b2da6e56ae7c16b232d50db4444548871b1afa4c85a7077da48c5c1da5230f3d

Sharing

Copy URL Twitter E-mail

General

Target
b2da6e56ae7c16b232d50db4444548871b1afa4c85a7077da48c5c1da5230f3d
Size 7.3MB
Sample241210-apavcs1rdj
SHA256 b2da6e56ae7c16b232d50db4444548871b1afa4c85a7077da48c5c1da5230f3d
MD5 d80bdd3b9cf78abf9f897549ac6d584d
SHA1 3b47134227c19819aea623a0840e7708356878b4
SHA512 15b197c0d6ebfe286746b90552519bb9895da4af99db0f3b9e0a6704960ef9b23d2b8a3284e0e9207d480bb17a505c778f242ff265b1c460ae7d670318b2ad48
SSDEEP 98304:vxC3ud6MOIvysi7CQKzo5qphIHVruP3WpF3UdE1hZHEdLF003:EGQgMkhgJuP32+dmhZk/0s
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b2da6e56ae7c16b232d50db4444548871b1afa4c85a7077da48c5c1da5230f3d

File Explorer

b2da6e56ae7c16b232d50db4444548871b1afa4c85a7077da48c5c1da5230f3d

.exe 7.3MB

b2da6e56ae7c16b232d50db4444548871b1afa4c85a7077da48c5c1da5230f3d

IMPHASH 7919c2f06f2b8d1d63b9af30c10fcfcc
SHA256 b2da6e56ae7c16b232d50db4444548871b1afa4c85a7077da48c5c1da5230f3d
MD5 d80bdd3b9cf78abf9f897549ac6d584d
SHA1 3b47134227c19819aea623a0840e7708356878b4
SHA512 15b197c0d6ebfe286746b90552519bb9895da4af99db0f3b9e0a6704960ef9b23d2b8a3284e0e9207d480bb17a505c778f242ff265b1c460ae7d670318b2ad48
SSDEEP 98304:vxC3ud6MOIvysi7CQKzo5qphIHVruP3WpF3UdE1hZHEdLF003:EGQgMkhgJuP32+dmhZk/0s
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

952704

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\B\T\BuildResults\bin\Release\AcroCEF\RdrCEF.pdb

kernel32

DuplicateHandle GetFileType SetHandleInformation RegisterWaitForSingleObject UnregisterWaitEx AssignProcessToJobObject WriteProcessMemory CreateFileMappingW MapViewOfFile VirtualFree GetProcessHandleCount GetProcessHeaps SignalObjectAndWait GetFileAttributesW QueryDosDeviceW GetLongPathNameW CreateFileW VirtualProtectEx ReadProcessMemory GetCurrentDirectoryW GetModuleFileNameW GetLocalTime OutputDebugStringA WriteFile FormatMessageA LoadLibraryExW LoadLibraryW FreeLibrary ReleaseSRWLockExclusive VirtualFreeEx CreateNamedPipeW CreateProcessW CreateRemoteThread CreateJobObjectW UnmapViewOfFile FindResourceW SizeofResource LoadResource LockResource CreateDirectoryW ReadFile TlsGetValue TryAcquireSRWLockExclusive AcquireSRWLockExclusive GetSystemTimeAsFileTime QueryPerformanceFrequency QueryPerformanceCounter QueryThreadCycleTime VirtualAlloc SetThreadPriority SearchPathW lstrlenW DebugBreak GetModuleHandleExW SetFilePointerEx GetFileSizeEx SetEndOfFile FlushFileBuffers FindClose FindNextFileW FindFirstFileExW SetUnhandledExceptionFilter RtlCaptureStackBackTrace TlsAlloc TlsFree TlsSetValue VirtualQuery WideCharToMultiByte K32QueryWorkingSetEx SwitchToThread QueryDepthSList InterlockedPopEntrySList ReleaseSemaphore GetThreadTimes UnregisterWait SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation CreateTimerQueue FreeLibraryAndExitThread ExitThread GetExitCodeThread AreFileApisANSI GetWindowsDirectoryW DeviceIoControl GetEnvironmentVariableW TryEnterCriticalSection CreateEventA GetThreadId RaiseException IsDebuggerPresent Sleep ProcessIdToSessionId GetCurrentProcessId LocalFree GetNativeSystemInfo GetVersionExW GetTickCount EnumSystemLocalesEx GetUserDefaultLocaleName GetUserDefaultLCID GetUserDefaultLangID TerminateProcess GetCurrentThreadId SetInformationJobObject DeleteCriticalSection WaitForSingleObject PostQueuedCompletionStatus SetEvent TerminateJobObject LeaveCriticalSection EnterCriticalSection GetQueuedCompletionStatus ResetEvent SetLastError CreateThread CreateEventW CreateIoCompletionPort InitializeCriticalSection VirtualAllocEx VirtualQueryEx GetCurrentThread GetModuleHandleA HeapSize HeapReAlloc HeapFree HeapAlloc HeapDestroy HeapCreate GetSystemInfo VerifyVersionInfoW SetDllDirectoryW GetProcAddress GetModuleHandleW GetCurrentProcess CreateMutexW ReleaseMutex HeapSetInformation GetProcessHeap GetLastError CloseHandle GetCommandLineW GetThreadPriority CancelIoEx DisconnectNamedPipe ConnectNamedPipe CancelSynchronousIo GetProcessTimes VerSetConditionMask SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage OutputDebugStringW GetTimeZoneInformation ReadConsoleW EnumSystemLocalesW IsValidLocale GetTimeFormatW VirtualProtect LoadLibraryExA InitializeSRWLock ReleaseSRWLockShared AcquireSRWLockShared FormatMessageW LocalAlloc TerminateThread CreateFileMappingA MapViewOfFileEx OpenFileMappingA ExitProcess MultiByteToWideChar GetStringTypeW EncodePointer DecodePointer InitializeCriticalSectionAndSpinCount CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo WaitForSingleObjectEx IsProcessorFeaturePresent UnhandledExceptionFilter GetStartupInfoW InitializeSListHead RtlUnwind InterlockedPushEntrySList InterlockedFlushSList GetConsoleCP GetConsoleMode SetStdHandle GetStdHandle WriteConsoleW GetDateFormatW

user32

CloseDesktop CloseWindowStation GetSystemMetrics GetProcessWindowStation CreateWindowStationW GetThreadDesktop SetProcessWindowStation GetUserObjectInformationW CreateDesktopW

advapi32

GetUserNameW EventWrite EventUnregister EventRegister GetSidSubAuthorityCount SetEntriesInAclW GetSecurityInfo GetSidSubAuthority InitializeSid CreateWellKnownSid CopySid LookupPrivilegeValueW DuplicateToken CreateRestrictedToken RegQueryValueExW RegCreateKeyExW SetThreadToken GetTokenInformation CreateProcessAsUserW AccessCheck EqualSid IsValidSid GetNamedSecurityInfoW MapGenericMask ImpersonateLoggedOnUser FreeSid SystemFunction036 ConvertSidToStringSidW DuplicateTokenEx GetKernelObjectSecurity SetKernelObjectSecurity GetAce OpenProcessToken SetTokenInformation GetLengthSid ConvertStringSidToSidW SetSecurityInfo GetSecurityDescriptorSacl ConvertStringSecurityDescriptorToSecurityDescriptorW RegOpenKeyExW RegDisablePredefinedCache RevertToSelf SetSecurityDescriptorDacl InitializeSecurityDescriptor RegQueryValueExA RegOpenKeyExA RegCloseKey RegOpenKeyA

shell32

CommandLineToArgvW SHGetKnownFolderPath SHGetFolderPathW

ole32

CoTaskMemFree

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

416KB

Virtual Size

416KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

46KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

276B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4.9MB

Virtual Size

4.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

500KB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

b2da6e56ae7c16b232d50db4444548871b1afa4c85a7077da48c5c1da5230f3d

kernel32

user32

advapi32

shell32

ole32

generic