3698210fac9ca446bf61be29ac07d5c53fcb31bfe6549e80c507154b7b03f02d

Sharing

Copy URL Twitter E-mail

General

Target
3698210fac9ca446bf61be29ac07d5c53fcb31bfe6549e80c507154b7b03f02d
Size 1.8MB
Sample231014-btnsfshf4s
SHA256 3698210fac9ca446bf61be29ac07d5c53fcb31bfe6549e80c507154b7b03f02d
MD5 6dc1ae62e5061e280cd69cbd2b1089fa
SHA1 49de645282784b15f5c385f61d6fc29b32e4f014
SHA512 fe3a8855e664bd849237e0254c50e392d326d93e929d435c3dad2620e3c090bb79e8d97730d55c3b4ea416d781e80e82b2fc5783635ffebb0ba60ff510b7fad1
SSDEEP 24576:8t1NbOpYL0ln9NN05E1AZ5Rf6a9DhvhBG6cJo:ozh0ln9NNmZTf6a3vnGLa
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3698210fac9ca446bf61be29ac07d5c53fcb31bfe6549e80c507154b7b03f02d

File Explorer

3698210fac9ca446bf61be29ac07d5c53fcb31bfe6549e80c507154b7b03f02d

.exe 1.8MB

3698210fac9ca446bf61be29ac07d5c53fcb31bfe6549e80c507154b7b03f02d

IMPHASH 06500afa79d4009a0fa967e7c375115a
SHA256 3698210fac9ca446bf61be29ac07d5c53fcb31bfe6549e80c507154b7b03f02d
MD5 6dc1ae62e5061e280cd69cbd2b1089fa
SHA1 49de645282784b15f5c385f61d6fc29b32e4f014
SHA512 fe3a8855e664bd849237e0254c50e392d326d93e929d435c3dad2620e3c090bb79e8d97730d55c3b4ea416d781e80e82b2fc5783635ffebb0ba60ff510b7fad1
SSDEEP 24576:8t1NbOpYL0ln9NN05E1AZ5Rf6a9DhvhBG6cJo:ozh0ln9NNmZTf6a3vnGLa
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4616

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ole32

CoGetObjectContext CoGetApartmentType CreateBindCtx

kernel32

CompareStringEx CreateFileW HeapSize ReadConsoleW FreeConsole RaiseException InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW FormatMessageA WideCharToMultiByte MultiByteToWideChar GetStringTypeW InitOnceBeginInitialize InitOnceComplete GetLastError FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetModuleHandleExW RtlCaptureStackBackTrace IsProcessorFeaturePresent EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection QueryPerformanceCounter QueryPerformanceFrequency CloseHandle WaitForSingleObjectEx Sleep SwitchToThread GetExitCodeThread GetNativeSystemInfo LocalFree GetLocaleInfoEx EncodePointer DecodePointer LCMapStringEx SetFileInformationByHandle GetTempPathW FlsAlloc FlsGetValue FlsSetValue FlsFree InitOnceExecuteOnce SleepConditionVariableCS CreateEventExW CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber GetSystemTimeAsFileTime GetTickCount64 CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait GetModuleHandleW GetProcAddress GetFileInformationByHandleEx CreateSymbolicLinkW WriteConsoleW GetCPInfo InitializeCriticalSectionAndSpinCount SetEvent ResetEvent CreateEventW IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcess TerminateProcess GetCurrentProcessId InitializeSListHead SetStdHandle RtlUnwind InterlockedPushEntrySList InterlockedFlushSList SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread ResumeThread FreeLibraryAndExitThread ExitProcess GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetCurrentThread HeapFree SetConsoleCtrlHandler HeapAlloc GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile HeapReAlloc GetTimeZoneInformation FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap OutputDebugStringW

Name

.text

Size

778KB

Virtual Size

778KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

802KB

Virtual Size

801KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

195KB

Virtual Size

202KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

270B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ