06c62f65c6c7e19ba840ea3595868de059c6a9c2134577780fdb3c1399f4d859

Sharing

Copy URL Twitter E-mail

General

Target
06c62f65c6c7e19ba840ea3595868de059c6a9c2134577780fdb3c1399f4d859
Size 397KB
Sample231018-pavcsaeb71
SHA256 06c62f65c6c7e19ba840ea3595868de059c6a9c2134577780fdb3c1399f4d859
MD5 2ba09ded899d2a276aa79ee33cf863ab
SHA1 9a98fbf85cd2a6d8c6419a2b666eb2d70228c849
SHA512 a8ee5de40cf0bfd437865bcd6e36cbac55df008d73ce6b164e97141f9099db962fd43fc3b86b655f4c9917551feb73fb38f69bf925f948633181012a37f5755f
SSDEEP 3072:Nji54sCWZwDurPADkMorI++HEKRXzTU39Mdff9X3T4vhVMtl/kQlXI0saJdon/zE:pk4sPPckM4B0Ts9Mdtztl/pY0xKnuOsd
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
06c62f65c6c7e19ba840ea3595868de059c6a9c2134577780fdb3c1399f4d859

File Explorer

06c62f65c6c7e19ba840ea3595868de059c6a9c2134577780fdb3c1399f4d859

.exe 397KB

06c62f65c6c7e19ba840ea3595868de059c6a9c2134577780fdb3c1399f4d859

IMPHASH c6e3fe897fa46e90fbf2162d8592eaeb
SHA256 06c62f65c6c7e19ba840ea3595868de059c6a9c2134577780fdb3c1399f4d859
MD5 2ba09ded899d2a276aa79ee33cf863ab
SHA1 9a98fbf85cd2a6d8c6419a2b666eb2d70228c849
SHA512 a8ee5de40cf0bfd437865bcd6e36cbac55df008d73ce6b164e97141f9099db962fd43fc3b86b655f4c9917551feb73fb38f69bf925f948633181012a37f5755f
SSDEEP 3072:Nji54sCWZwDurPADkMorI++HEKRXzTU39Mdff9X3T4vhVMtl/kQlXI0saJdon/zE:pk4sPPckM4B0Ts9Mdtztl/pY0xKnuOsd
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

115712

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

api-ms-win-crt-locale-l1-1-0

_lock_locales _unlock_locales

api-ms-win-crt-string-l1-1-0

memset wcsnlen

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback _initterm _initterm_e _c_exit

api-ms-win-crt-private-l1-1-0

_o__ismbblead _o__purecall _o__putws _o__register_onexit_function _o__seh_filter_exe _o__set_app_type _o__set_errno _o__set_fmode _o__set_new_mode _o__wcsdup _o__wcsicmp _o__wcsnicmp _o__wcsupr_s _o_abort _o_exit _o_free _o_malloc _o_realloc _o_setlocale _o_strncpy_s _o_strtol _o_terminate _o_wcstok_s _o_wcstombs _o_wcstoul __uncaught_exception __C_specific_handler _CxxThrowException _o__invalid_parameter_noinfo_noreturn _o__invalid_parameter_noinfo _o__initialize_wide_environment _o__initialize_onexit_table _o__get_wide_winmain_command_line wcsstr _o__exit _o__errno _o__crt_atexit _o__configure_wide_argv _o__configthreadlocale _o__cexit _o__calloc_base _o__callnewh _o___stdio_common_vswscanf _o___stdio_common_vswprintf _o___stdio_common_vsprintf_s _o___stdio_common_vsnprintf_s _o___std_exception_destroy _o___std_exception_copy _o___pctype_func _o___p__commode _o____mb_cur_max_func _o____lc_locale_name_func _o____lc_codepage_func strrchr strchr wcschr memmove __CxxFrameHandler3 memcmp memcpy

api-ms-win-core-file-l1-1-0

GetFileSize DeleteFileW WriteFile CreateFileW GetTempFileNameW GetFileAttributesW CreateDirectoryW

api-ms-win-core-libraryloader-l1-1-0

GetModuleFileNameW GetModuleHandleExW GetProcAddress GetModuleHandleW FreeLibrary GetModuleFileNameA

api-ms-win-core-synch-l1-2-0

InitOnceBeginInitialize InitOnceExecuteOnce InitOnceComplete

api-ms-win-eventing-controller-l1-1-0

EnableTraceEx2 StartTraceW ControlTraceW

api-ms-win-core-registry-l1-1-0

RegCloseKey RegQueryValueExW RegQueryInfoKeyW RegSetValueExW RegOpenKeyExW RegDeleteValueW RegCreateKeyExW RegEnumValueW RegGetValueW

api-ms-win-core-synch-l1-1-0

InitializeSRWLock CreateEventExW AcquireSRWLockShared SetEvent DeleteCriticalSection InitializeCriticalSectionEx WaitForSingleObjectEx ReleaseSemaphore AcquireSRWLockExclusive OpenSemaphoreW CreateMutexW WaitForSingleObject LeaveCriticalSection ReleaseSRWLockExclusive CreateMutexExW ReleaseMutex CreateSemaphoreExW ReleaseSRWLockShared

api-ms-win-core-heap-l1-1-0

GetProcessHeap HeapAlloc HeapFree

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter SetUnhandledExceptionFilter RaiseException GetLastError SetLastError

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-com-l1-1-0

CoUninitialize CoInitializeEx CLSIDFromString CoTaskMemRealloc CoCreateFreeThreadedMarshaler CoGetApartmentType CoWaitForMultipleHandles CoTaskMemAlloc CoCreateGuid CoTaskMemFree

api-ms-win-eventing-legacy-l1-1-0

QueryTraceW

api-ms-win-eventing-provider-l1-1-0

EventRegister EventSetInformation EventUnregister EventWriteTransfer

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFileExistsW PathRemoveFileSpecW

api-ms-win-core-heap-obsolete-l1-1-0

LocalFree GlobalFree LocalAlloc

api-ms-win-core-processthreads-l1-1-0

GetStartupInfoW TerminateProcess GetCurrentProcess GetCurrentThreadId OpenProcessToken GetCurrentProcessId

api-ms-win-core-localization-l1-2-0

GetUserDefaultLocaleName FormatMessageW LCMapStringEx

api-ms-win-core-debug-l1-1-0

DebugBreak IsDebuggerPresent OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

oleaut32

VariantClear

api-ms-win-core-path-l1-1-0

PathCchRemoveFileSpec PathCchCombine

crypt32

CertFreeCertificateContext CertGetCertificateChain CertFreeCertificateChain CertVerifyCertificateChainPolicy CryptStringToBinaryW

api-ms-win-core-kernel32-legacy-l1-1-0

LoadLibraryW MoveFileW

api-ms-win-core-string-l1-1-0

GetStringTypeW WideCharToMultiByte MultiByteToWideChar

api-ms-win-core-util-l1-1-0

DecodePointer EncodePointer

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry RtlCaptureContext RtlVirtualUnwind

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemDirectoryW GetLocalTime GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-memory-l1-1-0

MapViewOfFile UnmapViewOfFile CreateFileMappingW

shell32

CommandLineToArgvW

winhttp

WinHttpReceiveResponse WinHttpQueryOption WinHttpOpen WinHttpQueryDataAvailable WinHttpConnect WinHttpSetTimeouts WinHttpAddRequestHeaders WinHttpSendRequest WinHttpOpenRequest WinHttpCloseHandle WinHttpReadData WinHttpQueryHeaders

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-sysinfo-l1-2-0

GetProductInfo

ntdll

RtlConvertDeviceFamilyInfoToString

api-ms-win-core-timezone-l1-1-0

FileTimeToSystemTime SystemTimeToFileTime

api-ms-win-core-registry-l2-1-0

RegSetKeyValueW

cryptsp

CryptDestroyHash CryptCreateHash CryptHashData CryptAcquireContextW CryptGetHashParam CryptReleaseContext

api-ms-win-security-base-l1-1-0

GetTokenInformation

api-ms-win-core-file-l1-2-0

GetTempPathW

version

GetFileVersionInfoSizeW GetFileVersionInfoW

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateString WindowsCreateStringReference WindowsGetStringRawBuffer WindowsDeleteString

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory RoActivateInstance

api-ms-win-core-winrt-error-l1-1-0

RoTransformError RoOriginateError

wintrust

WTHelperProvDataFromStateData WTHelperGetProvSignerFromChain WinVerifyTrust

wininet

InternetOpenUrlW InternetReadFile InternetOpenW HttpQueryInfoW InternetCloseHandle

ext-ms-win-setupapi-classinstallers-l1-1-2

SetupIterateCabinetW