971782050c51b673582b9a67acd83ceb2ac99cdc21f118805d89c99ea325f326N

General

Target
971782050c51b673582b9a67acd83ceb2ac99cdc21f118805d89c99ea325f326N
Size 113KB
Sample240918-ldrvaatbkh
SHA256 971782050c51b673582b9a67acd83ceb2ac99cdc21f118805d89c99ea325f326
MD5 000e19937f565c3a38ad9b65fc477220
SHA1 13f66b6e809039b03e7828fbe8e01d56ccfcef76
SHA512 d6a70999c61a3fd49e00f547d4d645bcf7a50b4fec62219b263fa2f03ee3f9fba18e04df2eef086c1381972aa65dc1ae9f83794351c7bbe5f033874664d3a9d1
SSDEEP 1536:W966Spw1RSGXwStXQR1mTqZh52bAGXHnDtCdGgYluexaNSxFfHYTo+Gl:88wDSRUT0kbAYn2GgYlBYN2fHYTo+
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
971782050c51b673582b9a67acd83ceb2ac99cdc21f118805d89c99ea325f326N

File Explorer

971782050c51b673582b9a67acd83ceb2ac99cdc21f118805d89c99ea325f326N

.exe 113KB

971782050c51b673582b9a67acd83ceb2ac99cdc21f118805d89c99ea325f326N

IMPHASH c51d659b4b1142d4af3795d09f1d63f7
SHA256 971782050c51b673582b9a67acd83ceb2ac99cdc21f118805d89c99ea325f326
MD5 000e19937f565c3a38ad9b65fc477220
SHA1 13f66b6e809039b03e7828fbe8e01d56ccfcef76
SHA512 d6a70999c61a3fd49e00f547d4d645bcf7a50b4fec62219b263fa2f03ee3f9fba18e04df2eef086c1381972aa65dc1ae9f83794351c7bbe5f033874664d3a9d1
SSDEEP 1536:W966Spw1RSGXwStXQR1mTqZh52bAGXHnDtCdGgYluexaNSxFfHYTo+Gl:88wDSRUT0kbAYn2GgYlBYN2fHYTo+
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

2

Major OS version

5

Entry point

135168

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Vinay\Projects\simple_launcher\dist\t64.pdb

kernel32

ExitProcess GetCommandLineW SearchPathW SetInformationJobObject CreateProcessW SetHandleInformation WaitForSingleObjectEx AssignProcessToJobObject FormatMessageW GetExitCodeProcess GetModuleFileNameW QueryInformationJobObject MultiByteToWideChar GetStartupInfoW GetTempPathW CreateJobObjectA GetStdHandle GetLastError SetStdHandle GetFileType SetConsoleCtrlHandler SetCurrentDirectoryW CloseHandle HeapSize GetProcessHeap SetEndOfFile SetEnvironmentVariableW HeapFree HeapAlloc EnterCriticalSection LeaveCriticalSection GetStringTypeW UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext EncodePointer DecodePointer TerminateProcess GetCurrentProcess InitializeCriticalSectionAndSpinCount GetCommandLineA RtlUnwindEx HeapSetInformation GetVersion HeapCreate GetCPInfo GetACP GetOEMCP IsValidCodePage FlsGetValue FlsSetValue FlsFree SetLastError GetCurrentThreadId FlsAlloc GetProcAddress GetModuleHandleW WriteFile SetHandleCount DeleteCriticalSection Sleep LCMapStringW ReadFile SetFilePointer FreeEnvironmentStringsW GetEnvironmentStringsW GetModuleFileNameA WideCharToMultiByte QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime CreateFileW LoadLibraryW HeapReAlloc GetConsoleCP GetConsoleMode FlushFileBuffers CompareStringW WriteConsoleW

shlwapi

StrStrIW PathRemoveFileSpecW PathCombineW

Name

.text

Size

60KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

852B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.zero

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

971782050c51b673582b9a67acd83ceb2ac99cdc21f118805d89c99ea325f326N

kernel32

shlwapi

generic