00d881819445fb423adb68545986c50fb5889dd4
- SHA256 6f6ee24d416bffaefa0123fcc822ac8c66f44d4daa0aba3e19fb5802bfed9664
Behavioral task
behavioral1
Sample
2870a473e49673e2f6feb3d6e0792de6.exe
Resource
win7-20240903-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
2870a473e49673e2f6feb3d6e0792de6.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
5b198d1272b07fa5c8880604f17a4d65.exe
Resource
win7-20240708-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
5b198d1272b07fa5c8880604f17a4d65.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral5
Sample
7d41dd6194db2b9b1514ad154451bb7a.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
8 signatures
150 seconds
General
- Target 00d881819445fb423adb68545986c50fb5889dd4
- Size 1.7MB
- Sample241108-sd2stavbjj
- SHA256 6f6ee24d416bffaefa0123fcc822ac8c66f44d4daa0aba3e19fb5802bfed9664
- MD5 fd71ee51243b06f2f30b83e9eda0a85d
- SHA1 00d881819445fb423adb68545986c50fb5889dd4
- SHA512 8929f9f2563a9cffde05c9579919f44d9286a0ad0440982bd5f5f7994ccbea84667eb7b9385e773fc694b946fd2ee507c619f9754c48a40d3b4037fea3f8f653
- SSDEEP 49152:nO86cdLSZnhoIum89jjh7zYqA/e6w4X2MFkkaZnrFjz:nToOIs9jhfYqA/LX9zaZZ/
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
aurora
C2
-
217.195.155.154:8081
Signatures
- Aurora family
- Unsigned PE 3 IoCs
Checks for missing Authenticode signature.
resource unpack001/2870a473e49673e2f6feb3d6e0792de6.exe.vir unpack001/5b198d1272b07fa5c8880604f17a4d65.exe.vir unpack001/7d41dd6194db2b9b1514ad154451bb7a.exe.vir
File Explorer
-
00d881819445fb423adb68545986c50fb5889dd4.7z 1.7MB
-
2870a473e49673e2f6feb3d6e0792de6.exe.vir.exe 4.9MB
-
5b198d1272b07fa5c8880604f17a4d65.exe.vir.exe 145KB
-
7d41dd6194db2b9b1514ad154451bb7a.exe.vir.exe 383KB
2870a473e49673e2f6feb3d6e0792de6.exe.vir
- IMPHASH 9cbefe68f395e67356e2a5d8d1b285c0
- SHA256 55913852c201a5d380a8f20372c058db1cb0e093b4714b05d10516f5fccc7290
- MD5 2870a473e49673e2f6feb3d6e0792de6
- SHA1 39f016a1a81b29579be1221a49d9f8449e41b613
- SHA512 6fd8c3c7bc28ffa6f605c1a9deb9d5f0be7f38dc133eafe83af20b0bb3ea7745c549bd256447163bf0c470d07efadfd3939415f7876537e3e587f33c1fc4a4cd
- SSDEEP 49152:1oL3J54rb/TBvO90dL3BmAFd4A64nsfJ6HXWQ987QoL4z9jGLofnVTQMUnmECIbe:I0sQo+Bpan9E/awMSe+
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
1
Major OS version
6
Entry point
409664
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
WriteFile
WriteConsoleW
WaitForMultipleObjects
WaitForSingleObject
VirtualQuery
VirtualFree
VirtualAlloc
SwitchToThread
SuspendThread
SetWaitableTimer
SetUnhandledExceptionFilter
SetProcessPriorityBoost
SetEvent
SetErrorMode
SetConsoleCtrlHandler
ResumeThread
PostQueuedCompletionStatus
LoadLibraryA
LoadLibraryW
SetThreadContext
GetThreadContext
GetSystemInfo
GetSystemDirectoryA
GetStdHandle
GetQueuedCompletionStatusEx
GetProcessAffinityMask
GetProcAddress
GetEnvironmentStringsW
GetConsoleMode
FreeEnvironmentStringsW
ExitProcess
DuplicateHandle
CreateWaitableTimerExW
CreateThread
CreateIoCompletionPort
CreateFileA
CreateEventA
CloseHandle
AddVectoredExceptionHandler
Name
.text
Size
2.4MB
Virtual Size
2.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
2.3MB
Virtual Size
2.3MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
242KB
Virtual Size
631KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
38KB
Virtual Size
37KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Name
.symtab
Size
512B
Virtual Size
4B
Characteristics
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
5b198d1272b07fa5c8880604f17a4d65.exe.vir
- IMPHASH 6dbf27f4c70fe2c8ed3e0122ba75d641
- SHA256 9d1040b85717169f5d87bea082725b90d4d858c33ce5e88b198afc4ba68b9ce9
- MD5 5b198d1272b07fa5c8880604f17a4d65
- SHA1 a65b4960479dcb25b7b6d43a1743776f416ce434
- SHA512 53d5268b63018e373945929a5067f86486d7790437186cfd79d49414edd432825e788f9844bbe7b0d0a93d5ece0af6fbbc82f08cbf49754d259c87ba88ea4a02
- SSDEEP 3072:9wLEVbLoEZljy9611VBzEkjqr15MX7aSJpiGmpN:9RXy9611VBzwU2SPiGmz
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
81232
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
D:\a\_work\1\s\artifacts\obj\win-x64.Release\corehost\apphost\standalone\apphost.pdb
kernel32
FindNextFileW
GetCurrentProcess
GetModuleHandleExW
GetModuleFileNameW
LeaveCriticalSection
InitializeCriticalSection
GetEnvironmentVariableW
FindClose
MultiByteToWideChar
GetLastError
GetFileAttributesExW
GetFullPathNameW
GetProcAddress
DeleteCriticalSection
WideCharToMultiByte
IsWow64Process
LoadLibraryExW
FreeLibrary
TlsFree
TlsSetValue
TlsGetValue
TlsAlloc
EnterCriticalSection
FindFirstFileExW
OutputDebugStringW
LoadLibraryA
GetModuleHandleW
InitializeCriticalSectionAndSpinCount
SetLastError
RaiseException
RtlPcToFileHeader
RtlUnwindEx
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
LCMapStringEx
DecodePointer
EncodePointer
InitializeCriticalSectionEx
GetStringTypeW
user32
MessageBoxW
shell32
ShellExecuteW
advapi32
RegOpenKeyExW
RegGetValueW
DeregisterEventSource
RegisterEventSourceW
ReportEventW
RegCloseKey
api-ms-win-crt-runtime-l1-1-0
_exit
__p___argc
_initterm_e
_initterm
_get_initial_wide_environment
_invalid_parameter_noinfo_noreturn
_initialize_wide_environment
_configure_wide_argv
_initialize_onexit_table
_set_app_type
__p___wargv
_seh_filter_exe
_register_onexit_function
_cexit
terminate
_errno
exit
abort
_crt_atexit
_c_exit
_register_thread_local_exe_atexit_callback
api-ms-win-crt-stdio-l1-1-0
setvbuf
fflush
_wfopen
__stdio_common_vswprintf
__stdio_common_vfwprintf
_set_fmode
__stdio_common_vsprintf_s
__acrt_iob_func
fputwc
fputws
__p__commode
api-ms-win-crt-heap-l1-1-0
_set_new_mode
_callnewh
free
malloc
calloc
api-ms-win-crt-string-l1-1-0
wcsnlen
strcpy_s
_wcsdup
strcspn
wcsncmp
toupper
api-ms-win-crt-convert-l1-1-0
_wtoi
wcstoul
api-ms-win-crt-locale-l1-1-0
setlocale
___lc_locale_name_func
localeconv
_unlock_locales
_lock_locales
___mb_cur_max_func
_configthreadlocale
__pctype_func
___lc_codepage_func
api-ms-win-crt-math-l1-1-0
frexp
__setusermatherr
api-ms-win-crt-time-l1-1-0
_gmtime64_s
_time64
wcsftime
Name
.text
Size
97KB
Virtual Size
96KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
36KB
Virtual Size
36KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
2KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
5KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
_RDATA
Size
512B
Virtual Size
244B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1KB
Virtual Size
1KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
1024B
Virtual Size
792B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=12, id=260, version=30034,
count=10, id=259, version=30034,
count=77, id=261, version=30034,
count=16, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=257, version=29395,
count=162, id=1, productName=Unmarked objects,
count=10, id=265, version=30140,
count=1, id=258, version=30140,
7d41dd6194db2b9b1514ad154451bb7a.exe.vir
- IMPHASH 4cea7ae85c87ddc7295d39ff9cda31d1
- SHA256 a5d3a4578fd5979a7e3fe324b7c329e5b853c1c739e73428d77ade897c113e44
- MD5 7d41dd6194db2b9b1514ad154451bb7a
- SHA1 3c2597920f384ee5152754e410594c078bc14fe5
- SHA512 f32284fb34ac82dab3f88c110b51c3ffbf8b6705a96cc472c05dfe083a25ccd9ea3695590d577236f40f5f55778712a4f74251a05056249c31cfe8a7f3182019
- SSDEEP 768:kSvNWMz7EVXU/hVJ+7hSYfGJsQO849wk9ESnGCuqqyUq60atL+Qs1eIeRgiSlmmu:VI47GyTGCwiSnmQUt0LB1eIus5gDB
- MD5 SHA1 SHA512 SSDEEP
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
10
Entry point
31152
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_GUARD_CF
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
wextract.pdb
advapi32
GetTokenInformation
RegDeleteValueA
RegOpenKeyExA
RegQueryInfoKeyA
FreeSid
OpenProcessToken
RegSetValueExA
RegCreateKeyExA
LookupPrivilegeValueA
AllocateAndInitializeSid
RegQueryValueExA
EqualSid
RegCloseKey
AdjustTokenPrivileges
kernel32
_lopen
_llseek
CompareStringA
GetLastError
GetFileAttributesA
GetSystemDirectoryA
LoadLibraryA
DeleteFileA
GlobalAlloc
GlobalFree
CloseHandle
WritePrivateProfileStringA
IsDBCSLeadByte
GetWindowsDirectoryA
SetFileAttributesA
GetProcAddress
GlobalLock
LocalFree
RemoveDirectoryA
FreeLibrary
_lclose
CreateDirectoryA
GetPrivateProfileIntA
GetPrivateProfileStringA
GlobalUnlock
ReadFile
SizeofResource
WriteFile
GetDriveTypeA
LoadLibraryExA
SetFileTime
SetFilePointer
FindResourceA
CreateMutexA
GetVolumeInformationA
WaitForSingleObject
GetCurrentDirectoryA
FreeResource
GetVersion
SetCurrentDirectoryA
GetTempPathA
LocalFileTimeToFileTime
CreateFileA
SetEvent
TerminateThread
GetVersionExA
LockResource
GetSystemInfo
CreateThread
ResetEvent
LoadResource
ExitProcess
GetModuleHandleW
CreateProcessA
FormatMessageA
GetTempFileNameA
DosDateTimeToFileTime
CreateEventA
GetExitCodeProcess
ExpandEnvironmentStringsA
LocalAlloc
lstrcmpA
FindNextFileA
GetCurrentProcess
FindFirstFileA
GetModuleFileNameA
GetShortPathNameA
Sleep
GetStartupInfoW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
GetTickCount
EnumResourceLanguagesA
GetDiskFreeSpaceA
MulDiv
FindClose
gdi32
GetDeviceCaps
user32
ShowWindow
MsgWaitForMultipleObjects
SetWindowPos
GetDC
GetWindowRect
DispatchMessageA
GetSystemMetrics
CallWindowProcA
SetWindowTextA
MessageBoxA
SendDlgItemMessageA
SendMessageA
GetDlgItem
DialogBoxIndirectParamA
GetWindowLongPtrA
SetWindowLongPtrA
SetForegroundWindow
ReleaseDC
EnableWindow
CharNextA
LoadStringA
CharPrevA
EndDialog
MessageBeep
ExitWindowsEx
SetDlgItemTextA
CharUpperA
GetDesktopWindow
PeekMessageA
GetDlgItemTextA
msvcrt
?terminate@@YAXXZ
_commode
_fmode
_acmdln
__C_specific_handler
memset
__setusermatherr
_ismbblead
_cexit
_exit
exit
__set_app_type
__getmainargs
_amsg_exit
_XcptFilter
memcpy_s
_vsnprintf
_initterm
memcpy
comctl32
ord17
cabinet
ord20
ord21
ord23
ord22
version
VerQueryValueA
GetFileVersionInfoSizeA
GetFileVersionInfoA
Name
.text
Size
29KB
Virtual Size
28KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
9KB
Virtual Size
8KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
1024B
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
1024B
Virtual Size
1020B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
341KB
Virtual Size
341KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
32B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=1, id=261, version=26213,
count=2, id=259, version=26213,
count=18, id=260, version=26213,
count=17, id=257, version=26213,
count=160, id=1, productName=Unmarked objects,
count=9, id=264, version=26213,
count=1, id=255, version=26213,
count=1, id=258, version=26213,