884efd1521e2fff9a05e7428239b3d9b92442ecef1248dd2bb295b253016dfb5

General

Target
884efd1521e2fff9a05e7428239b3d9b92442ecef1248dd2bb295b253016dfb5
Size 124KB
Sample220220-flcsfahhfj
SHA256 884efd1521e2fff9a05e7428239b3d9b92442ecef1248dd2bb295b253016dfb5
MD5 3925ae7df3328773be923f74d70555e3
SHA1 948af4614e8ff150fbe0bc38f40806b457acaf3a
SHA512 1eb06c442f6c63d7f5908a57ec57852678820349385e8e77aa0baaa584e6bb2dca59c0e2d4529734f9108e298d245e755202b70461cc1e6402ef37cc7d3d942d
SSDEEP 3072:ivNMnEiVKFZ0hxMJ75+TotFU2eDKih9rEUU:ivNMnxy2KJ70sDy5/rEU
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

884efd1521e2fff9a05e7428239b3d9b92442ecef1248dd2bb295b253016dfb5

.exe 124KB

884efd1521e2fff9a05e7428239b3d9b92442ecef1248dd2bb295b253016dfb5

IMPHASH 9f64c8cf2ba268400f51862b635a85b2
SHA256 884efd1521e2fff9a05e7428239b3d9b92442ecef1248dd2bb295b253016dfb5
MD5 3925ae7df3328773be923f74d70555e3
SHA1 948af4614e8ff150fbe0bc38f40806b457acaf3a
SHA512 1eb06c442f6c63d7f5908a57ec57852678820349385e8e77aa0baaa584e6bb2dca59c0e2d4529734f9108e298d245e755202b70461cc1e6402ef37cc7d3d942d
SSDEEP 3072:ivNMnEiVKFZ0hxMJ75+TotFU2eDKih9rEUU:ivNMnxy2KJ70sDy5/rEU
MD5 SHA1 SHA512 SSDEEP

windows x64

Minor OS version

Major OS version

Entry point

31860

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetModuleHandleA OpenProcess CreateToolhelp32Snapshot Sleep GetLastError Process32NextW GetCurrentThread LoadLibraryA GlobalAlloc DeleteFileW Process32FirstW GetVersionExW CloseHandle LoadLibraryW HeapAlloc GetWindowsDirectoryW GetProcAddress VirtualAllocEx LocalFree GetProcessHeap FreeLibrary CreateRemoteThread VirtualFreeEx CreateFileW CreateMutexA GetModuleFileNameW GetCurrentProcess GetCommandLineW SetLastError HeapFree GlobalFree WriteConsoleW SetFilePointerEx GetConsoleMode RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx RaiseException InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection ExitProcess GetModuleHandleExW GetStdHandle WriteFile MultiByteToWideChar WideCharToMultiByte GetACP LCMapStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW HeapSize HeapReAlloc FlushFileBuffers GetConsoleCP WriteProcessMemory

advapi32

SystemFunction036 LookupPrivilegeValueW AdjustTokenPrivileges ImpersonateSelf OpenProcessToken OpenThreadToken LookupAccountSidW GetTokenInformation

shell32

CommandLineToArgvW

Name

.text

Size

65KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

39KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

11KB

Virtual Size

3.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

168B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

884efd1521e2fff9a05e7428239b3d9b92442ecef1248dd2bb295b253016dfb5

kernel32

advapi32

shell32