756a30193ccd542f63c726da7d9fa5c
Size 214KB
Sample220220-bcferagafq
SHA256 e5ceb42928a16190aeb1a9893c89e808a756a30193ccd542f63c726da7d9fa5c
MD5 4d3454c85d85856674bb6e835f139649
SHA1 a8d64f6dddff26b423793e08994a6ee19077c1f7
SHA512 e713ee2c5fe12dfa27e8294ce1a6415221cccead720dd5163d6ccb399518a810ad567db39023a763ce39a8b861b39400f1faa56d8398c7c64fa7a5fdc2010c6c
SSDEEP 3072:BvRt93pALREz0+YXEJdZfFVGdCIEnk++KWYt7jjjH:9Rt93OEA+GcT9VafoRrH
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

e5ceb42928a16190aeb1a9893c89e808a756a30193ccd542f63c726da7d9fa5c

.exe 214KB

e5ceb42928a16190aeb1a9893c89e808a756a30193ccd542f63c726da7d9fa5c

IMPHASH 11741f1f5249d752141167ce996d6892
SHA256 e5ceb42928a16190aeb1a9893c89e808a756a30193ccd542f63c726da7d9fa5c
MD5 4d3454c85d85856674bb6e835f139649
SHA1 a8d64f6dddff26b423793e08994a6ee19077c1f7
SHA512 e713ee2c5fe12dfa27e8294ce1a6415221cccead720dd5163d6ccb399518a810ad567db39023a763ce39a8b861b39400f1faa56d8398c7c64fa7a5fdc2010c6c
SSDEEP 3072:BvRt93pALREz0+YXEJdZfFVGdCIEnk++KWYt7jjjH:9Rt93OEA+GcT9VafoRrH
MD5 SHA1 SHA512 SSDEEP

windows x64

Minor OS version

Major OS version

Entry point

24136

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

iphlpapi

IcmpCloseHandle IcmpCreateFile GetAdaptersAddresses IcmpSendEcho GetIpNetTable

kernel32

SetLastError WriteProcessMemory WaitForMultipleObjects Sleep GetLogicalDrives SetFilePointer CloseHandle WinExec GetTickCount GetLastError LoadLibraryA GetModuleFileNameW GetModuleHandleA GetCommandLineW GetTempPathW GetWindowsDirectoryW CreateFileW DeleteFileW CopyFileW GetVersionExW CreateToolhelp32Snapshot Process32FirstW Process32NextW GetCurrentThread CreateRemoteThread CreateThread ExitProcess GetCurrentProcess OpenProcess GetProcessHeap HeapFree HeapAlloc VirtualFreeEx VirtualAllocEx VirtualFree VirtualAlloc LocalFree GlobalFree GlobalAlloc GetProcAddress FreeLibrary SetFilePointerEx HeapReAlloc HeapSize GetConsoleMode GetConsoleCP FlushFileBuffers SetStdHandle WriteConsoleW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW RtlUnwindEx RtlPcToFileHeader RaiseException EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW TerminateProcess GetModuleHandleExW GetStdHandle WriteFile MultiByteToWideChar WideCharToMultiByte GetACP GetStringTypeW CompareStringW LCMapStringW WaitForSingleObject GetExitCodeProcess CreateProcessA GetFileAttributesExW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetOEMCP GetCPInfo

advapi32

OpenProcessToken OpenThreadToken GetTokenInformation AdjustTokenPrivileges LookupAccountSidW OpenSCManagerW EnumServicesStatusW LookupPrivilegeValueW ImpersonateSelf

shell32

ShellExecuteW CommandLineToArgvW

ws2_32

socket sendto inet_addr WSAStartup htonl closesocket bind WSACleanup htons setsockopt