b56390ebde9d10dd7666358b57db7d9f0665e3305f6e50d714faf68568be91d2

Sharing

Copy URL Twitter E-mail

General

Target
b56390ebde9d10dd7666358b57db7d9f0665e3305f6e50d714faf68568be91d2
Size 616KB
Sample240530-cf4r7abe66
SHA256 b56390ebde9d10dd7666358b57db7d9f0665e3305f6e50d714faf68568be91d2
MD5 60513d666094ab5605c7e73f14e0a5f5
SHA1 74c9abce7d83fb379fbc953262723a866e626edc
SHA512 72065250148eb3f9b580f953c9d10a8aeb7025abcffbc86915fa9ca2b046752853bd9bd51b15e323b9df6525d9e9c85539c65b21693c69fb6528dc7374385045
SSDEEP 12288:Arfu4XHx6kdeLYqdWwwlIwIEO/ekUvn4pAa3Y/eJKiUdJL59S/vTuE:wuoHEkdeLYqEwwurEOWkUv4p7cGdUjLO
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b56390ebde9d10dd7666358b57db7d9f0665e3305f6e50d714faf68568be91d2

File Explorer

b56390ebde9d10dd7666358b57db7d9f0665e3305f6e50d714faf68568be91d2

.exe 616KB

b56390ebde9d10dd7666358b57db7d9f0665e3305f6e50d714faf68568be91d2

IMPHASH 88aac23f5141acd5d3fcc18999868875
SHA256 b56390ebde9d10dd7666358b57db7d9f0665e3305f6e50d714faf68568be91d2
MD5 60513d666094ab5605c7e73f14e0a5f5
SHA1 74c9abce7d83fb379fbc953262723a866e626edc
SHA512 72065250148eb3f9b580f953c9d10a8aeb7025abcffbc86915fa9ca2b046752853bd9bd51b15e323b9df6525d9e9c85539c65b21693c69fb6528dc7374385045
SSDEEP 12288:Arfu4XHx6kdeLYqdWwwlIwIEO/ekUvn4pAa3Y/eJKiUdJL59S/vTuE:wuoHEkdeLYqEwwurEOWkUv4p7cGdUjLO
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8540

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\_work\1\s\\binaries\amd64ret\bin\amd64\pgocvt.pdb

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __std_exception_copy __std_exception_destroy memcpy wcschr __current_exception_context __current_exception __C_specific_handler wcsrchr memset

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argc _register_onexit_function _exit _initterm_e _initterm _get_initial_wide_environment _initialize_wide_environment _configure_wide_argv __p___wargv _set_app_type _seh_filter_exe __p__wpgmptr exit _crt_atexit _errno terminate

api-ms-win-crt-stdio-l1-1-0

_fileno fclose _wfsopen _get_osfhandle __stdio_common_vsnwprintf_s _chsize_s ftell fwrite putchar fputs __acrt_iob_func fflush _set_fmode __p__commode fseek __stdio_common_vswprintf_s __stdio_common_vswscanf

api-ms-win-crt-time-l1-1-0

_time64 _tzset

api-ms-win-crt-heap-l1-1-0

free calloc _callnewh _set_new_mode malloc

api-ms-win-crt-string-l1-1-0

wcscmp _wcsdup wcsncpy_s wcstok_s wcscpy_s wcsncat_s _wcsicmp

api-ms-win-crt-filesystem-l1-1-0

_wsplitpath_s _wmakepath_s

api-ms-win-crt-environment-l1-1-0

_wdupenv_s _wgetcwd

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

pgodb140

?SzUtf8DupWz@PogoDbUtil@@SAPEADPEBG@Z ?GetMachineId@PogoDbUtil@@SAKPEBG@Z ?GetErrorText@PogoDbUtil@@SAPEBGW4POGODB_ERROR@@@Z ?NewPgdObject@PogoDbUtil@@SAPEAVPogoDbInterface@@XZ ?FreeMemory@PogoDbUtil@@SAXPEAX@Z ?GetMachineName@PogoDbUtil@@SAPEBGK@Z ?GetMachineAttributes@PogoDbUtil@@SAPEAUtagPGDMACHINEATTR@@K@Z ?DeletePgdObject@PogoDbUtil@@SAPEAVPogoDbInterface@@PEAV2@@Z

kernel32

RtlVirtualUnwind GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent FormatMessageW LocalFree GetConsoleMode GetConsoleOutputCP GetCPInfo WideCharToMultiByte WriteFile GetFileType GetUserDefaultUILanguage LoadResource LoadLibraryExW GetProcAddress GetModuleFileNameW FindResourceExW GetProcessHeap HeapFree HeapAlloc DecodePointer EncodePointer FindNextFileW FindFirstFileW FindClose SetLastError GetLastError GetEnvironmentVariableW TerminateProcess GetCurrentProcess GetModuleHandleW QueryPerformanceCounter

api-ms-win-crt-convert-l1-1-0

wcstoul _itow_s wcstol _wtoi64

api-ms-win-crt-conio-l1-1-0

_cputws

Name

.text

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

b56390ebde9d10dd7666358b57db7d9f0665e3305f6e50d714faf68568be91d2

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

pgodb140

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-conio-l1-1-0

generic