6fa37b44b02c37654860a889b7357232

Sharing

Copy URL Twitter E-mail

General

Target
6fa37b44b02c37654860a889b7357232
Size 218KB
Sample240918-b4sjdswdmc
SHA256 98ea1bf06f53eba0ad356bd62c8a99351ccf3d86a0e9ec3c3a7fae603bf01a34
MD5 6fa37b44b02c37654860a889b7357232
SHA1 943840ce5e688886c93af9101c200a6aa20d165a
SHA512 f7a1386dc3c0cba6ab62e840f0f48ac5689aed70dcb49f12ac764cf3320aec57657325feb06d4cd00fd126cb932e53b729de49ba385cd33cd5aa18332e61d22a
SSDEEP 3072:BIXRFodXqsjH455EGYx6KAMlGMPyqVP8DRFcp3U/BqryhsKgNtGWIXhOFTTX:Bqg4bElxgjVqVPQFcW/sKsXN0W3Nr
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6fa37b44b02c37654860a889b7357232

File Explorer

6fa37b44b02c37654860a889b7357232

.exe 218KB

6fa37b44b02c37654860a889b7357232

IMPHASH 78da59308ee0088a874b4a6cdd7d91bd
SHA256 98ea1bf06f53eba0ad356bd62c8a99351ccf3d86a0e9ec3c3a7fae603bf01a34
MD5 6fa37b44b02c37654860a889b7357232
SHA1 943840ce5e688886c93af9101c200a6aa20d165a
SHA512 f7a1386dc3c0cba6ab62e840f0f48ac5689aed70dcb49f12ac764cf3320aec57657325feb06d4cd00fd126cb932e53b729de49ba385cd33cd5aa18332e61d22a
SSDEEP 3072:BIXRFodXqsjH455EGYx6KAMlGMPyqVP8DRFcp3U/BqryhsKgNtGWIXhOFTTX:Bqg4bElxgjVqVPQFcW/sKsXN0W3Nr
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

82672

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb

kernel32

FindNextFileW GetCurrentProcess GetModuleHandleExW GetModuleFileNameW LeaveCriticalSection InitializeCriticalSection GetEnvironmentVariableW FindClose MultiByteToWideChar GetLastError GetFileAttributesExW GetFullPathNameW GetProcAddress DeleteCriticalSection WideCharToMultiByte IsWow64Process LoadLibraryExW RtlUnwind FreeLibrary TlsFree TlsSetValue TlsGetValue EnterCriticalSection FindFirstFileExW OutputDebugStringW LoadLibraryA GetModuleHandleW TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError RaiseException RtlPcToFileHeader RtlUnwindEx InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext LCMapStringEx DecodePointer EncodePointer InitializeCriticalSectionEx GetStringTypeW

user32

MessageBoxW

shell32

ShellExecuteW

advapi32

RegOpenKeyExW RegGetValueW DeregisterEventSource RegisterEventSourceW ReportEventW RegCloseKey

api-ms-win-crt-runtime-l1-1-0

_invalid_parameter_noinfo_noreturn _initialize_onexit_table _register_onexit_function _crt_atexit _exit _cexit _seh_filter_exe _set_app_type _configure_wide_argv __p___argc _initialize_wide_environment _get_initial_wide_environment __p___wargv exit terminate _errno _initterm abort _c_exit _register_thread_local_exe_atexit_callback _initterm_e

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s setvbuf __stdio_common_vswprintf __stdio_common_vsnwprintf_s __stdio_common_vfwprintf _set_fmode fflush _wfsopen __p__commode fputws __acrt_iob_func fputwc

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode free malloc calloc

api-ms-win-crt-string-l1-1-0

_wcsdup strcpy_s wcsnlen toupper wcsncmp strcspn

api-ms-win-crt-convert-l1-1-0

_wtoi wcstoul

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv _lock_locales _unlock_locales ___mb_cur_max_func ___lc_codepage_func setlocale ___lc_locale_name_func __pctype_func

api-ms-win-crt-math-l1-1-0

frexp __setusermatherr

api-ms-win-crt-time-l1-1-0

_time64 wcsftime _gmtime64_s

Name

.text

Size

99KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

39KB

Virtual Size

39KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

840B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

6fa37b44b02c37654860a889b7357232

kernel32

user32

shell32

advapi32

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

generic