c9c94ac5e1991a7db42c7973e328fceeb6f163d9f644031bdfd4123c7b3898b0

General

Target
c9c94ac5e1991a7db42c7973e328fceeb6f163d9f644031bdfd4123c7b3898b0
Size 1.4MB
Sample230930-t7hsgafd48
SHA256 c9c94ac5e1991a7db42c7973e328fceeb6f163d9f644031bdfd4123c7b3898b0
MD5 9df999f142f137b0794b8afcaaedc588
SHA1 a420fbd6cb9d10db807251564c1c9e1718c6fbc5
SHA512 05965800d32160f4f2077739c3a7c26c5d4f7886ad38ea857ad62ff78f954c04dce5995e18447529c5356db3b59518e5ed86bb1dfc7677ab5c0cd4ba2161071c
SSDEEP 24576:GGie5bgXY9eAAh25kI95fIeqtvZ83GKEziPx/zZImBXxV:GGie5bQcAh25kzvFKEziPx/FFB
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c9c94ac5e1991a7db42c7973e328fceeb6f163d9f644031bdfd4123c7b3898b0

File Explorer

c9c94ac5e1991a7db42c7973e328fceeb6f163d9f644031bdfd4123c7b3898b0

.exe 1.4MB

c9c94ac5e1991a7db42c7973e328fceeb6f163d9f644031bdfd4123c7b3898b0

IMPHASH d0f1c6a6d9b90898749c1a859a88de75
SHA256 c9c94ac5e1991a7db42c7973e328fceeb6f163d9f644031bdfd4123c7b3898b0
MD5 9df999f142f137b0794b8afcaaedc588
SHA1 a420fbd6cb9d10db807251564c1c9e1718c6fbc5
SHA512 05965800d32160f4f2077739c3a7c26c5d4f7886ad38ea857ad62ff78f954c04dce5995e18447529c5356db3b59518e5ed86bb1dfc7677ab5c0cd4ba2161071c
SSDEEP 24576:GGie5bgXY9eAAh25kI95fIeqtvZ83GKEziPx/zZImBXxV:GGie5bQcAh25kzvFKEziPx/FFB
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

1020460

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

kernel32

GetFullPathNameW ReleaseSRWLockExclusive AcquireSRWLockExclusive GetLogicalDriveStringsA CloseHandle GetConsoleScreenBufferInfo SetConsoleTextAttribute GetConsoleMode SetConsoleMode QueryPerformanceFrequency GetSystemTimeAsFileTime QueryPerformanceCounter GetSystemInfo FreeEnvironmentStringsW ReleaseMutex FindClose ReleaseSRWLockShared CompareStringOrdinal GetLastError AddVectoredExceptionHandler SetThreadStackGuarantee SwitchToThread Sleep GetCurrentProcess GetCurrentThread RtlCaptureContext GetProcAddress RtlLookupFunctionEntry SetLastError GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW SetEnvironmentVariableW GetCommandLineW FlushFileBuffers DuplicateHandle SetFilePointerEx GetStdHandle GetCurrentProcessId WriteFileEx SleepEx WaitForSingleObject GetExitCodeProcess TerminateProcess WakeAllConditionVariable TryAcquireSRWLockExclusive HeapAlloc GetProcessHeap HeapFree HeapReAlloc AcquireSRWLockShared WaitForSingleObjectEx LoadLibraryA CreateMutexA GetModuleHandleA FindNextFileW CreateFileW GetFileInformationByHandle GetFileInformationByHandleEx FindFirstFileW MoveFileExW GetFinalPathNameByHandleW CreateEventW ReadFile GetOverlappedResult CancelIo GetFileType GetModuleHandleW FormatMessageW GetModuleFileNameW ExitProcess CreateNamedPipeW ReadFileEx WaitForMultipleObjects GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW MultiByteToWideChar WriteConsoleW WideCharToMultiByte CreateThread TlsGetValue TlsSetValue GetConsoleOutputCP HeapSize LCMapStringW CompareStringW GetStringTypeW SetStdHandle GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW GetCommandLineA GetModuleHandleExW WriteFile LoadLibraryExW FreeLibrary TlsFree TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer RaiseException GetCurrentThreadId InitializeSListHead RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent RtlUnwindEx RtlPcToFileHeader

ntdll

NtReadFile NtWriteFile RtlNtStatusToDosError

Sharing

General

Malware Config

Signatures

File Explorer

c9c94ac5e1991a7db42c7973e328fceeb6f163d9f644031bdfd4123c7b3898b0

bcrypt

advapi32

kernel32

ntdll