b272e2dd318b37767eb9201f92b35b79043651c704d8cae125b9ca8ad5427152N

General

Target
b272e2dd318b37767eb9201f92b35b79043651c704d8cae125b9ca8ad5427152N
Size 757KB
Sample241110-ej8xeszbjd
SHA256 b272e2dd318b37767eb9201f92b35b79043651c704d8cae125b9ca8ad5427152
MD5 cb0cb6b45cfce5439a54101bc780ec20
SHA1 3d60fdedd3f507576173021d846008cd543c0852
SHA512 c1b430ec9cb8ba3eae0d549db75327fafcd10ac4f8c4b098d616ce111fad31adade2e8615c3d23ac64a1dd79d54aaf3eab7209150f79910ac35d315933a4c9f3
SSDEEP 12288:cNIyZN4+Wv4PLq6Okrh9ZN/hs9DsdaLUJ3eLxN:c9TPmirh9Zdh6ouT
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b272e2dd318b37767eb9201f92b35b79043651c704d8cae125b9ca8ad5427152N

File Explorer

b272e2dd318b37767eb9201f92b35b79043651c704d8cae125b9ca8ad5427152N

.dll 757KB

b272e2dd318b37767eb9201f92b35b79043651c704d8cae125b9ca8ad5427152N

IMPHASH aa2340bf328d6b5eabd2d0e4b31754e4
SHA256 b272e2dd318b37767eb9201f92b35b79043651c704d8cae125b9ca8ad5427152
MD5 cb0cb6b45cfce5439a54101bc780ec20
SHA1 3d60fdedd3f507576173021d846008cd543c0852
SHA512 c1b430ec9cb8ba3eae0d549db75327fafcd10ac4f8c4b098d616ce111fad31adade2e8615c3d23ac64a1dd79d54aaf3eab7209150f79910ac35d315933a4c9f3
SSDEEP 12288:cNIyZN4+Wv4PLq6Okrh9ZN/hs9DsdaLUJ3eLxN:c9TPmirh9Zdh6ouT
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

618496

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\coretech\source\kimi\xml\axe\public\libraries\windows\release\dynamic\axsle\AXSLE.pdb

kernel32

GetProcAddress GetModuleHandleA InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection RtlUnwind RaiseException GetCurrentThreadId GetCommandLineA HeapFree GetVersionExA HeapAlloc GetProcessHeap GetSystemTimeAsFileTime InterlockedIncrement InterlockedDecrement GetLastError HeapReAlloc TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent Sleep HeapSize ExitProcess WriteFile GetStdHandle GetModuleFileNameA SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapDestroy HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetCPInfo GetACP GetOEMCP LCMapStringA MultiByteToWideChar LCMapStringW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale IsValidCodePage GetStringTypeA GetStringTypeW VirtualAlloc LoadLibraryA SetFilePointer GetConsoleCP GetConsoleMode GetLocaleInfoW SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW FlushFileBuffers CreateFileA CloseHandle

Name

.text

Size

399KB

Virtual Size

399KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

121KB

Virtual Size

121KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

22KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

36KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.text

Size

175KB

Virtual Size

176KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

b272e2dd318b37767eb9201f92b35b79043651c704d8cae125b9ca8ad5427152N

kernel32

generic