cc527877f3fe5db651531afc435632c5dd02f9b0600900b7d95d04d62edc238a

General

Target
cc527877f3fe5db651531afc435632c5dd02f9b0600900b7d95d04d62edc238a
Size 11.0MB
Sample240802-vc9hdasakj
SHA256 cc527877f3fe5db651531afc435632c5dd02f9b0600900b7d95d04d62edc238a
MD5 ffeaa382b4bd7df15ea3b8dbc62dda8f
SHA1 9b7f8e4f5a57a0aae47e6d2c244f1472c77eec1c
SHA512 8900a94f2a44098c65674717de505428034ae126d611e5f6c7de3796d2ec6724a36822b0ad29445ad744975fa94694dd9041d7b7563ca6402d81b8edf11ac508
SSDEEP 24576:sCoZopQ3TmLgqkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkc:1sjms
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cc527877f3fe5db651531afc435632c5dd02f9b0600900b7d95d04d62edc238a

File Explorer

cc527877f3fe5db651531afc435632c5dd02f9b0600900b7d95d04d62edc238a

.exe 11.0MB

cc527877f3fe5db651531afc435632c5dd02f9b0600900b7d95d04d62edc238a

IMPHASH 8406c253adc95c5fe6849445a3438fac
SHA256 cc527877f3fe5db651531afc435632c5dd02f9b0600900b7d95d04d62edc238a
MD5 ffeaa382b4bd7df15ea3b8dbc62dda8f
SHA1 9b7f8e4f5a57a0aae47e6d2c244f1472c77eec1c
SHA512 8900a94f2a44098c65674717de505428034ae126d611e5f6c7de3796d2ec6724a36822b0ad29445ad744975fa94694dd9041d7b7563ca6402d81b8edf11ac508
SSDEEP 24576:sCoZopQ3TmLgqkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkkc:1sjms
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

56144

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\kedefula.pdb

kernel32

ZombifyActCtx GetConsoleAliasesLengthW GetVersionExW GetConsoleOutputCP GetDefaultCommConfigA FindFirstFileExA GetDriveTypeW FreeEnvironmentStringsW SetProcessPriorityBoost FindNextVolumeA SetCurrentDirectoryA GetLongPathNameA TlsSetValue SetComputerNameExA FindAtomW BuildCommDCBAndTimeoutsA VirtualProtect GetModuleHandleA GlobalAlloc InitializeCriticalSection TlsGetValue GetCommandLineW InterlockedDecrement GetCalendarInfoA CopyFileA OutputDebugStringW SetSystemTimeAdjustment GetPriorityClass WritePrivateProfileStringW GetProcessHeaps GlobalWire HeapCompact GetStartupInfoA GetDiskFreeSpaceExA GetCPInfoExA GetWindowsDirectoryW GetSystemWow64DirectoryA SetLastError WriteProfileSectionW GetCalendarInfoW GetProfileStringA SetConsoleCursorPosition GetLastError DeleteVolumeMountPointW ContinueDebugEvent WriteFile GetNumberOfConsoleInputEvents GetSystemWindowsDirectoryW GlobalFindAtomA FindNextChangeNotification CreateActCtxA GetMailslotInfo GetPrivateProfileIntA _lread DefineDosDeviceA SetVolumeMountPointA EndUpdateResourceA WriteConsoleW GetPrivateProfileSectionA WritePrivateProfileSectionA GetPrivateProfileStructA TryEnterCriticalSection GetPrivateProfileSectionNamesW GetFileAttributesExW LocalFileTimeToFileTime MoveFileW GetVolumePathNameA TerminateProcess lstrcmpW GetComputerNameA FindActCtxSectionStringA GetThreadContext MoveFileExA GetProcAddress GlobalCompact UnregisterWait BuildCommDCBW GlobalDeleteAtom GetShortPathNameW OpenEventA SetCommTimeouts WaitNamedPipeW CreateIoCompletionPort GetPrivateProfileSectionNamesA FindResourceExW GetSystemTimeAsFileTime GetSystemInfo FreeEnvironmentStringsA GetLocalTime OpenSemaphoreA WriteProfileStringA lstrcpyW VerLanguageNameW GetThreadSelectorEntry GetSystemTime UnlockFile GetConsoleCP GetConsoleAliasA SetConsoleScreenBufferSize GetAtomNameA WriteConsoleInputW CreateMailslotA SetCommState SetHandleCount _lopen ResetWriteWatch ClearCommBreak GetModuleHandleW GetOverlappedResult EnumDateFormatsA GetConsoleAliasExesLengthW WriteConsoleOutputCharacterA HeapFree OpenMutexW GetStringTypeW SetFilePointer PostQueuedCompletionStatus AreFileApisANSI OpenWaitableTimerW GetCurrentProcess PeekNamedPipe GetCompressedFileSizeW FindNextVolumeMountPointA GetFullPathNameA WriteProfileStringW InitAtomTable GlobalAddAtomW TerminateJobObject SetFirmwareEnvironmentVariableA GetBinaryTypeW LeaveCriticalSection QueryDosDeviceW HeapSetInformation CreateNamedPipeA InterlockedIncrement Sleep DeleteCriticalSection EnterCriticalSection RaiseException RtlUnwind MoveFileA GetCommandLineA HeapValidate IsBadReadPtr UnhandledExceptionFilter SetUnhandledExceptionFilter GetModuleFileNameW IsDebuggerPresent TlsAlloc GetCurrentThreadId TlsFree CloseHandle GetACP GetOEMCP GetCPInfo IsValidCodePage ExitProcess GetStdHandle GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetModuleFileNameA GetEnvironmentStrings WideCharToMultiByte GetEnvironmentStringsW HeapDestroy HeapCreate VirtualFree HeapAlloc HeapSize HeapReAlloc VirtualAlloc FlushFileBuffers GetConsoleMode DebugBreak OutputDebugStringA LoadLibraryW InitializeCriticalSectionAndSpinCount SetStdHandle MultiByteToWideChar GetStringTypeA LCMapStringA LCMapStringW GetLocaleInfoA LoadLibraryA WriteConsoleA CreateFileA

user32

OemToCharA

advapi32

GetFileSecurityW

msimg32

AlphaBlend

Sharing

General

Malware Config

Signatures

File Explorer

cc527877f3fe5db651531afc435632c5dd02f9b0600900b7d95d04d62edc238a

kernel32

user32

advapi32

msimg32

generic