03d922f691c556c806f0fbdaa6a48943f5e959754a658dac2a837dc366603efc

Sharing

Copy URL Twitter E-mail

General

Target
03d922f691c556c806f0fbdaa6a48943f5e959754a658dac2a837dc366603efc
Size 69KB
Sample240930-13dfhs1fqe
SHA256 03d922f691c556c806f0fbdaa6a48943f5e959754a658dac2a837dc366603efc
MD5 b1e1b1e52cdc4bec7b4dc9043cddace0
SHA1 b84a89acfcd7282874e7dff017dcfa6755e30fb3
SHA512 ac4f18a580b88d438861b63a00b8ea6552ea89d92467613b3fdd5b113d8b39030f6ddf5e36cbcb926f988355d0b0275b0829320499bcd7acfcf111f0f55e3dc5
SSDEEP 768:H3iAXknD6cA9UePT/DvwW6KclRIAW6XHpFH8U7L9fYfiEA0K5ar3TY55X801amg:SI7/IhIAW6XHp177L96jAh5a0am
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
03d922f691c556c806f0fbdaa6a48943f5e959754a658dac2a837dc366603efc

File Explorer

03d922f691c556c806f0fbdaa6a48943f5e959754a658dac2a837dc366603efc

.exe 69KB

03d922f691c556c806f0fbdaa6a48943f5e959754a658dac2a837dc366603efc

IMPHASH c765ffa0b5add1050ada7a5a19c97659
SHA256 03d922f691c556c806f0fbdaa6a48943f5e959754a658dac2a837dc366603efc
MD5 b1e1b1e52cdc4bec7b4dc9043cddace0
SHA1 b84a89acfcd7282874e7dff017dcfa6755e30fb3
SHA512 ac4f18a580b88d438861b63a00b8ea6552ea89d92467613b3fdd5b113d8b39030f6ddf5e36cbcb926f988355d0b0275b0829320499bcd7acfcf111f0f55e3dc5
SSDEEP 768:H3iAXknD6cA9UePT/DvwW6KclRIAW6XHpFH8U7L9fYfiEA0K5ar3TY55X801amg:SI7/IhIAW6XHp177L96jAh5a0am
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

41336

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CloseHandle FormatMessageA GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetModuleHandleW GetProcAddress GetSystemTimeAsFileTime GetThreadContext GetThreadLocale InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent K32EnumProcessModules K32EnumProcesses K32GetModuleBaseNameW LoadLibraryA LoadLibraryExA LocalFree OpenProcess QueryPerformanceCounter RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetUnhandledExceptionFilter Sleep TerminateProcess UnhandledExceptionFilter

vcruntime140

__C_specific_handler __current_exception __current_exception_context memcpy memmove memset

api-ms-win-crt-time-l1-1-0

_time64 clock

api-ms-win-crt-string-l1-1-0

_wcsicmp strlen strncpy

api-ms-win-crt-utility-l1-1-0

rand srand

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _c_exit _cexit _configure_narrow_argv _crt_atexit _exit _get_initial_narrow_environment _initialize_narrow_environment _initialize_onexit_table _initterm _initterm_e _register_onexit_function _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type exit terminate

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __stdio_common_vfprintf __stdio_common_vsprintf _set_fmode puts

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

api-ms-win-crt-environment-l1-1-0

getenv

Name

.text

Size

47KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1024B

Virtual Size

588B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.retplne

Size

512B

Virtual Size

140B

Characteristics

Name

_RDATA

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

03d922f691c556c806f0fbdaa6a48943f5e959754a658dac2a837dc366603efc

kernel32

vcruntime140

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-environment-l1-1-0

generic