2092575042b4a2902b3560825a805416c1016cf592a81549e7a5afc9f967eb86

Sharing

Copy URL Twitter E-mail

General

Target
2092575042b4a2902b3560825a805416c1016cf592a81549e7a5afc9f967eb86
Size 3.0MB
Sample230813-el59baba8w
SHA256 2092575042b4a2902b3560825a805416c1016cf592a81549e7a5afc9f967eb86
MD5 8454f54e79c5f3ce5e9f4d842848cc65
SHA1 abfea6d7213ba02d9e875292e71a0f176138bfa8
SHA512 015e890efe781ca5a91d0cf4ef3314d3d432d54c7accc52e86bfccf1d9f740fdd4e6158d644f07b628464473c3eaf329a45c35513c40cc98c90c5b7c4d20a2e4
SSDEEP 49152:V+HRJBJAUqEkE5Nk7eYeTu+E3qQcUAXDVdkl5eNbPlZ:V+CUqYf9l9HjUAX5s5e1
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2092575042b4a2902b3560825a805416c1016cf592a81549e7a5afc9f967eb86

File Explorer

2092575042b4a2902b3560825a805416c1016cf592a81549e7a5afc9f967eb86

.exe 3.0MB

2092575042b4a2902b3560825a805416c1016cf592a81549e7a5afc9f967eb86

IMPHASH 4be9cf61fbea6eb1f9072ab06ecee6cd
SHA256 2092575042b4a2902b3560825a805416c1016cf592a81549e7a5afc9f967eb86
MD5 8454f54e79c5f3ce5e9f4d842848cc65
SHA1 abfea6d7213ba02d9e875292e71a0f176138bfa8
SHA512 015e890efe781ca5a91d0cf4ef3314d3d432d54c7accc52e86bfccf1d9f740fdd4e6158d644f07b628464473c3eaf329a45c35513c40cc98c90c5b7c4d20a2e4
SSDEEP 49152:V+HRJBJAUqEkE5Nk7eYeTu+E3qQcUAXDVdkl5eNbPlZ:V+CUqYf9l9HjUAX5s5e1
MD5 SHA1 SHA512 SSDEEP

windows x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

431872

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegQueryValueExW RegCloseKey OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges EnumerateTraceGuidsEx EventSetInformation EventUnregister EventActivityIdControl EventRegister EventWriteTransfer RegEnumKeyExW RegEnumValueW RegOpenKeyExW EventWrite EventEnabled

ncrypt

BCryptCloseAlgorithmProvider BCryptEncrypt BCryptDecrypt BCryptImportKey BCryptOpenAlgorithmProvider BCryptSetProperty BCryptDestroyKey BCryptGenRandom

kernel32

HeapReAlloc HeapSize SetFilePointerEx GetFileSizeEx FlushFileBuffers GetProcessHeap GetStringTypeW SetStdHandle SetEnvironmentVariableW CreateProcessW VirtualAllocEx SetLastError FormatMessageW GetLastError CloseHandle GetExitCodeProcess TerminateProcess OpenProcess K32EnumProcesses GetProcessId DuplicateHandle GetCurrentProcess GetCPInfoExW GetConsoleMode GetFileType ReadFile ReadConsoleW WriteFile WriteConsoleW GetConsoleOutputCP GetStdHandle MultiByteToWideChar WideCharToMultiByte GetCurrentProcessId TzSpecificLocalTimeToSystemTime SystemTimeToFileTime FileTimeToSystemTime GetSystemTime GetCalendarInfoEx CompareStringOrdinal CompareStringEx FindNLSStringEx GetLocaleInfoEx ResolveLocaleName GetUserPreferredUILanguages FindStringOrdinal GetTickCount64 GetCurrentProcessorNumber GetCurrentThread Sleep InitializeCriticalSection InitializeConditionVariable DeleteCriticalSection LocalFree EnterCriticalSection SleepConditionVariableCS LeaveCriticalSection WakeConditionVariable WaitForMultipleObjectsEx GetFullPathNameW GetLongPathNameW LocalAlloc GetProcAddress RaiseFailFastException LocaleNameToLCID LCMapStringEx EnumTimeFormatsEx EnumCalendarInfoExEx ExpandEnvironmentStringsW FindClose FindFirstFileExW FreeLibrary GetFileAttributesExW GetSystemDirectoryW LoadLibraryExW SetThreadErrorMode GetDynamicTimeZoneInformation GetTimeZoneInformation SetEvent CreateEventExW GetEnvironmentVariableW GetThreadPriority FlushProcessWriteBuffers QueryPerformanceCounter QueryPerformanceFrequency GetCurrentThreadId WaitForSingleObjectEx VirtualQuery RtlRestoreContext AddVectoredExceptionHandler FlsAlloc FlsGetValue FlsSetValue CreateEventW SwitchToThread CreateThread SetThreadPriority SuspendThread ResumeThread GetThreadContext SetThreadContext FlushInstructionCache VirtualAlloc VirtualProtect VirtualFree QueryInformationJobObject GetModuleHandleW GetModuleHandleExW GetProcessAffinityMask InitializeContext GetEnabledXStateFeatures SetXStateFeaturesMask InitializeCriticalSectionEx GetSystemTimeAsFileTime ResetEvent DebugBreak WaitForSingleObject SleepEx GlobalMemoryStatusEx GetSystemInfo GetTickCount GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock GetWriteWatch ResetWriteWatch VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW InitializeCriticalSectionAndSpinCount InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent RtlUnwindEx RtlPcToFileHeader RaiseException EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree RtlUnwind GetModuleFileNameW ExitProcess GetCommandLineA GetCommandLineW HeapAlloc HeapFree FlsFree CompareStringW LCMapStringW CreateFileW

ole32

CoWaitForMultipleHandles CoInitializeEx CoUninitialize CoGetApartmentType

user32

LoadStringW

Name

.text

Size

562KB

Virtual Size

562KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.managed

Size

1013KB

Virtual Size

1012KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

128KB

Virtual Size

183KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

98KB

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

50KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

114KB

Virtual Size

113KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ