9ce792c84ac112d1958875b4ccbc7d1747ad416349edb0b21021b1863e15b78f

Sharing

Copy URL Twitter E-mail

General

Target
9ce792c84ac112d1958875b4ccbc7d1747ad416349edb0b21021b1863e15b78f
Size 6.0MB
Sample240320-mxff2aeh79
SHA256 9ce792c84ac112d1958875b4ccbc7d1747ad416349edb0b21021b1863e15b78f
MD5 9729373f42c999ea9ade560820df7102
SHA1 1070753d6a9b05e35324396d320024ebf042d8c7
SHA512 1134b8067ec6979292a29dba12f8c989729156b6417cdc00c901c7adbb5c8c559cc1a918529571ea1296e3770a063be750a15c9458b1fcaec104e0f3e0a0200e
SSDEEP 98304:9caoZQU7LgG4PwVIsWE61NQq7vW+WHTemGoM:9c1uUwfHNQqYTemGoM
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9ce792c84ac112d1958875b4ccbc7d1747ad416349edb0b21021b1863e15b78f

File Explorer

9ce792c84ac112d1958875b4ccbc7d1747ad416349edb0b21021b1863e15b78f

.exe 6.0MB

9ce792c84ac112d1958875b4ccbc7d1747ad416349edb0b21021b1863e15b78f

IMPHASH 49e6287af890e460497d7376999d7002
SHA256 9ce792c84ac112d1958875b4ccbc7d1747ad416349edb0b21021b1863e15b78f
MD5 9729373f42c999ea9ade560820df7102
SHA1 1070753d6a9b05e35324396d320024ebf042d8c7
SHA512 1134b8067ec6979292a29dba12f8c989729156b6417cdc00c901c7adbb5c8c559cc1a918529571ea1296e3770a063be750a15c9458b1fcaec104e0f3e0a0200e
SSDEEP 98304:9caoZQU7LgG4PwVIsWE61NQq7vW+WHTemGoM:9c1uUwfHNQqYTemGoM
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4367460

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

AcquireSRWLockExclusive CloseHandle CopyFileW CreateEventA CreateEventW CreateFileW CreateIoCompletionPort CreateThread CreateToolhelp32Snapshot DecodePointer DeleteCriticalSection DeviceIoControl DuplicateHandle EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess FindClose FindFirstFileExW FindFirstVolumeW FindNextFileW FindNextVolumeW FindVolumeClose FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetComputerNameA GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceExA GetDiskFreeSpaceExW GetDriveTypeW GetEnvironmentStringsW GetFileAttributesW GetFileSizeEx GetFileType GetFinalPathNameByHandleW GetLastError GetLocaleInfoA GetLocaleInfoW GetLogicalDrives GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHeap GetQueuedCompletionStatus GetStartupInfoW GetStdHandle GetStringTypeW GetSystemInfo GetSystemTimeAsFileTime GetTickCount GetTickCount64 GetUserDefaultLCID GetUserDefaultLangID GetVolumePathNamesForVolumeNameW GetWindowsDirectoryW GlobalMemoryStatusEx HeapAlloc HeapFree HeapReAlloc HeapSize InitializeConditionVariable InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale K32GetModuleFileNameExW LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW LocalFree MoveFileW MultiByteToWideChar OpenProcess OutputDebugStringW PostQueuedCompletionStatus Process32NextW QueryDosDeviceW QueryPerformanceCounter RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetEndOfFile SetErrorMode SetEvent SetFileAttributesW SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter SetVolumeMountPointW Sleep SleepConditionVariableCS SleepConditionVariableSRW SleepEx TerminateProcess TerminateThread TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter WaitForMultipleObjects WaitForSingleObject WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile lstrcatW lstrcmpW lstrcmpiW lstrcpyW lstrlenA lstrlenW

user32

CreateWindowExW DefWindowProcW GetCursorPos MessageBoxW RegisterClassW

advapi32

AdjustTokenPrivileges AllocateAndInitializeSid ChangeServiceConfigW CloseServiceHandle ControlService CreateServiceW CryptAcquireContextW CryptGenRandom CryptReleaseContext EnumDependentServicesW EnumServicesStatusW FreeSid GetTokenInformation LookupPrivilegeValueW LsaClose LsaFreeMemory LsaOpenPolicy LsaQueryInformationPolicy OpenProcessToken OpenSCManagerW OpenServiceW OpenThreadToken QueryServiceConfigW QueryServiceStatusEx RegCloseKey RegOpenKeyExA RegOpenKeyExW RegQueryValueExA RegSetValueExW SetEntriesInAclW SetNamedSecurityInfoW StartServiceW

shell32

CommandLineToArgvW ShellExecuteA ShellExecuteW

netapi32

NetApiBufferFree NetShareEnum

shlwapi

PathFileExistsW SHDeleteKeyW StrCmpNIW StrCmpNW StrStrIW UrlEscapeA UrlUnescapeA wnsprintfA wnsprintfW

iphlpapi

GetIpNetTable

ws2_32

inet_ntoa

wininet

HttpOpenRequestW HttpSendRequestW InternetCloseHandle InternetConnectW InternetCrackUrlW InternetOpenW InternetQueryDataAvailable InternetQueryOptionW InternetReadFile InternetSetOptionW

Name

.text

Size

4.3MB

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

131KB

Virtual Size

130KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gxfg

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.retplne

Size

512B

Virtual Size

156B

Characteristics

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

306KB

Virtual Size

305KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

9ce792c84ac112d1958875b4ccbc7d1747ad416349edb0b21021b1863e15b78f

kernel32

user32

advapi32

shell32

netapi32

shlwapi

iphlpapi

ws2_32

wininet

generic