bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816

Sharing

Copy URL Twitter E-mail

General

Target
bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816
Size 1.5MB
Sample240709-exa8bawblr
SHA256 bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816
MD5 adc8b65bed6ed290ea4abeb13ffae0af
SHA1 1abc9804ab9f75a3fb379335a1f985a28e46c17b
SHA512 45218a514c046b502c9bbb6d843cff7d31acb0baf719ce9dc054bc41c490200ae3016dbfb599bd3bf25d822529edd6c6768eeb0283781362ae81a185e8a5a925
SSDEEP 24576:+z2DW48NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:VgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816

File Explorer

bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816

.exe 1.5MB

bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816

IMPHASH c54f40d6023142651a792ae38ae262de
SHA256 bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816
MD5 adc8b65bed6ed290ea4abeb13ffae0af
SHA1 1abc9804ab9f75a3fb379335a1f985a28e46c17b
SHA512 45218a514c046b502c9bbb6d843cff7d31acb0baf719ce9dc054bc41c490200ae3016dbfb599bd3bf25d822529edd6c6768eeb0283781362ae81a185e8a5a925
SSDEEP 24576:+z2DW48NDFKYmKOF0zr31JwAlcR3QC0OXxc0H:VgDUYmvFur31yAipQCtXxc0H
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

30784

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

mscorsvw.pdb

mscoree

GetRequestedRuntimeInfo GetRealProcAddress

msvcr80

?_type_info_dtor_internal_method@type_info@@QEAAXXZ __crt_debugger_hook _decode_pointer _onexit _lock __dllonexit _unlock ?terminate@@YAXXZ __set_app_type _encode_pointer _fmode _commode __setusermatherr _configthreadlocale _initterm_e _initterm _acmdln exit _cexit _ismbblead _exit _XcptFilter __C_specific_handler __getmainargs _amsg_exit free malloc _vsnprintf _snwprintf_s wcstoul wcscat_s towupper _vsnwprintf_s _errno _vsnprintf_s strcpy_s wcsncpy_s wcscpy_s memmove _purecall _wcsicmp memcmp memcpy _CxxThrowException __CxxFrameHandler3 memset

advapi32

RegOpenKeyExA RegDeleteKeyW RegSetValueExW RegCreateKeyExW RegQueryValueExW RegOpenKeyExW RegCloseKey

kernel32

VirtualAlloc SleepEx ReleaseMutex CreateMutexW WaitForSingleObjectEx HeapFree GetProcessHeap HeapAlloc TlsFree TlsAlloc TlsSetValue ReleaseSemaphore CreateSemaphoreW ResetEvent DeleteCriticalSection InitializeCriticalSection LeaveCriticalSection EnterCriticalSection GetCurrentProcessId VirtualFree GetVersionExA RaiseException CloseHandle GetSystemTimeAsFileTime QueryPerformanceCounter GetCurrentThreadId VirtualQuery VirtualProtect HeapCreate HeapDestroy HeapValidate Sleep GetStartupInfoA SetUnhandledExceptionFilter GetTickCount UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext LoadLibraryExW GetCommandLineW GetCurrentProcess SetEvent GetModuleHandleW OpenProcess LoadLibraryW TerminateProcess GetModuleFileNameW GetProcAddress CreateEventW WaitForMultipleObjects IsDebuggerPresent OpenEventW DebugBreak CreateThread TlsGetValue FreeLibrary GetLastError SetLastError LocalFree MultiByteToWideChar GetACP GetCPInfo WideCharToMultiByte FormatMessageW GetEnvironmentVariableW lstrlenW

user32

LoadStringW PeekMessageW DispatchMessageW MessageBoxW MsgWaitForMultipleObjects

ole32

CoRegisterClassObject CoInitializeEx CoReleaseServerProcess CoAddRefServerProcess CoUninitialize CoRevokeClassObject

oleaut32

SetErrorInfo SysStringLen

Sharing

General

Malware Config

Signatures

File Explorer

bb3dd8373caf6de98b85dffdf8908fb533632d6f6c001e25a892c63d76393816

mscoree

msvcr80

advapi32

kernel32

user32

ole32

oleaut32

generic