221117-gwmk3adg52

Sharing

Copy URL Twitter E-mail

General

Target
221117-gwmk3adg52
Size 604KB
Sample240226-rysvzagd69
SHA256 c7a7bd1b4c92ecd04a2cee933a616ed9cb567f82d8316bc8ce873a2ab8850d07
MD5 3577cc6664949243192fd4a5a9d84ef5
SHA1 cd13a72cbe8b86bd93ed3213f69cad8f1d59f5c8
SHA512 2a8d0507dd4ae10d765a120bed60001f1370a71132eef8f04bca384843aac285df939ae531062170a3f57ef676f59b7fa88075db9ab33b4f579e96d321a01d7f
SSDEEP 12288:PPNcYhLgtKYU5Js9R2E18xGZn92r3PGFj7mlr:n+euK22EWxG5983eIF
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
221117-gwmk3adg52

File Explorer

221117-gwmk3adg52

.exe 604KB

IMPHASH 19c55dd8a167167bd60449f146e32aa6
SHA256 c7a7bd1b4c92ecd04a2cee933a616ed9cb567f82d8316bc8ce873a2ab8850d07
MD5 3577cc6664949243192fd4a5a9d84ef5
SHA1 cd13a72cbe8b86bd93ed3213f69cad8f1d59f5c8
SHA512 2a8d0507dd4ae10d765a120bed60001f1370a71132eef8f04bca384843aac285df939ae531062170a3f57ef676f59b7fa88075db9ab33b4f579e96d321a01d7f
SSDEEP 12288:PPNcYhLgtKYU5Js9R2E18xGZn92r3PGFj7mlr:n+euK22EWxG5983eIF
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

269664

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

RUXIMICS.pdb

api-ms-win-crt-runtime-l1-1-0

_initterm_e _c_exit _register_thread_local_exe_atexit_callback _initterm

api-ms-win-crt-private-l1-1-0

_o__get_wide_winmain_command_line _o__Getdays _o__Getmonths _o__Gettnames _o__initialize_onexit_table _o__initialize_wide_environment _o__invalid_parameter_noinfo _o__invalid_parameter_noinfo_noreturn _o__malloc_base _o__purecall _o__realloc_base _o__register_onexit_function _o__seh_filter_exe _o__set_app_type _o__set_errno _o__set_fmode _o__set_new_mode _o__Strftime memmove _o__W_Getdays _o__W_Getmonths _o__W_Gettnames _o__wcsdup _o__Wcsftime _o__wcsicmp _o__wtol _o_abort _o_calloc _o_exit _o_free _o_frexp _o_islower _o_isspace _o_isupper _o_ldexp _o_localeconv _o_malloc _o_pow _o_powf _o_rand _o_realloc _o_setlocale _o_srand _o_strncpy_s _o_strtod _o_strtof _o_strtol _o_terminate _o_tolower _o_wcscpy_s __C_specific_handler _o__errno _o__free_base _o__crt_atexit _o__configure_wide_argv _o__configthreadlocale wcschr _CxxThrowException _o__cexit _o__calloc_base _o__callnewh strchr wcsstr __std_type_info_compare _o___stdio_common_vswscanf _o___stdio_common_vswprintf _o___stdio_common_vsprintf_s _o___stdio_common_vsnprintf_s _o___std_exception_destroy _o___std_exception_copy _o___pctype_func _o___p__commode _o____mb_cur_max_func _o____lc_locale_name_func _o____lc_collate_cp_func _o____lc_codepage_func __CxxFrameHandler3 memchr memcmp _o__exit memcpy

api-ms-win-crt-string-l1-1-0

strcspn memset __strncnt wcsnlen

api-ms-win-core-libraryloader-l1-2-0

LoadStringW GetModuleHandleW GetModuleFileNameW GetProcAddress GetModuleFileNameA LoadLibraryExW GetModuleHandleExW FreeLibrary

api-ms-win-core-synch-l1-1-0

ReleaseSemaphore AcquireSRWLockShared ReleaseSRWLockShared AcquireSRWLockExclusive SetEvent ReleaseSRWLockExclusive CreateEventExW InitializeSRWLock WaitForSingleObject ReleaseMutex WaitForSingleObjectEx OpenSemaphoreW CreateMutexExW InitializeCriticalSectionEx DeleteCriticalSection InitializeCriticalSectionAndSpinCount ResetEvent LeaveCriticalSection EnterCriticalSection CreateSemaphoreExW CreateEventW

api-ms-win-core-heap-l1-1-0

GetProcessHeap HeapAlloc HeapFree

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter UnhandledExceptionFilter GetLastError RaiseException SetLastError

api-ms-win-core-processthreads-l1-1-0

CreateProcessAsUserW GetCurrentProcessId GetCurrentThreadId GetStartupInfoW CreateProcessW GetCurrentProcess TerminateProcess GetExitCodeProcess

api-ms-win-core-localization-l1-2-0

SetThreadPreferredUILanguages GetCPInfo GetUserDefaultLocaleName LCMapStringEx GetUserPreferredUILanguages GetLocaleInfoEx FormatMessageW

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent DebugBreak OutputDebugStringW

api-ms-win-core-handle-l1-1-0

CloseHandle

oleaut32

VariantClear SysAllocString SysFreeString VariantInit

api-ms-win-core-rtlsupport-l1-1-0

RtlLookupFunctionEntry RtlCaptureContext RtlVirtualUnwind

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetVersionExW GetSystemTimeAsFileTime GetSystemDirectoryW

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-eventing-legacy-l1-1-0

QueryTraceW

api-ms-win-core-kernel32-legacy-l1-1-0

MoveFileW

api-ms-win-core-heap-obsolete-l1-1-0

LocalFree GlobalFree LocalAlloc

api-ms-win-shcore-obsolete-l1-1-0

CommandLineToArgvW

api-ms-win-eventing-provider-l1-1-0

EventSetInformation EventUnregister EventRegister EventWriteTransfer

api-ms-win-eventing-controller-l1-1-0

StartTraceW EnableTraceEx2 ControlTraceW

api-ms-win-core-synch-l1-2-0

InitOnceComplete InitOnceBeginInitialize

api-ms-win-core-com-l1-1-0

CoUninitialize CoInitializeEx CoTaskMemRealloc CoCreateInstance CoTaskMemAlloc CoTaskMemFree CoWaitForMultipleHandles CoGetApartmentType CoCreateFreeThreadedMarshaler CLSIDFromString

api-ms-win-core-file-l1-1-0

CreateDirectoryW CompareFileTime GetFileAttributesW DeleteFileW

api-ms-win-core-processenvironment-l1-1-0

GetCurrentDirectoryW ExpandEnvironmentStringsW GetCommandLineW

api-ms-win-core-registry-l1-1-0

RegQueryValueExW RegCreateKeyExW RegEnumKeyExW RegGetValueW RegOpenKeyExW RegCloseKey RegSetValueExW

rpcrt4

UuidCreate UuidFromStringW UuidToStringW RpcStringFreeW

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-namedpipe-l1-1-0

PeekNamedPipe CreateNamedPipeW

api-ms-win-crt-locale-l1-1-0

_unlock_locales _lock_locales

api-ms-win-core-registry-l2-1-0

RegDeleteKeyW

api-ms-win-core-shlwapi-obsolete-l1-1-0

StrStrIW StrToIntExW

api-ms-win-security-base-l1-1-0

DuplicateTokenEx

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

winhttp

WinHttpReceiveResponse WinHttpConnect WinHttpOpen WinHttpAddRequestHeaders WinHttpQueryHeaders WinHttpReadData WinHttpOpenRequest WinHttpSetTimeouts WinHttpQueryDataAvailable WinHttpQueryOption WinHttpCloseHandle WinHttpSendRequest

api-ms-win-core-version-l1-1-1

GetFileVersionInfoSizeW GetFileVersionInfoW

crypt32

CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateContext CertVerifyCertificateChainPolicy

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-sysinfo-l1-2-0

GetProductInfo

api-ms-win-core-winrt-string-l1-1-0

WindowsCreateStringReference WindowsDeleteString WindowsCreateString WindowsGetStringRawBuffer

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory RoActivateInstance

api-ms-win-core-winrt-error-l1-1-0

RoTransformError RoOriginateError

api-ms-win-core-string-l1-1-0

WideCharToMultiByte MultiByteToWideChar CompareStringEx GetStringTypeW

api-ms-win-core-util-l1-1-0

DecodePointer EncodePointer

ntdll

RtlConvertDeviceFamilyInfoToString

api-ms-win-core-apiquery-l1-1-0

ApiSetQueryApiSetPresence

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Name

.text

Size

275KB

Virtual Size

275KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

89KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

72B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

75KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer