826ab21b35cb73a12a56002c87c492d0192e85f912627e440f49e2d2777942ec

General

Target
826ab21b35cb73a12a56002c87c492d0192e85f912627e440f49e2d2777942ec
Size 206KB
Sample220220-ftwwaaaael
SHA256 826ab21b35cb73a12a56002c87c492d0192e85f912627e440f49e2d2777942ec
MD5 c75b0beff52189aed827839bea3e5da4
SHA1 e9b20948b82eee88081cebe2d62408871dbe601a
SHA512 4fe591ab12f1245f7f16efea215679321ff415b879cacfa373824e6f170d08ffcf650783f835fd219abe240b7fe0fd48d4f1dad0e4b730e7e72fb6433b6b8a9c
SSDEEP 1536:zUECZ4koARJ+ESEBM3jwkUAlqVpe8uzK26cEgIbsW9d7B9dl1fPQlPsUZ+lc1hi:7koU+xEB8wpVpWzK26/19Vbfomwhi
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

826ab21b35cb73a12a56002c87c492d0192e85f912627e440f49e2d2777942ec

.exe 206KB

826ab21b35cb73a12a56002c87c492d0192e85f912627e440f49e2d2777942ec

IMPHASH 7392bf63e0480c44b4cad34b59be5fdc
SHA256 826ab21b35cb73a12a56002c87c492d0192e85f912627e440f49e2d2777942ec
MD5 c75b0beff52189aed827839bea3e5da4
SHA1 e9b20948b82eee88081cebe2d62408871dbe601a
SHA512 4fe591ab12f1245f7f16efea215679321ff415b879cacfa373824e6f170d08ffcf650783f835fd219abe240b7fe0fd48d4f1dad0e4b730e7e72fb6433b6b8a9c
SSDEEP 1536:zUECZ4koARJ+ESEBM3jwkUAlqVpe8uzK26cEgIbsW9d7B9dl1fPQlPsUZ+lc1hi:7koU+xEB8wpVpWzK26/19Vbfomwhi
MD5 SHA1 SHA512 SSDEEP

windows x64

Minor OS version

Major OS version

Entry point

35652

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetModuleHandleA OpenProcess CreateToolhelp32Snapshot Sleep GetLastError Process32NextW GetCurrentThread LoadLibraryA GlobalAlloc DeleteFileW Process32FirstW GetVersionExW CloseHandle CreateThread HeapAlloc GetWindowsDirectoryW GetProcAddress VirtualAllocEx LocalFree GetProcessHeap FreeLibrary CreateRemoteThread VirtualFreeEx CreateFileW GetModuleFileNameW VirtualAlloc GetCurrentProcess GetCommandLineW VirtualFree SetLastError HeapFree GlobalFree WriteConsoleW SetFilePointerEx HeapReAlloc RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx RaiseException InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection ExitProcess GetModuleHandleExW GetStdHandle WriteFile MultiByteToWideChar WideCharToMultiByte GetACP LCMapStringW GetStringTypeW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle FlushFileBuffers GetConsoleCP GetConsoleMode HeapSize WriteProcessMemory

advapi32

SystemFunction036 LookupPrivilegeValueW AdjustTokenPrivileges OpenSCManagerW ImpersonateSelf OpenProcessToken EnumServicesStatusW OpenThreadToken LookupAccountSidW GetTokenInformation

shell32

ShellExecuteW CommandLineToArgvW

Name

.text

Size

90KB

Virtual Size

90KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

41KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

65KB

Virtual Size

3.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

168B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

826ab21b35cb73a12a56002c87c492d0192e85f912627e440f49e2d2777942ec

kernel32

advapi32

shell32