204461d39b084014483e8c0838300a41

Sharing

Copy URL Twitter E-mail

General

Target
204461d39b084014483e8c0838300a41
Size 488KB
Sample231230-3mthxaedgk
SHA256 4cf3e0f92076e2f3f879bfaa998cc65284fa7b14bda08fa2f82715f25a685f21
MD5 204461d39b084014483e8c0838300a41
SHA1 2f388a611580bbef170e9404d16ff303073fbfcf
SHA512 f2eaaf0345f84960bab85f98e60a001be77d688af255a474dc736ab3452c736f3cd03f16bb0eef185b07549e8a3332aff4ac5b2f1ad8c1fcd543ced02ad12ee7
SSDEEP 12288:dd3Q9eMdN9zVB3+G7AgG99TdbgsToVxGH:c9eUNFVB3+G7vGDhs6z
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
204461d39b084014483e8c0838300a41

File Explorer

204461d39b084014483e8c0838300a41

.exe 488KB

204461d39b084014483e8c0838300a41

IMPHASH f718d257cb3a4bbbe8310fa60e7d1ded
SHA256 4cf3e0f92076e2f3f879bfaa998cc65284fa7b14bda08fa2f82715f25a685f21
MD5 204461d39b084014483e8c0838300a41
SHA1 2f388a611580bbef170e9404d16ff303073fbfcf
SHA512 f2eaaf0345f84960bab85f98e60a001be77d688af255a474dc736ab3452c736f3cd03f16bb0eef185b07549e8a3332aff4ac5b2f1ad8c1fcd543ced02ad12ee7
SSDEEP 12288:dd3Q9eMdN9zVB3+G7AgG99TdbgsToVxGH:c9eUNFVB3+G7vGDhs6z
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

55456

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

msvcrt

_fmode ?terminate@@YAXXZ _wcmdln _initterm ??1type_info@@UEAA@XZ _lock __setusermatherr _cexit _exit exit _unlock __dllonexit _onexit memmove _commode __set_app_type __wgetmainargs _amsg_exit isdigit _XcptFilter _CxxThrowException _callnewh ??0exception@@QEAA@AEBQEBDH@Z ??0exception@@QEAA@XZ memmove_s memcpy_s _wcsicmp ?what@exception@@UEBAPEBDXZ realloc wcscat_s malloc free ??0exception@@QEAA@AEBV0@@Z ??1exception@@UEAA@XZ ??0exception@@QEAA@AEBQEBD@Z __C_specific_handler __CxxFrameHandler3 memcmp memcpy memset

api-ms-win-core-synch-l1-1-0

SetEvent DeleteCriticalSection InitializeCriticalSection EnterCriticalSection LeaveCriticalSection CreateEventW WaitForSingleObject

api-ms-win-core-libraryloader-l1-2-0

FindResourceExW SizeofResource GetModuleFileNameW LoadResource GetModuleHandleW LoadLibraryExW GetProcAddress FreeLibrary

api-ms-win-core-string-l2-1-0

CharPrevW CharNextW

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter RaiseException GetLastError UnhandledExceptionFilter

api-ms-win-core-registry-l1-1-0

RegNotifyChangeKeyValue RegOpenKeyExW RegQueryValueExW RegQueryInfoKeyW RegDeleteValueW RegSetValueExW RegEnumKeyExW RegEnumValueW RegCloseKey RegCreateKeyExW

api-ms-win-core-memory-l1-1-0

VirtualAlloc VirtualQuery VirtualProtect

api-ms-win-core-sysinfo-l1-1-0

GetSystemInfo GetTickCount GetSystemTimeAsFileTime

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-handle-l1-1-0

DuplicateHandle CloseHandle

api-ms-win-core-synch-l1-2-1

WaitForMultipleObjects

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-heap-l1-1-0

HeapFree GetProcessHeap HeapSetInformation HeapAlloc HeapDestroy

api-ms-win-core-processthreads-l1-1-0

GetCurrentThreadId TerminateProcess GetCurrentProcessId CreateThread GetCurrentProcess GetStartupInfoW

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry RtlCaptureContext RtlVirtualUnwind

api-ms-win-core-threadpool-legacy-l1-1-0

CreateTimerQueue DeleteTimerQueueTimer CreateTimerQueueTimer DeleteTimerQueueEx

api-ms-win-core-string-obsolete-l1-1-0

lstrcmpiW lstrcpynW

cryptbase

SystemFunction036

mswsock

AcceptEx GetAcceptExSockaddrs

api-ms-win-core-file-l1-1-0

WriteFile ReadFile

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

api-ms-win-core-kernel32-legacy-l1-1-0

BindIoCompletionCallback

Name

.text

Size

56KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

21KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

280B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

396KB

Virtual Size

736KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

204461d39b084014483e8c0838300a41

msvcrt

api-ms-win-core-synch-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-string-l2-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-memory-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-synch-l1-2-1

api-ms-win-core-synch-l1-2-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-threadpool-legacy-l1-1-0

api-ms-win-core-string-obsolete-l1-1-0

cryptbase

mswsock

api-ms-win-core-file-l1-1-0

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

generic