98798af20f74f09d6b5abf2f31a22ff3[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
98798af20f74f09d6b5abf2f31a22ff3.exe
Size 32KB
Sample230113-ttm52aeb3s
SHA256 f16b2871155bd4898cd02cbb8bffe7ee7770acf0b7577c66c334f71dc2394471
MD5 98798af20f74f09d6b5abf2f31a22ff3
SHA1 d7419f45bf40e43c8ce00aa8338972294a79c93f
SHA512 489356b5e5ba2a0ca0fae3929c95b0787c3846f2c2878ba4fec8a89c99e1c94063696b5090fb00c6768ef7bca5ede59480aecd44b463c42b61c64cade1fbac7f
SSDEEP 768:ct6/PJRlNhSP00p7Prw0P4cIGA0ryWP5suw5zc:X/PJ7NhSP00ZPU0mv47q
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

98798af20f74f09d6b5abf2f31a22ff3.exe

.exe 32KB

98798af20f74f09d6b5abf2f31a22ff3.exe

IMPHASH 41d47768be27a1b9dc153c47ae3e0cb7
SHA256 f16b2871155bd4898cd02cbb8bffe7ee7770acf0b7577c66c334f71dc2394471
MD5 98798af20f74f09d6b5abf2f31a22ff3
SHA1 d7419f45bf40e43c8ce00aa8338972294a79c93f
SHA512 489356b5e5ba2a0ca0fae3929c95b0787c3846f2c2878ba4fec8a89c99e1c94063696b5090fb00c6768ef7bca5ede59480aecd44b463c42b61c64cade1fbac7f
SSDEEP 768:ct6/PJRlNhSP00p7Prw0P4cIGA0ryWP5suw5zc:X/PJ7NhSP00ZPU0mv47q
MD5 SHA1 SHA512 SSDEEP

windows x64

Minor OS version

Major OS version

Entry point

15976

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

LoadLibraryA CloseHandle VirtualProtectEx GetProcAddress VirtualAllocEx ReadProcessMemory CreateRemoteThread VirtualFreeEx GetLastError GetCurrentProcess GetFileAttributesW OpenProcess CreateToolhelp32Snapshot Process32NextW Process32FirstW IsWow64Process GetCurrentProcessId Sleep RtlAddFunctionTable GetExitCodeProcess WriteProcessMemory GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetModuleHandleW QueryPerformanceCounter

advapi32

AdjustTokenPrivileges OpenProcessToken LookupPrivilegeValueW

msvcp140

?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ??Bid@locale@std@@QEAA_KXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception _CxxThrowException __current_exception_context __std_terminate __std_exception_copy __std_exception_destroy memcpy __C_specific_handler memset memmove

api-ms-win-crt-stdio-l1-1-0

setvbuf ungetc __p__commode fwrite _set_fmode _get_stream_buffer_pointers _fseeki64 fgetc fclose fflush fsetpos fputc fread __stdio_common_vfprintf __acrt_iob_func fgetpos

api-ms-win-crt-heap-l1-1-0

malloc _set_new_mode free _callnewh

api-ms-win-crt-string-l1-1-0

_wcsicmp

api-ms-win-crt-runtime-l1-1-0

exit _exit _invalid_parameter_noinfo_noreturn system __p___wargv _cexit _c_exit _register_thread_local_exe_atexit_callback _initterm_e _configure_wide_argv _initterm _initialize_onexit_table _register_onexit_function _crt_atexit _initialize_wide_environment terminate _get_initial_wide_environment _set_app_type _seh_filter_exe __p___argc

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-convert-l1-1-0

mbstowcs_s

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale