891a1ac0ea79bc311ed664bc9fa0afec8f1db115c1cc8bf4c457f60865afd94e

Sharing

Copy URL Twitter E-mail

General

Target
891a1ac0ea79bc311ed664bc9fa0afec8f1db115c1cc8bf4c457f60865afd94e
Size 7.9MB
Sample230604-g71xtsbh7v
SHA256 891a1ac0ea79bc311ed664bc9fa0afec8f1db115c1cc8bf4c457f60865afd94e
MD5 005aa97a5b3611810eb6a9e0f9489748
SHA1 5edb2e62f89652601721df81e8a4b27e4decbdd7
SHA512 d0d136d2ffc22dc24cc1a6214d94735928c9c1f251e317c8786bc11814173892308a49240b0ebe3551cd783eb69aed52c61291103657715600c81b7de6108af0
SSDEEP 49152:ZUzV98qVLewPhDSE6t87BMMs9HdxxE2j3L2gpWPp4eHVLgdRhTV8PKeTFID:gpD65Xt3V82D
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
891a1ac0ea79bc311ed664bc9fa0afec8f1db115c1cc8bf4c457f60865afd94e

File Explorer

891a1ac0ea79bc311ed664bc9fa0afec8f1db115c1cc8bf4c457f60865afd94e

.exe 7.9MB

891a1ac0ea79bc311ed664bc9fa0afec8f1db115c1cc8bf4c457f60865afd94e

IMPHASH 0f5e8d6080b1bccc18b27dd257e505d2
SHA256 891a1ac0ea79bc311ed664bc9fa0afec8f1db115c1cc8bf4c457f60865afd94e
MD5 005aa97a5b3611810eb6a9e0f9489748
SHA1 5edb2e62f89652601721df81e8a4b27e4decbdd7
SHA512 d0d136d2ffc22dc24cc1a6214d94735928c9c1f251e317c8786bc11814173892308a49240b0ebe3551cd783eb69aed52c61291103657715600c81b7de6108af0
SSDEEP 49152:ZUzV98qVLewPhDSE6t87BMMs9HdxxE2j3L2gpWPp4eHVLgdRhTV8PKeTFID:gpD65Xt3V82D
MD5 SHA1 SHA512 SSDEEP

windows x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3065619

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

ioctlsocket recv send connect htons socket inet_addr closesocket

shlwapi

PathFindExtensionW

kernel32

lstrcmpiW MultiByteToWideChar GetStdHandle CreateFileW FindClose FindFirstFileW FindNextFileW GetFileSizeEx ReadFile SetFileAttributesW SetFilePointerEx WriteFile IsDebuggerPresent DebugBreak HeapAlloc HeapFree GetProcessHeap InitializeCriticalSection EnterCriticalSection LeaveCriticalSection WaitForMultipleObjects CreateThread ExitThread GetProcessId GetWindowsDirectoryW GetProcAddress LoadLibraryW MoveFileW WideCharToMultiByte SetConsoleTextAttribute SetLastError QueryPerformanceCounter QueryPerformanceFrequency GetCurrentThread GetThreadTimes GetFileSize GetACP GetThreadLocale GetConsoleOutputCP TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW LocalFree TryEnterCriticalSection DeleteCriticalSection CreateDirectoryW GetFileType GetTempPathW GetCurrentProcessId GetTickCount GetEnvironmentVariableA SetEnvironmentVariableA SetCurrentDirectoryW GetCurrentDirectoryW GetFileAttributesW GetFullPathNameW ExpandEnvironmentStringsA SetEvent ResetEvent DeviceIoControl GetProcessTimes GetCurrentThreadId GetStartupInfoW GetVersionExW OpenFileMappingW MapViewOfFile UnmapViewOfFile GetProcessWorkingSetSize FreeLibrary GlobalMemoryStatus HeapReAlloc SetConsoleCtrlHandler OutputDebugStringW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW DuplicateHandle ReadConsoleW GetConsoleMode GetCommandLineW GetModuleFileNameW GetCurrentProcess Sleep CreateEventW WaitForSingleObject GetLastError CloseHandle GetLogicalDrives GetDriveTypeW HeapQueryInformation FlushFileBuffers SetEndOfFile GetTimeZoneInformation FindFirstFileExW GetFileAttributesExW IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW LocalAlloc GetCommandLineA FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileInformationByHandle WriteConsoleW SetStdHandle GetSystemInfo HeapValidate HeapSize ExitProcess FreeLibraryAndExitThread WaitForSingleObjectEx SwitchToThread GetExitCodeThread GetNativeSystemInfo FormatMessageA InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive InitializeCriticalSectionEx InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW GetLocaleInfoEx GetStringTypeW EncodePointer DecodePointer LCMapStringEx SetFileInformationByHandle FlsAlloc FlsGetValue FlsSetValue FlsFree InitOnceExecuteOnce SleepConditionVariableCS CreateEventExW CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber GetSystemTimeAsFileTime GetTickCount64 FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait GetFileInformationByHandleEx CreateSymbolicLinkW CompareStringEx GetCPInfo InitializeCriticalSectionAndSpinCount InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent RaiseException VirtualQuery RtlPcToFileHeader RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList LoadLibraryExW RtlUnwind GetModuleHandleExW ResumeThread

user32

GetProcessWindowStation GetMessagePos GetDesktopWindow GetCaretPos GetCursorPos GetCapture GetInputState GetFocus GetActiveWindow GetOpenClipboardWindow GetClipboardViewer GetClipboardOwner GetMessageTime

advapi32

CryptGenRandom RegQueryValueExW RegOpenKeyExW RegQueryValueExA RegOpenKeyExA RegCloseKey CryptReleaseContext CryptAcquireContextA StartServiceW StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerW OpenServiceW OpenSCManagerW DeleteService CreateServiceW CloseServiceHandle GetUserNameW GetTokenInformation OpenProcessToken

shell32

ShellExecuteExW

ole32

CoCreateGuid StringFromCLSID CoTaskMemFree

rstrtmgr

RmGetList RmRegisterResources RmEndSession RmStartSession RmShutdown

Name

.textbss

Size

Virtual Size

2.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

6.0MB

Virtual Size

6.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

124KB

Virtual Size

153KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

266KB

Virtual Size

265KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

1024B

Virtual Size

671B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

64KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ