6e19ae14f0381f59332036012660b73ae277ac0e6684fc47f1ac92d5f6d91507

General

Target
6e19ae14f0381f59332036012660b73ae277ac0e6684fc47f1ac92d5f6d91507
Size 1002KB
Sample250521-vyak6seq3t
SHA256 6e19ae14f0381f59332036012660b73ae277ac0e6684fc47f1ac92d5f6d91507
MD5 637a86d22062c2b5c730c68427e93e23
SHA1 64d41a477f82fb3e74aca668d1bcd21e5091c498
SHA512 ce11d65a6325d051b2b7a1bf416f241f7aec435e51c73631b0bc43b0ad802915e411d8bf568bca596617e62c9cb7f38b2046e9b1ee296e7ebb70863e4b9fb4d6
SSDEEP 24576:mDmr77qzQk4J0FdC52eGlgTsr8DST4sDECfopKn/2wmScgytJ:mDmr77kQk4Nwe4gmbAfInHmSchtJ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6e19ae14f0381f59332036012660b73ae277ac0e6684fc47f1ac92d5f6d91507

File Explorer

6e19ae14f0381f59332036012660b73ae277ac0e6684fc47f1ac92d5f6d91507

.exe 1002KB

6e19ae14f0381f59332036012660b73ae277ac0e6684fc47f1ac92d5f6d91507

IMPHASH 022e9722ff662b0db9da40a4156e7826
SHA256 6e19ae14f0381f59332036012660b73ae277ac0e6684fc47f1ac92d5f6d91507
MD5 637a86d22062c2b5c730c68427e93e23
SHA1 64d41a477f82fb3e74aca668d1bcd21e5091c498
SHA512 ce11d65a6325d051b2b7a1bf416f241f7aec435e51c73631b0bc43b0ad802915e411d8bf568bca596617e62c9cb7f38b2046e9b1ee296e7ebb70863e4b9fb4d6
SSDEEP 24576:mDmr77qzQk4J0FdC52eGlgTsr8DST4sDECfopKn/2wmScgytJ:mDmr77kQk4Nwe4gmbAfInHmSchtJ
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

446899

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Ouroboros v7\Ouroborosv7\Release\Ouroborosv7.pdb

kernel32

FindClose CloseHandle WinExec lstrcmpW CreateProcessA GetDriveTypeA FindFirstFileW FindNextFileW FreeConsole GetLogicalDrives Process32First Process32Next GetLastError SetLastError QueryPerformanceCounter QueryPerformanceFrequency GetCurrentThread GetThreadTimes SetEndOfFile WaitForSingleObject TerminateProcess CreateToolhelp32Snapshot OpenProcess WriteConsoleW GetProcessHeap SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP IsValidCodePage FindNextFileA FindFirstFileExA HeapSize HeapReAlloc SetStdHandle SetFilePointerEx ReadConsoleW ReadFile GetConsoleMode GetConsoleCP FlushFileBuffers WideCharToMultiByte MultiByteToWideChar GetStringTypeW FormatMessageW DuplicateHandle WaitForSingleObjectEx Sleep GetCurrentProcess SwitchToThread GetCurrentThreadId GetExitCodeThread CreateFileW DeleteFileW FindFirstFileExW GetDiskFreeSpaceExW GetFileAttributesExW GetFileInformationByHandle RemoveDirectoryW AreFileApisANSI GetModuleHandleW GetProcAddress MoveFileExW EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection EncodePointer DecodePointer InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount CompareStringW LCMapStringW GetLocaleInfoW GetCPInfo SetEvent ResetEvent InitializeSListHead IsProcessorFeaturePresent IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcessId CreateTimerQueue SignalObjectAndWait CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait FreeLibrary FreeLibraryAndExitThread GetModuleFileNameW GetModuleHandleA LoadLibraryExW GetVersionExW VirtualAlloc VirtualProtect VirtualFree ReleaseSemaphore InterlockedPopEntrySList InterlockedPushEntrySList InterlockedFlushSList QueryDepthSList UnregisterWaitEx LoadLibraryW RaiseException RtlUnwind ExitProcess GetModuleHandleExW ExitThread GetModuleFileNameA GetStdHandle WriteFile GetCommandLineA GetCommandLineW GetACP HeapAlloc HeapFree IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetExitCodeProcess GetFileType

advapi32

CryptReleaseContext CryptAcquireContextA CryptGenRandom

ws2_32

WSACleanup WSAStartup htons ioctlsocket closesocket freeaddrinfo getaddrinfo inet_ntoa inet_addr WSAGetLastError select recv ntohl htonl getpeername connect socket setsockopt send

Sharing

General

Malware Config

Signatures

File Explorer

6e19ae14f0381f59332036012660b73ae277ac0e6684fc47f1ac92d5f6d91507

kernel32

advapi32

ws2_32

generic