a9b8c823b4817d93d9f3c9b9a1fa30da10f676fc8dc51579ee8bc20d1cfe1367

Sharing

Copy URL Twitter E-mail

General

Target
a9b8c823b4817d93d9f3c9b9a1fa30da10f676fc8dc51579ee8bc20d1cfe1367
Size 761KB
Sample241018-b57ppsscjr
SHA256 a9b8c823b4817d93d9f3c9b9a1fa30da10f676fc8dc51579ee8bc20d1cfe1367
MD5 92bccaa34b59d9a9743f4227f7aff667
SHA1 97779e3da63fd6e8728e82df5ee0aeb69896c071
SHA512 5e25afdc876adaf27e5dd7004be218c7b0721e517687388fec1a5e752eca68ccf9d0a689fd1dc8d6802000b7ad5a395eadb8e54b5bcfebffefc5cfe223a04c1a
SSDEEP 6144:ed0/ivn5OAzyTlau2BEnIe5dm+1wCzq/kigCJgv3cwf+9G0zL:Xun5zzyou2BEIEmP+kYc2eG0
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a9b8c823b4817d93d9f3c9b9a1fa30da10f676fc8dc51579ee8bc20d1cfe1367

File Explorer

a9b8c823b4817d93d9f3c9b9a1fa30da10f676fc8dc51579ee8bc20d1cfe1367

.dll 761KB

a9b8c823b4817d93d9f3c9b9a1fa30da10f676fc8dc51579ee8bc20d1cfe1367

IMPHASH 4bbcb0a1d6c11c38fafd40c61385ee0c
SHA256 a9b8c823b4817d93d9f3c9b9a1fa30da10f676fc8dc51579ee8bc20d1cfe1367
MD5 92bccaa34b59d9a9743f4227f7aff667
SHA1 97779e3da63fd6e8728e82df5ee0aeb69896c071
SHA512 5e25afdc876adaf27e5dd7004be218c7b0721e517687388fec1a5e752eca68ccf9d0a689fd1dc8d6802000b7ad5a395eadb8e54b5bcfebffefc5cfe223a04c1a
SSDEEP 6144:ed0/ivn5OAzyTlau2BEnIe5dm+1wCzq/kigCJgv3cwf+9G0zL:Xun5zzyou2BEIEmP+kYc2eG0
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

18251

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\projects\kryptex-backend\backend\node_modules\cpuid\build\Release\cpuid.pdb

kernel32

QueryPerformanceFrequency RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx RtlPcToFileHeader RaiseException InterlockedPushEntrySList InterlockedFlushSList GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer ExitProcess GetModuleHandleExW GetModuleFileNameW GetCurrentThread HeapAlloc HeapFree QueryPerformanceCounter GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetStdHandle GetFileType CloseHandle FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetConsoleCtrlHandler GetStringTypeW FlushFileBuffers WriteFile GetConsoleCP GetConsoleMode SetStdHandle CreateFileW GetFileSizeEx SetFilePointerEx HeapSize HeapReAlloc ReadFile ReadConsoleW SetEndOfFile WriteConsoleW OutputDebugStringW GetSystemInfo LoadLibraryExA GetDateFormatW GetModuleHandleA VirtualProtect VirtualQuery RtlUnwind

advapi32

RegOpenKeyExA RegCloseKey RegQueryValueExA

Name

.text

Size

575KB

Virtual Size

575KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

142KB

Virtual Size

142KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

25KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

283B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

a9b8c823b4817d93d9f3c9b9a1fa30da10f676fc8dc51579ee8bc20d1cfe1367

kernel32

advapi32

generic