dab4c40bf852e10b7bca386a7e9654263794e549c7e557ba9618619ace5929d6

Sharing

Copy URL Twitter E-mail

General

Target
dab4c40bf852e10b7bca386a7e9654263794e549c7e557ba9618619ace5929d6
Size 1.2MB
Sample240530-edefmaed47
SHA256 dab4c40bf852e10b7bca386a7e9654263794e549c7e557ba9618619ace5929d6
MD5 aa84ae105291c122261b8313b37a81ac
SHA1 a92f062872043d83f7b815228abf4527b9f6e4be
SHA512 7feb30b1b537b309ae47f58e886e35cd9daca856121ab1c336180220eab04106f64a18880fe7a1afcfe9f3a8a90dc7a2f4a1b630794fe7af7e2afa459994e6ff
SSDEEP 12288:xnB3etSeJ4+/x8J7ct3z5htUcQ1MlhrmQgwwJzt5+7fyZkCtXFiWZF/3o:xBetSeJ4+mIJz5IcuMlQHJxrDiSi
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dab4c40bf852e10b7bca386a7e9654263794e549c7e557ba9618619ace5929d6

File Explorer

dab4c40bf852e10b7bca386a7e9654263794e549c7e557ba9618619ace5929d6

.exe 1.2MB

dab4c40bf852e10b7bca386a7e9654263794e549c7e557ba9618619ace5929d6

IMPHASH 1fa4de8a2407221a129267000545ba9e
SHA256 dab4c40bf852e10b7bca386a7e9654263794e549c7e557ba9618619ace5929d6
MD5 aa84ae105291c122261b8313b37a81ac
SHA1 a92f062872043d83f7b815228abf4527b9f6e4be
SHA512 7feb30b1b537b309ae47f58e886e35cd9daca856121ab1c336180220eab04106f64a18880fe7a1afcfe9f3a8a90dc7a2f4a1b630794fe7af7e2afa459994e6ff
SSDEEP 12288:xnB3etSeJ4+/x8J7ct3z5htUcQ1MlhrmQgwwJzt5+7fyZkCtXFiWZF/3o:xBetSeJ4+mIJz5IcuMlQHJxrDiSi
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

37849

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\a\_work\1\s\\binaries\x86ret\bin\i386\pgomgr.pdb

kernel32

FindFirstFileW FindNextFileW GetEnvironmentVariableW FindClose GetFileAttributesW MultiByteToWideChar QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetModuleHandleW GetCurrentProcess TerminateProcess EncodePointer FormatMessageW LocalFree UnmapViewOfFile MapViewOfFileEx CreateFileMappingW CloseHandle GetFileSize CreateFileW SetLastError GetConsoleMode GetConsoleOutputCP GetCPInfo WideCharToMultiByte WriteFile GetFileType GetUserDefaultUILanguage LoadResource LoadLibraryExW GetProcAddress GetModuleFileNameW FindResourceExW GetProcessHeap HeapFree HeapAlloc GetLastError DecodePointer

vcruntime140

_except_handler4_common memset __current_exception_context __current_exception __unDNameEx _CxxThrowException strstr __std_terminate __std_exception_copy __std_exception_destroy __CxxFrameHandler3 wcschr memmove wcsrchr memcpy

api-ms-win-crt-runtime-l1-1-0

exit _controlfp_s _initialize_onexit_table terminate _register_onexit_function _cexit __p___wargv __p___argc _exit _initterm_e _initterm _get_initial_wide_environment _initialize_wide_environment _configure_wide_argv _c_exit _set_app_type _seh_filter_exe _crt_atexit _register_thread_local_exe_atexit_callback _invalid_parameter_noinfo_noreturn _errno

api-ms-win-crt-heap-l1-1-0

malloc calloc free _set_new_mode _callnewh

api-ms-win-crt-stdio-l1-1-0

fputs _fileno __stdio_common_vsnwprintf_s __stdio_common_vswscanf fflush _get_osfhandle fclose _wfopen_s __stdio_common_vswprintf_s _set_fmode __p__commode __acrt_iob_func

api-ms-win-crt-string-l1-1-0

_wcsdup _wcsnicmp _wcsicmp wcsncat_s wcsncpy_s wcscpy_s wcscat_s wcstok_s

api-ms-win-crt-filesystem-l1-1-0

_wsplitpath_s _waccess_s

api-ms-win-crt-convert-l1-1-0

_wtoi wcstoul wcstol _itow_s

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

msvcp140

?_Xlength_error@std@@YAXPBD@Z

pgodb140

?FreeMemory@PogoDbUtil@@SGXPAX@Z PogoDbStreamNames ?NewPgdObject@PogoDbUtil@@SGPAVPogoDbInterface@@XZ ?GetErrorText@PogoDbUtil@@SGPBGW4POGODB_ERROR@@@Z ?GetMachineAttributes@PogoDbUtil@@SGPAUtagPGDMACHINEATTR@@K@Z ?FormatTime_s@PogoDbUtil@@SGHPB_KPADI@Z ?DeletePgdObject@PogoDbUtil@@SGPAVPogoDbInterface@@PAV2@@Z

api-ms-win-crt-environment-l1-1-0

_wdupenv_s

api-ms-win-crt-conio-l1-1-0

_cputws

Sharing

General

Malware Config

Signatures

File Explorer

dab4c40bf852e10b7bca386a7e9654263794e549c7e557ba9618619ace5929d6

kernel32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

msvcp140

pgodb140

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-conio-l1-1-0

generic