a9b9d561de00ab8645f09b17e997cd8cb71a05d7ba1f98b02f054cd3a6f9d6ec

Sharing

Copy URL Twitter E-mail

General

Target
a9b9d561de00ab8645f09b17e997cd8cb71a05d7ba1f98b02f054cd3a6f9d6ec
Size 2.6MB
Sample240524-bc9nlafe2t
SHA256 a9b9d561de00ab8645f09b17e997cd8cb71a05d7ba1f98b02f054cd3a6f9d6ec
MD5 493f4b0d2c4ca5e25b9e082761e69a19
SHA1 5cc170d7f49da4f8095d5d7164d85947cf10ecb5
SHA512 441d4eaa41f9c7ce42323e606e16a325d567ec68ea443b5b59d62da032b59695a21b43c060c4b7d388cc278775dc02d0818652a0c284efc86956b9a6e9cf22e2
SSDEEP 24576:vF5fMqy5ezdTd27RccO1XaaAiF4QEb8n0ilBTAViL0ctTRVG6dQ+O1SFZQXxAa9D:t5fMuz4nO1XaaAx5pIQ+O1SFZQTyHu
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a9b9d561de00ab8645f09b17e997cd8cb71a05d7ba1f98b02f054cd3a6f9d6ec

File Explorer

a9b9d561de00ab8645f09b17e997cd8cb71a05d7ba1f98b02f054cd3a6f9d6ec

.exe 2.6MB

a9b9d561de00ab8645f09b17e997cd8cb71a05d7ba1f98b02f054cd3a6f9d6ec

IMPHASH 3b91208bbe42f346e99b9afc0f2bf798
SHA256 a9b9d561de00ab8645f09b17e997cd8cb71a05d7ba1f98b02f054cd3a6f9d6ec
MD5 493f4b0d2c4ca5e25b9e082761e69a19
SHA1 5cc170d7f49da4f8095d5d7164d85947cf10ecb5
SHA512 441d4eaa41f9c7ce42323e606e16a325d567ec68ea443b5b59d62da032b59695a21b43c060c4b7d388cc278775dc02d0818652a0c284efc86956b9a6e9cf22e2
SSDEEP 24576:vF5fMqy5ezdTd27RccO1XaaAiF4QEb8n0ilBTAViL0ctTRVG6dQ+O1SFZQXxAa9D:t5fMuz4nO1XaaAx5pIQ+O1SFZQTyHu
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

432384

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegCloseKey RegEnumKeyExW RegEnumValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegSetValueExA GetTokenInformation EventWrite EventRegister EventEnabled

bcrypt

BCryptGenerateSymmetricKey BCryptGenRandom BCryptOpenAlgorithmProvider BCryptDestroyKey BCryptCloseAlgorithmProvider

kernel32

TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer CloseThreadpoolIo MultiByteToWideChar GetStdHandle TzSpecificLocalTimeToSystemTime SystemTimeToFileTime FileTimeToSystemTime GetSystemTime GetCalendarInfoEx CompareStringOrdinal CompareStringEx FindNLSStringEx GetLocaleInfoEx ResolveLocaleName GetUserPreferredUILanguages FindStringOrdinal GetTickCount64 GetCurrentProcess GetCurrentThread WaitForSingleObject Sleep CreateThreadpoolWork CloseThreadpoolWork SubmitThreadpoolWork CreateThreadpoolWait SetThreadpoolWait WaitForThreadpoolWaitCallbacks CloseThreadpoolWait DeleteCriticalSection LocalFree EnterCriticalSection SleepConditionVariableCS LeaveCriticalSection WakeConditionVariable QueryPerformanceCounter InitializeCriticalSection InitializeConditionVariable WaitForMultipleObjectsEx GetLastError QueryPerformanceFrequency SetLastError GetFullPathNameW GetLongPathNameW WideCharToMultiByte LocalAlloc GetConsoleOutputCP GetProcAddress RaiseFailFastException CreateThreadpoolIo StartThreadpoolIo CancelThreadpoolIo LocaleNameToLCID LCMapStringEx EnumTimeFormatsEx EnumCalendarInfoExEx CopyFileExW CreateDirectoryW CreateFileW DeleteFileW DeleteVolumeMountPointW CreateSymbolicLinkW DeviceIoControl ExpandEnvironmentStringsW FindNextFileW FindClose FindFirstFileExW FlushFileBuffers FreeLibrary GetCurrentDirectoryW GetFileAttributesExW GetFileInformationByHandle GetFileInformationByHandleEx GetFileType GetFinalPathNameByHandleW GetLogicalDrives GetModuleFileNameW GetOverlappedResult GetSystemDirectoryW GetVolumeInformationW LoadLibraryExW MoveFileExW ReadFile RemoveDirectoryW ReplaceFileW SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetThreadErrorMode GetDynamicTimeZoneInformation GetTimeZoneInformation WriteFile GetCurrentProcessorNumberEx CloseHandle SetEvent CreateEventExW GetEnvironmentVariableW FormatMessageW CreateThread ResumeThread DuplicateHandle GetThreadPriority SetThreadPriority GetCPInfoExW GetConsoleMode WriteConsoleW GetExitCodeProcess CreateProcessW TerminateProcess OpenProcess K32EnumProcesses GetProcessId QueryFullProcessImageNameW CreatePipe GetConsoleCP GetConsoleWindow LoadLibraryA GetModuleHandleA FreeConsole AllocConsole VirtualAllocEx FlushProcessWriteBuffers GetCurrentThreadId WaitForSingleObjectEx VirtualQuery RtlRestoreContext AddVectoredExceptionHandler FlsAlloc FlsGetValue FlsSetValue CreateEventW SwitchToThread SuspendThread GetThreadContext SetThreadContext FlushInstructionCache VirtualAlloc VirtualProtect VirtualFree QueryInformationJobObject GetModuleHandleW GetModuleHandleExW GetProcessAffinityMask InitializeContext GetEnabledXStateFeatures SetXStateFeaturesMask InitializeCriticalSectionEx GetSystemTimeAsFileTime ResetEvent DebugBreak SleepEx GlobalMemoryStatusEx GetSystemInfo GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo RaiseException RtlPcToFileHeader RtlUnwindEx IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext InitializeSListHead GetCurrentProcessId

ole32

CoGetApartmentType CoTaskMemAlloc CoUninitialize CoTaskMemFree CoCreateGuid CoWaitForMultipleHandles CoInitializeEx

user32

LoadStringW

api-ms-win-crt-math-l1-1-0

__setusermatherr sin modf tan ceil cos floor pow

api-ms-win-crt-heap-l1-1-0

calloc malloc _callnewh _set_new_mode free

api-ms-win-crt-string-l1-1-0

strncpy_s _stricmp strcpy_s _wcsicmp strcmp wcsncmp

api-ms-win-crt-runtime-l1-1-0

_exit __p___argc _initterm_e terminate _crt_atexit _register_onexit_function _initialize_onexit_table exit _initterm _get_initial_wide_environment abort __p___wargv _register_thread_local_exe_atexit_callback _c_exit _cexit _seh_filter_exe _set_app_type _initialize_wide_environment _configure_wide_argv

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s __p__commode __stdio_common_vfprintf __stdio_common_vsscanf _set_fmode __acrt_iob_func

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

461KB

Virtual Size

461KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.managed

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

hydrated

Size

Virtual Size

536KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

899KB

Virtual Size

898KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

112KB

Virtual Size

111KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

a9b9d561de00ab8645f09b17e997cd8cb71a05d7ba1f98b02f054cd3a6f9d6ec

advapi32

bcrypt

kernel32

ole32

user32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic