e63f9a5b7d0b12c2b58fd9e9c40cb01c8d7cb7f4d70026c6eed871aa060a8c72

Sharing

Copy URL Twitter E-mail

General

Target
e63f9a5b7d0b12c2b58fd9e9c40cb01c8d7cb7f4d70026c6eed871aa060a8c72
Size 2.1MB
Sample250217-k96smsxpax
SHA256 e63f9a5b7d0b12c2b58fd9e9c40cb01c8d7cb7f4d70026c6eed871aa060a8c72
MD5 bedf5eb89d3a15f5474759421aa49e93
SHA1 afb3eb9ae040f86dd8381cd54c7cac215beee85b
SHA512 fbed7338e55e2c6cec2c121c008533645f389c22d5fe7fdeecc3af872f4be59df66a13d0b379f2fb192073de7700cfaedb43cd56f290101df83dc3590e45e6fb
SSDEEP 24576:U1GDoLeM8596lTbS4VCc0r29X/C+iyxoZXBj9V+EBg6+q+a3WpZmGztj:4Gt96lTbS48c0mDq3g6+
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e63f9a5b7d0b12c2b58fd9e9c40cb01c8d7cb7f4d70026c6eed871aa060a8c72

File Explorer

e63f9a5b7d0b12c2b58fd9e9c40cb01c8d7cb7f4d70026c6eed871aa060a8c72

.exe 2.1MB

e63f9a5b7d0b12c2b58fd9e9c40cb01c8d7cb7f4d70026c6eed871aa060a8c72

IMPHASH 34758d9a7c0a5abe65177cbb34ce9f64
SHA256 e63f9a5b7d0b12c2b58fd9e9c40cb01c8d7cb7f4d70026c6eed871aa060a8c72
MD5 bedf5eb89d3a15f5474759421aa49e93
SHA1 afb3eb9ae040f86dd8381cd54c7cac215beee85b
SHA512 fbed7338e55e2c6cec2c121c008533645f389c22d5fe7fdeecc3af872f4be59df66a13d0b379f2fb192073de7700cfaedb43cd56f290101df83dc3590e45e6fb
SSDEEP 24576:U1GDoLeM8596lTbS4VCc0r29X/C+iyxoZXBj9V+EBg6+q+a3WpZmGztj:4Gt96lTbS48c0mDq3g6+
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1560432

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

encv2.pdb

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

kernel32

FlushFileBuffers GetProcessHeap HeapFree CloseHandle FindClose WaitForSingleObject PostQueuedCompletionStatus GetLastError QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimePreciseAsFileTime GetModuleHandleW GetProcAddress FindFirstFileExW CreateFileW GetFileInformationByHandleEx SetFileInformationByHandle GetSystemInfo HeapReAlloc GetStdHandle GetConsoleMode WideCharToMultiByte GetConsoleWindow AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetQueuedCompletionStatusEx CreateIoCompletionPort SetFileCompletionNotificationModes Sleep GetModuleHandleA SetLastError GetCurrentDirectoryW GetConsoleOutputCP MultiByteToWideChar WriteConsoleW GetEnvironmentVariableW GetFileInformationByHandle GetFullPathNameW CreateDirectoryW FormatMessageW ReadConsoleW HeapAlloc SetHandleInformation CreateThread SetFilePointerEx FindNextFileW RtlUnwindEx IsProcessorFeaturePresent GetStartupInfoW HeapSize LCMapStringW CompareStringW FlsFree FlsSetValue FlsGetValue SetUnhandledExceptionFilter FlsAlloc GetStringTypeW GetFileType SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage GetCommandLineW GetCommandLineA GetModuleHandleExW UnhandledExceptionFilter TerminateProcess ExitProcess GetCurrentProcess GetModuleFileNameW WriteFile RtlPcToFileHeader RaiseException EncodePointer LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection IsDebuggerPresent LeaveCriticalSection GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind EnterCriticalSection

user32

ShowWindow

crypt32

CertAddCertificateContextToStore CertFreeCertificateChain CertDuplicateCertificateChain CertDuplicateCertificateContext CertFreeCertificateContext CertEnumCertificatesInStore CertCloseStore CertGetCertificateChain CertVerifyCertificateChainPolicy CertOpenStore CertDuplicateStore

secur32

DecryptMessage FreeCredentialsHandle FreeContextBuffer InitializeSecurityContextW QueryContextAttributesW AcquireCredentialsHandleA AcceptSecurityContext DeleteSecurityContext EncryptMessage

ws2_32

connect ioctlsocket socket WSAGetLastError closesocket getsockopt getaddrinfo WSAStartup WSACleanup freeaddrinfo WSASocketW bind send WSAIoctl recv

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

ntdll

NtCreateFile NtWriteFile NtDeviceIoControlFile NtReadFile NtCancelIoFileEx RtlNtStatusToDosError

Sharing

General

Malware Config

Signatures

File Explorer

e63f9a5b7d0b12c2b58fd9e9c40cb01c8d7cb7f4d70026c6eed871aa060a8c72

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

user32

crypt32

secur32

ws2_32

bcrypt

advapi32

ntdll

generic