696ea26bda4b0fab70aa35315aa89149

Sharing

Copy URL Twitter E-mail

General

Target
696ea26bda4b0fab70aa35315aa89149
Size 3.3MB
Sample220714-hr4t8abcdp
SHA256 1b62679a7dd555ec5a3c8dd0641a7b3c99c11263a4f3d8a4c256965bdc75ecbd
MD5 696ea26bda4b0fab70aa35315aa89149
SHA1 083dcf2c765df863ee34353559a885357628e145
SHA512 6247d8d1020878a872d6e4efe80efb58fa6c5f3939bfb88368c8b528687f176800eaea2fa94e187093801631b6a68d7dbd0708e8efd360d2e9fc9ef0a378c7b5
SSDEEP 49152:AGtlquqIU6iiuJQu8FBL63eNOB0G5/GW9DoAPq4E7XGcvfzEAOAnE9ciPINrRTp:J+iBW3eNOBhi5WfAOJiPNr
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

696ea26bda4b0fab70aa35315aa89149

.exe 3.3MB

696ea26bda4b0fab70aa35315aa89149

IMPHASH 32c00243248766c78e518933e661bd05
SHA256 1b62679a7dd555ec5a3c8dd0641a7b3c99c11263a4f3d8a4c256965bdc75ecbd
MD5 696ea26bda4b0fab70aa35315aa89149
SHA1 083dcf2c765df863ee34353559a885357628e145
SHA512 6247d8d1020878a872d6e4efe80efb58fa6c5f3939bfb88368c8b528687f176800eaea2fa94e187093801631b6a68d7dbd0708e8efd360d2e9fc9ef0a378c7b5
SSDEEP 49152:AGtlquqIU6iiuJQu8FBL63eNOB0G5/GW9DoAPq4E7XGcvfzEAOAnE9ciPINrRTp:J+iBW3eNOBhi5WfAOJiPNr
MD5 SHA1 SHA512 SSDEEP

windows x64

Minor OS version

Major OS version

Entry point

2204536

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

__WSAFDIsSet shutdown inet_pton select WSASetLastError bind getnameinfo gethostname sendto recvfrom ntohl freeaddrinfo getaddrinfo ioctlsocket listen htonl socket send recv closesocket accept WSACleanup WSAStartup WSAIoctl setsockopt ntohs htons getsockopt getsockname getpeername connect WSAGetLastError

wldap32

ord60 ord46 ord45 ord50 ord211 ord41 ord301 ord200 ord30 ord79 ord35 ord33 ord32 ord27 ord26 ord22 ord143

crypt32

CryptQueryObject CertGetCertificateContextProperty CertDuplicateCertificateContext CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CertGetNameStringA CertAddCertificateContextToStore CryptStringToBinaryA CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore

advapi32

CryptEnumProvidersW CryptSignHashW CryptDecrypt CryptExportKey CryptGetUserKey CryptGetProvParam CryptSetHashParam CryptDestroyKey CryptAcquireContextW ReportEventW RegisterEventSourceW DeregisterEventSource CryptDestroyHash CryptHashData CryptCreateHash CryptGenRandom CryptGetHashParam CryptReleaseContext CryptAcquireContextA CopySid IsValidSid OpenProcessToken ConvertSidToStringSidW GetLengthSid GetTokenInformation

kernel32

VirtualQuery VirtualProtect VirtualAlloc GetSystemInfo ExitProcess RtlPcToFileHeader InterlockedPushEntrySList RtlUnwindEx CreateFileW GetDriveTypeW GetFileInformationByHandle SystemTimeToTzSpecificLocalTime FileTimeToSystemTime CreateThread ExitThread FreeLibraryAndExitThread GetDateFormatW SetFilePointerEx SetConsoleCtrlHandler GetCommandLineA GetCommandLineW GetConsoleOutputCP GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTimeZoneInformation FlushFileBuffers GetFileAttributesExW GetCurrentDirectoryW GetFullPathNameW SetStdHandle FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetEndOfFile WriteConsoleW LoadLibraryExW SetConsoleMode WriteProcessMemory HeapFree SetConsoleTitleA GetCurrentProcess TerminateProcess GetModuleFileNameW InitializeCriticalSectionEx WaitForSingleObject ResumeThread HeapSize Sleep GetLastError HeapReAlloc CloseHandle RaiseException HeapAlloc DecodePointer HeapDestroy GetThreadContext VirtualAllocEx LocalFree DeleteCriticalSection GetProcessHeap CreateProcessW WideCharToMultiByte GetConsoleWindow SetThreadContext GetExitCodeProcess SetLastError QueryPerformanceCounter QueryPerformanceFrequency FormatMessageA GetTickCount EnterCriticalSection LeaveCriticalSection SleepEx VerSetConditionMask GetSystemDirectoryA FreeLibrary GetModuleHandleA GetProcAddress LoadLibraryA VerifyVersionInfoA WaitForSingleObjectEx ExpandEnvironmentStringsA GetStdHandle GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects CreateFileA GetFileSizeEx GetEnvironmentVariableW GetConsoleMode RtlUnwind ReadConsoleA ReadConsoleW InitializeCriticalSectionAndSpinCount GetCurrentThreadId TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW MultiByteToWideChar FormatMessageW WriteFile GetModuleHandleW GetCurrentProcessId GetSystemTimeAsFileTime RtlVirtualUnwind SwitchToFiber DeleteFiber CreateFiber LoadLibraryW ConvertFiberToThread ConvertThreadToFiber FindClose FindFirstFileW FindNextFileW GetSystemTime SystemTimeToFileTime GetStartupInfoW IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead CreateEventW ResetEvent SetEvent OutputDebugStringW IsDebuggerPresent GetCPInfo GetStringTypeW EncodePointer LCMapStringEx FlsAlloc FlsGetValue FlsSetValue FlsFree

user32

MessageBoxA GetProcessWindowStation GetUserObjectInformationW MessageBoxW

shell32

ShellExecuteA

userenv

UnloadUserProfile

rpcrt4

RpcStringFreeA UuidToStringA UuidCreate

bcrypt

BCryptGenRandom

Name

.text

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

788KB

Virtual Size

787KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

36KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

100KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

31KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ