a665dc3d0e8890b660d9084aab04eac00fd970eba9afbbffe925e2482246f325

Sharing

Copy URL Twitter E-mail

General

Target
a665dc3d0e8890b660d9084aab04eac00fd970eba9afbbffe925e2482246f325
Size 4.8MB
Sample250415-vdhfaatzhs
SHA256 a665dc3d0e8890b660d9084aab04eac00fd970eba9afbbffe925e2482246f325
MD5 a40f6e0f17d53efd522b1da4455ed460
SHA1 e5207a04dffe4df3e65d89e39a7d71d9575b77f8
SHA512 6c76de1b4473b9bb878084e5bda701d78a30855b2735de212ed788a01740e1e0e7600b3dca1fcda222db0f8b38f1a66b4f0034d4f29a03f57edfff6814674398
SSDEEP 3072:tJp1EO+4LmV5stwdJkocF/g0z7UxYfOT8+KWqG8u01b3n3KZvzCsiGnfbMJfbMmQ:tVEOJLAAwdBc5fOo+FqG891b3e+NRi
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a665dc3d0e8890b660d9084aab04eac00fd970eba9afbbffe925e2482246f325

File Explorer

a665dc3d0e8890b660d9084aab04eac00fd970eba9afbbffe925e2482246f325

.exe 4.8MB

a665dc3d0e8890b660d9084aab04eac00fd970eba9afbbffe925e2482246f325

IMPHASH bdc22efce5198e5aef6f4ba2cb7253bc
SHA256 a665dc3d0e8890b660d9084aab04eac00fd970eba9afbbffe925e2482246f325
MD5 a40f6e0f17d53efd522b1da4455ed460
SHA1 e5207a04dffe4df3e65d89e39a7d71d9575b77f8
SHA512 6c76de1b4473b9bb878084e5bda701d78a30855b2735de212ed788a01740e1e0e7600b3dca1fcda222db0f8b38f1a66b4f0034d4f29a03f57edfff6814674398
SSDEEP 3072:tJp1EO+4LmV5stwdJkocF/g0z7UxYfOT8+KWqG8u01b3n3KZvzCsiGnfbMJfbMmQ:tVEOJLAAwdBc5fOo+FqG891b3e+NRi
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

122708

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Slawd.pdb

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

kernel32

SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead LoadLibraryW GetProcAddress FreeLibrary CloseHandle GetLastError AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread CreateWaitableTimerExW SetWaitableTimer WaitForSingleObject Sleep QueryPerformanceCounter RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetLastError GetCurrentDirectoryW GetEnvironmentVariableW GetCurrentProcess GetStdHandle GetCurrentProcessId SetHandleInformation GetProcessHeap HeapFree HeapReAlloc lstrlenW ReleaseMutex GetModuleHandleW FormatMessageW GetModuleHandleA HeapAlloc GetConsoleMode IsProcessorFeaturePresent GetConsoleOutputCP MultiByteToWideChar WriteConsoleW WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA CreateMutexA GetSystemTimeAsFileTime GetCurrentThreadId

ntdll

NtWriteFile RtlNtStatusToDosError

ws2_32

WSASocketW getaddrinfo bind sendto recvfrom closesocket setsockopt WSAGetLastError freeaddrinfo WSACleanup WSAStartup

vcruntime140

__current_exception __current_exception_context __C_specific_handler _CxxThrowException memcmp memmove __CxxFrameHandler3 memset memcpy

api-ms-win-crt-runtime-l1-1-0

_initterm_e exit _exit _initterm _get_initial_narrow_environment __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _configure_narrow_argv __p___argc _initialize_onexit_table _initialize_narrow_environment _register_onexit_function _crt_atexit terminate _set_app_type _seh_filter_exe

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

a665dc3d0e8890b660d9084aab04eac00fd970eba9afbbffe925e2482246f325

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

ntdll

ws2_32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic