dcf536edd67a98868759f4e72bcbd1f4404c70048a2a3257e77d8af06cb036ac[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
dcf536edd67a98868759f4e72bcbd1f4404c70048a2a3257e77d8af06cb036ac.exe
Size 5.2MB
Sample250112-wdevtsskgy
SHA256 dcf536edd67a98868759f4e72bcbd1f4404c70048a2a3257e77d8af06cb036ac
MD5 2456fdd65bc48203815f22e444d78fb0
SHA1 1732202d4d9f130fafc3b9a4cad9995e0eda03d7
SHA512 a3195fc839dcf75b940bdb17b0411f6f6d8070c6a2c0e40bf0e3579475b3f57648c7dc3e307e9bab0cae20c571cf84eaba50c66630a70ed645eef464f6e2bf52
SSDEEP 49152:Br/rw+39KLrK3UwcLzRj5i0B6FN0uckTMEuYqxqyZH5biWJZ2pX5uUV6PS4Raps5:PKLr7+0t9NP1t69OYn2m
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dcf536edd67a98868759f4e72bcbd1f4404c70048a2a3257e77d8af06cb036ac.exe

File Explorer

dcf536edd67a98868759f4e72bcbd1f4404c70048a2a3257e77d8af06cb036ac.exe

.exe 5.2MB

dcf536edd67a98868759f4e72bcbd1f4404c70048a2a3257e77d8af06cb036ac.exe

IMPHASH ce5f91eb3b1ebc7df7d7ab97a153e7b7
SHA256 dcf536edd67a98868759f4e72bcbd1f4404c70048a2a3257e77d8af06cb036ac
MD5 2456fdd65bc48203815f22e444d78fb0
SHA1 1732202d4d9f130fafc3b9a4cad9995e0eda03d7
SHA512 a3195fc839dcf75b940bdb17b0411f6f6d8070c6a2c0e40bf0e3579475b3f57648c7dc3e307e9bab0cae20c571cf84eaba50c66630a70ed645eef464f6e2bf52
SSDEEP 49152:Br/rw+39KLrK3UwcLzRj5i0B6FN0uckTMEuYqxqyZH5biWJZ2pX5uUV6PS4Raps5:PKLr7+0t9NP1t69OYn2m
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3556236

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

funksec.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

bcryptprimitives

ProcessPrng

kernel32

Sleep GetModuleHandleA GetCurrentThreadId GetSystemTimeAsFileTime GetOverlappedResult FreeEnvironmentStringsW DeleteProcThreadAttributeList CompareStringOrdinal GetLastError AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread SwitchToThread WaitForSingleObject ReadFile GetSystemInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetLastError GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW GetCommandLineW SetFileInformationByHandle SetFilePointerEx GetStdHandle GetCurrentProcessId WriteFileEx SleepEx GetExitCodeProcess QueryPerformanceFrequency PostQueuedCompletionStatus HeapFree HeapReAlloc lstrlenW ReleaseMutex GetQueuedCompletionStatusEx FindNextFileW FindClose CreateFileW GetFileInformationByHandle GetFileInformationByHandleEx FindFirstFileW DeleteFileW GetFinalPathNameByHandleW CreateEventW CancelIo CreateIoCompletionPort GetConsoleMode SetHandleInformation FormatMessageW GetModuleFileNameW ExitProcess CreateNamedPipeW ReadFileEx WaitForMultipleObjects GetFullPathNameW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW InitializeProcThreadAttributeList UpdateProcThreadAttribute MultiByteToWideChar WriteConsoleW WideCharToMultiByte CreateThread GetProcessHeap HeapAlloc WaitForSingleObjectEx LoadLibraryA CreateMutexA DuplicateHandle GetCurrentProcess SetFileCompletionNotificationModes InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter CloseHandle GetProcAddress GetModuleHandleW QueryPerformanceCounter IsProcessorFeaturePresent

user32

SystemParametersInfoW

advapi32

RegQueryValueExW RegOpenKeyExW SystemFunction036 RegCloseKey

ws2_32

send recv shutdown ioctlsocket connect bind WSASocketW getsockname getpeername getsockopt setsockopt WSAIoctl WSAGetLastError WSAStartup WSACleanup freeaddrinfo getaddrinfo closesocket WSASend

secur32

ApplyControlToken FreeCredentialsHandle AcceptSecurityContext InitializeSecurityContextW QueryContextAttributesW FreeContextBuffer DeleteSecurityContext AcquireCredentialsHandleA DecryptMessage EncryptMessage

crypt32

CertDuplicateStore CertEnumCertificatesInStore CertVerifyCertificateChainPolicy CertGetCertificateChain CertAddCertificateContextToStore CertFreeCertificateContext CertDuplicateCertificateContext CertFreeCertificateChain CertOpenStore CertDuplicateCertificateChain CertCloseStore

ntdll

NtCreateFile NtDeviceIoControlFile RtlNtStatusToDosError NtReadFile NtWriteFile NtCancelIoFileEx

bcrypt

BCryptGenRandom

vcruntime140

__current_exception_context __C_specific_handler __current_exception _CxxThrowException memcmp memmove memset memcpy __CxxFrameHandler3

api-ms-win-crt-math-l1-1-0

round pow __setusermatherr truncf roundf powf exp2f ceil

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _initialize_narrow_environment _seh_filter_exe _get_initial_narrow_environment _initterm _initterm_e _crt_atexit _set_app_type exit _exit __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback terminate _initialize_onexit_table _register_onexit_function

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode