2e979fdba8def722a6e66369a124d13e

Sharing

Copy URL Twitter E-mail

General

Target
2e979fdba8def722a6e66369a124d13e
Size 414KB
Sample240918-ca46rsxblm
SHA256 756db689c2c1ff143eb4855fde5e96446ce5397c6efbf074b17ba091d41d3909
MD5 2e979fdba8def722a6e66369a124d13e
SHA1 0ab714e77668ba7b0944d29d731b3f0c7dd68c32
SHA512 579f50e9241998e08b6c73c81c38cd1d5fc478f097919993bce100ddd47fa60dae2f82ef56ac64f16bf17221f22a28c94da221fdea1ac1a3c36811d1371ed14a
SSDEEP 6144:LGztkBvkE02Ap9ntElxgYYIxW3+WOMjvEV4UJlOOBB5z7Q8Nl:Lykxn02Ap9nulqsxWtjcV3lj7/l
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2e979fdba8def722a6e66369a124d13e

File Explorer

2e979fdba8def722a6e66369a124d13e

.exe 414KB

2e979fdba8def722a6e66369a124d13e

IMPHASH 34ab9ecd1566711ad1baa609e7db9a6b
SHA256 756db689c2c1ff143eb4855fde5e96446ce5397c6efbf074b17ba091d41d3909
MD5 2e979fdba8def722a6e66369a124d13e
SHA1 0ab714e77668ba7b0944d29d731b3f0c7dd68c32
SHA512 579f50e9241998e08b6c73c81c38cd1d5fc478f097919993bce100ddd47fa60dae2f82ef56ac64f16bf17221f22a28c94da221fdea1ac1a3c36811d1371ed14a
SSDEEP 6144:LGztkBvkE02Ap9ntElxgYYIxW3+WOMjvEV4UJlOOBB5z7Q8Nl:Lykxn02Ap9nulqsxWtjcV3lj7/l
MD5 SHA1 SHA512 SSDEEP

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

127760

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

culauncher.pdb

api-ms-win-crt-runtime-l1-1-0

_initterm _c_exit _initterm_e _register_thread_local_exe_atexit_callback

api-ms-win-crt-string-l1-1-0

memset

api-ms-win-crt-private-l1-1-0

_o__purecall _o__register_onexit_function _o__seh_filter_exe _o__set_app_type _o__set_fmode _o__set_new_mode _o__wcsicmp _o__wcsupr_s memcpy _o_exit _o_free _o_malloc _o_realloc _o_terminate _o_wcstok_s _o_wcstoul __C_specific_handler _CxxThrowException _o__invalid_parameter_noinfo_noreturn _o__invalid_parameter_noinfo _o__initialize_wide_environment _o__initialize_onexit_table _o__get_wide_winmain_command_line wcsstr _o__exit _o__errno _o__crt_atexit _o__configure_wide_argv _o__configthreadlocale _o__cexit _o__callnewh _o___stdio_common_vswscanf _o___stdio_common_vswprintf _o___stdio_common_vsprintf_s _o___stdio_common_vsnprintf_s _o___std_exception_destroy _o___std_exception_copy _o___p__commode wcschr memmove __CxxFrameHandler3 memcmp

api-ms-win-core-libraryloader-l1-1-0

GetModuleHandleExW SizeofResource FindResourceExW GetModuleFileNameW FreeLibrary LoadResource GetProcAddress GetModuleFileNameA GetModuleHandleW LockResource

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionAndSpinCount DeleteCriticalSection CreateEventExW ReleaseSRWLockExclusive AcquireSRWLockExclusive CreateMutexExW ReleaseSRWLockShared CreateEventW AcquireSRWLockShared InitializeSRWLock ResetEvent ReleaseSemaphore OpenSemaphoreW WaitForSingleObjectEx SetEvent CreateSemaphoreExW InitializeCriticalSectionEx InitializeCriticalSection WaitForSingleObject CreateMutexW ReleaseMutex

api-ms-win-core-heap-l1-1-0

HeapAlloc HeapFree HeapReAlloc HeapDestroy HeapSize GetProcessHeap

api-ms-win-core-errorhandling-l1-1-0

RaiseException SetLastError GetLastError SetUnhandledExceptionFilter UnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-0

GetCurrentProcessId TerminateProcess GetStartupInfoW OpenProcessToken GetCurrentThreadId GetCurrentProcess

api-ms-win-core-shutdown-l1-1-0

InitiateSystemShutdownExW

api-ms-win-core-com-l1-1-0

CoTaskMemAlloc CoRevokeClassObject CLSIDFromString CoInitializeEx CoTaskMemRealloc CoGetApartmentType CoCreateInstance CoCreateFreeThreadedMarshaler CoCreateGuid CoRegisterClassObject CoTaskMemFree CoWaitForMultipleHandles CoUninitialize

api-ms-win-core-kernel32-legacy-l1-1-0

GetSystemPowerStatus FindResourceW LoadLibraryW MoveFileW

api-ms-win-security-base-l1-1-0

ImpersonateLoggedOnUser RevertToSelf

api-ms-win-core-synch-l1-2-0

Sleep InitOnceBeginInitialize InitOnceComplete

api-ms-win-core-localization-l1-2-0

FormatMessageW GetUserDefaultLocaleName

api-ms-win-core-debug-l1-1-0

OutputDebugStringW IsDebuggerPresent DebugBreak

api-ms-win-core-timezone-l1-1-0

SystemTimeToFileTime FileTimeToSystemTime

api-ms-win-core-handle-l1-1-0

CloseHandle

oleaut32

SysFreeString SysAllocString VariantInit VariantClear

api-ms-win-core-sysinfo-l1-1-0

GetVersionExA GetSystemDirectoryW GetLocalTime GetSystemTimeAsFileTime

api-ms-win-core-file-l1-1-0

GetFileSize CreateFileW LocalFileTimeToFileTime WriteFile CreateDirectoryW GetTempFileNameW GetFileAttributesW DeleteFileW

api-ms-win-eventing-controller-l1-1-0

StartTraceW ControlTraceW EnableTraceEx2

api-ms-win-core-registry-l1-1-0

RegQueryInfoKeyW RegOpenKeyExW RegQueryValueExW RegGetValueW RegSetValueExW RegCloseKey RegEnumValueW RegCreateKeyExW

api-ms-win-security-sddl-l1-1-0

ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-eventing-legacy-l1-1-0

QueryTraceW

api-ms-win-eventing-provider-l1-1-0

EventSetInformation EventWriteTransfer EventRegister EventUnregister

api-ms-win-core-shlwapi-legacy-l1-1-0

PathFileExistsW PathRemoveFileSpecW

api-ms-win-core-heap-obsolete-l1-1-0

LocalAlloc GlobalFree LocalFree

api-ms-win-core-path-l1-1-0

PathCchRemoveFileSpec PathCchCombine

crypt32

CryptStringToBinaryW CertFreeCertificateContext CertVerifyCertificateChainPolicy CertFreeCertificateChain CertGetCertificateChain

api-ms-win-core-rtlsupport-l1-1-0

RtlVirtualUnwind RtlCaptureContext RtlLookupFunctionEntry

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-memory-l1-1-0

MapViewOfFile UnmapViewOfFile CreateFileMappingW

shlwapi

ord354

shell32

SHQueryUserNotificationState CommandLineToArgvW

api-ms-win-core-winrt-error-l1-1-0

RoOriginateError RoTransformError

ext-ms-win-session-wtsapi32-l1-1-0

WTSEnumerateSessionsW WTSFreeMemory

netapi32

NetApiBufferFree

winhttp

WinHttpOpen WinHttpConnect WinHttpOpenRequest WinHttpCloseHandle WinHttpReceiveResponse WinHttpSendRequest WinHttpQueryOption WinHttpSetTimeouts WinHttpAddRequestHeaders WinHttpQueryDataAvailable WinHttpReadData WinHttpQueryHeaders

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-sysinfo-l1-2-0

GetProductInfo

ntdll

RtlConvertDeviceFamilyInfoToString

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW

cryptsp

CryptReleaseContext CryptAcquireContextW CryptHashData CryptDestroyHash CryptGetHashParam CryptCreateHash

api-ms-win-core-file-l1-2-0

GetTempPathW

api-ms-win-core-util-l1-1-0

DecodePointer

version

GetFileVersionInfoSizeW GetFileVersionInfoW

user32

UnregisterClassA

api-ms-win-core-winrt-string-l1-1-0

WindowsDeleteString WindowsGetStringRawBuffer WindowsCreateString WindowsCreateStringReference

api-ms-win-core-winrt-l1-1-0

RoGetActivationFactory RoActivateInstance

wintrust

WTHelperProvDataFromStateData WinVerifyTrust WTHelperGetProvSignerFromChain

ext-ms-win-setupapi-classinstallers-l1-1-2

SetupIterateCabinetW

wininet

InternetOpenW InternetOpenUrlW InternetReadFile InternetCloseHandle HttpQueryInfoW

Sharing

General

Malware Config

Signatures

File Explorer

2e979fdba8def722a6e66369a124d13e

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-core-libraryloader-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-shutdown-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-kernel32-legacy-l1-1-0

api-ms-win-security-base-l1-1-0

api-ms-win-core-synch-l1-2-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-timezone-l1-1-0

api-ms-win-core-handle-l1-1-0

oleaut32

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-eventing-controller-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-security-sddl-l1-1-0

api-ms-win-eventing-legacy-l1-1-0

api-ms-win-eventing-provider-l1-1-0

api-ms-win-core-shlwapi-legacy-l1-1-0

api-ms-win-core-heap-obsolete-l1-1-0

api-ms-win-core-path-l1-1-0

crypt32

api-ms-win-core-rtlsupport-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-string-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-memory-l1-1-0

shlwapi

shell32

api-ms-win-core-winrt-error-l1-1-0

ext-ms-win-session-wtsapi32-l1-1-0

netapi32

winhttp

api-ms-win-core-version-l1-1-0

api-ms-win-core-sysinfo-l1-2-0

ntdll

api-ms-win-core-processenvironment-l1-1-0

cryptsp

api-ms-win-core-file-l1-2-0

api-ms-win-core-util-l1-1-0

version

user32

api-ms-win-core-winrt-string-l1-1-0

api-ms-win-core-winrt-l1-1-0

wintrust

ext-ms-win-setupapi-classinstallers-l1-1-2

wininet

generic