8bc50fc624999c1b88ed8b842e195d279fdf33e24458b00d74f026026a09d2ab

Sharing

Copy URL Twitter E-mail

General

Target
8bc50fc624999c1b88ed8b842e195d279fdf33e24458b00d74f026026a09d2ab
Size 5.5MB
Sample240403-m8herscd6v
SHA256 8bc50fc624999c1b88ed8b842e195d279fdf33e24458b00d74f026026a09d2ab
MD5 701c4e45fa484bab72325df9cee69c80
SHA1 d0b7535defb7d3141b55022312d740833fae8f2b
SHA512 a6a3a2bd483b84e7057eb71f3215602a78c12cf37782eb6af5b1d0461ffa4e8d6834921ef9b2557211aa12cccd4fbde8e4b2c0d6ecdfbbb1e7b21ff22413f395
SSDEEP 49152:xIFzxLh+7KFc/rfltudWjXjGjYBJTcWIQKY6sB+gk89esANH1vcUbgkE4W4ed+aW:8h+PL1rkPFDO3RUdSI9LwrYbn
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

8bc50fc624999c1b88ed8b842e195d279fdf33e24458b00d74f026026a09d2ab

.exe 5.5MB

8bc50fc624999c1b88ed8b842e195d279fdf33e24458b00d74f026026a09d2ab

IMPHASH 688b0e874fba5c12c759e02a18d32e0f
SHA256 8bc50fc624999c1b88ed8b842e195d279fdf33e24458b00d74f026026a09d2ab
MD5 701c4e45fa484bab72325df9cee69c80
SHA1 d0b7535defb7d3141b55022312d740833fae8f2b
SHA512 a6a3a2bd483b84e7057eb71f3215602a78c12cf37782eb6af5b1d0461ffa4e8d6834921ef9b2557211aa12cccd4fbde8e4b2c0d6ecdfbbb1e7b21ff22413f395
SSDEEP 49152:xIFzxLh+7KFc/rfltudWjXjGjYBJTcWIQKY6sB+gk89esANH1vcUbgkE4W4ed+aW:8h+PL1rkPFDO3RUdSI9LwrYbn
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

PE Signature issue

Digest

b7:15:c6:c5:d1:77:a7:6e:2b:36:f2:8f:fc:d9:c0:93:f7:5a:8e:5f:50:35:df:54:ad:9b:5a:ba:98:3d:74:fc

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=Microsoft Code Signing PCA 2011,OU=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Apr 3, 2024

Minor OS version

Major OS version

Entry point

450004

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegCloseKey RegCreateKeyExW RegOpenKeyExW RegQueryValueExW RegSetValueExW RegEnumKeyExW RegEnumValueW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges GetTokenInformation DuplicateTokenEx OpenThreadToken RevertToSelf ImpersonateLoggedOnUser CheckTokenMembership EventWrite EventRegister EventEnabled

bcrypt

BCryptSetProperty BCryptOpenAlgorithmProvider BCryptImportKey BCryptDecrypt BCryptEncrypt BCryptCloseAlgorithmProvider BCryptDestroyKey BCryptGenRandom

kernel32

TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer RaiseException RtlPcToFileHeader LoadLibraryA GetProcAddress CreateProcessW WriteProcessMemory GetConsoleWindow AllocConsole FreeConsole FormatMessageW ExitProcess RaiseFailFastException GetTickCount64 GetCurrentProcessorNumber CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait CloseThreadpoolIo FindNLSStringEx CompareStringEx FindStringOrdinal GetUserPreferredUILanguages InitializeConditionVariable WakeConditionVariable InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection FileTimeToSystemTime GetLastError GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetStdHandle GetSystemTime LocalAlloc LocalFree MultiByteToWideChar SetLastError SystemTimeToFileTime WaitForMultipleObjectsEx WaitForSingleObject Sleep GetCurrentThread TzSpecificLocalTimeToSystemTime WideCharToMultiByte WaitForThreadpoolWaitCallbacks CreateThreadpoolIo StartThreadpoolIo CancelThreadpoolIo LocaleNameToLCID LCMapStringEx CompareStringOrdinal GetLocaleInfoEx EnumTimeFormatsEx GetCalendarInfoEx EnumCalendarInfoExEx ResolveLocaleName SleepConditionVariableCS CopyFileExW CreateFileW DeleteFileW DeviceIoControl ExpandEnvironmentStringsW FindClose FindFirstFileExW FlushFileBuffers FreeLibrary GetCurrentDirectoryW GetFileAttributesExW GetFileInformationByHandleEx GetFileType GetFullPathNameW GetLongPathNameW GetModuleFileNameW GetOverlappedResult GetSystemDirectoryW LoadLibraryExW ReadFile SetFileInformationByHandle SetFilePointerEx SetThreadErrorMode CreateThread ResumeThread DuplicateHandle GetThreadPriority SetThreadPriority GetDynamicTimeZoneInformation GetTimeZoneInformation WriteFile CloseHandle SetEvent CreateEventExW GetEnvironmentVariableW GetConsoleCP GetCPInfoExW K32EnumProcessModulesEx IsWow64Process GetExitCodeProcess TerminateProcess OpenProcess K32EnumProcesses K32GetModuleInformation K32GetModuleBaseNameW K32GetModuleFileNameExW GetProcessId QueryFullProcessImageNameW CreatePipe FlushProcessWriteBuffers GetCurrentThreadId WaitForSingleObjectEx QueryPerformanceCounter QueryPerformanceFrequency VirtualQuery RtlCaptureContext RtlRestoreContext AddVectoredExceptionHandler FlsAlloc FlsGetValue FlsSetValue CreateEventW SwitchToThread SuspendThread GetThreadContext SetThreadContext FlushInstructionCache VirtualAlloc VirtualProtect VirtualFree QueryInformationJobObject GetModuleHandleW GetModuleHandleExW GetProcessAffinityMask InitializeContext GetEnabledXStateFeatures SetXStateFeaturesMask InitializeCriticalSectionEx GetSystemTimeAsFileTime ResetEvent DebugBreak SleepEx GlobalMemoryStatusEx GetSystemInfo GetTickCount GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock GetWriteWatch ResetWriteWatch VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo RtlUnwindEx IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry InitializeSListHead SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive ReleaseSRWLockExclusive

ole32

CoWaitForMultipleHandles CoCreateGuid CoGetApartmentType CoTaskMemFree CoTaskMemAlloc CoInitializeEx CoUninitialize

user32

LoadStringW

api-ms-win-crt-math-l1-1-0

sin sqrt tan modf __setusermatherr pow ceil cos floor

api-ms-win-crt-heap-l1-1-0

calloc _set_new_mode _callnewh malloc free

api-ms-win-crt-string-l1-1-0

wcsncmp _wcsicmp strcmp strncpy_s strcpy_s _stricmp

api-ms-win-crt-runtime-l1-1-0

_initterm_e exit _get_initial_wide_environment _initterm _initialize_wide_environment terminate _crt_atexit _register_onexit_function _initialize_onexit_table _configure_wide_argv abort _register_thread_local_exe_atexit_callback _c_exit _cexit __p___wargv _set_app_type __p___argc _seh_filter_exe _exit

api-ms-win-crt-stdio-l1-1-0

__p__commode __stdio_common_vfprintf _set_fmode __stdio_common_vsscanf __stdio_common_vsprintf_s __acrt_iob_func

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

479KB

Virtual Size

479KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.managed

Size

2.8MB

Virtual Size

2.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

154KB

Virtual Size

216KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

206KB

Virtual Size

206KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

71KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

8bc50fc624999c1b88ed8b842e195d279fdf33e24458b00d74f026026a09d2ab

PE Signature issue

advapi32

bcrypt

kernel32

ole32

user32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic