8970c45b6098e59c1fd5567f9f77c8c4ec5eaaae4de3e81df89a8a2eeeb88d2a

General

Target
8970c45b6098e59c1fd5567f9f77c8c4ec5eaaae4de3e81df89a8a2eeeb88d2a
Size 1.4MB
Sample260212-rqapeset2f
SHA256 8970c45b6098e59c1fd5567f9f77c8c4ec5eaaae4de3e81df89a8a2eeeb88d2a
MD5 17ed5c6315c6cd6621060aad63b51544
SHA1 8cd7b953511dc8f1aa29d8a16ca80206b822adca
SHA512 b9abefe9bbae4107e653140d173fc5e554c33ba62bf24115a07a4163a4cb1a45b1251b909ba7b3134e54937bb371089361e94c207f99b6eefdc048ee6d91b0e4
SSDEEP 24576:3oSjFj9IZOLS862Bg9PpFf/lJxjlycEg0q91Qt:3oQzvLBeDXxpjv0q91i
TLSH
T1D065E0337804D431F9E211F99EACEFE4453CA930176A55C367C809A45A607E7BB31AFA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8970c45b6098e59c1fd5567f9f77c8c4ec5eaaae4de3e81df89a8a2eeeb88d2a

File Explorer

8970c45b6098e59c1fd5567f9f77c8c4ec5eaaae4de3e81df89a8a2eeeb88d2a

.exe 1.4MB

8970c45b6098e59c1fd5567f9f77c8c4ec5eaaae4de3e81df89a8a2eeeb88d2a

IMPHASH 7597640c29b0dad658948c09334fdbc5
SHA256 8970c45b6098e59c1fd5567f9f77c8c4ec5eaaae4de3e81df89a8a2eeeb88d2a
MD5 17ed5c6315c6cd6621060aad63b51544
SHA1 8cd7b953511dc8f1aa29d8a16ca80206b822adca
SHA512 b9abefe9bbae4107e653140d173fc5e554c33ba62bf24115a07a4163a4cb1a45b1251b909ba7b3134e54937bb371089361e94c207f99b6eefdc048ee6d91b0e4
SSDEEP 24576:3oSjFj9IZOLS862Bg9PpFf/lJxjlycEg0q91Qt:3oQzvLBeDXxpjv0q91i
TLSH
T1D065E0337804D431F9E211F99EACEFE4453CA930176A55C367C809A45A607E7BB31AFA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

273241

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetLastError CreatePipe CreateProcessA GetModuleFileNameW GetProcAddress LoadLibraryA VirtualAlloc VirtualProtect VirtualQuery GetModuleHandleA GetStdHandle GetEnvironmentVariableA CreateDirectoryA CreateFileA GetFileAttributesA ReadFile SetFilePointer WriteFile IsDebuggerPresent OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency Sleep TerminateProcess GetCurrentThreadId GetProcessId GetSystemInfo GetNativeSystemInfo VirtualFree WideCharToMultiByte K32EnumProcessModules K32GetModuleInformation GetCurrentProcessId CreateThread SetHandleInformation DebugBreak SetUnhandledExceptionFilter GetProcessHeap GetProcessHeaps HeapLock HeapUnlock HeapWalk GetModuleHandleExW InitOnceExecuteOnce SetLastError GlobalAlloc GlobalFree GlobalSize GlobalReAlloc GlobalLock GlobalUnlock GlobalHandle LocalAlloc LocalFree LocalSize LocalReAlloc LocalLock LocalUnlock GetEnvironmentVariableW CreateFileW FlushFileBuffers GetTempFileNameW GetTempPathW K32GetModuleBaseNameW K32GetModuleFileNameExW DecodePointer CloseHandle RtlCaptureStackBackTrace GetCurrentThread GetCurrentProcess GetConsoleMode GetConsoleOutputCP SetFilePointerEx UnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead GetStartupInfoW GetModuleHandleW GetSystemTimeAsFileTime RaiseException OpenProcess FreeLibrary LoadLibraryExW MultiByteToWideChar PssCaptureSnapshot PssFreeSnapshot PssQuerySnapshot RtlUnwind InterlockedPushEntrySList EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW CompareStringW LCMapStringW SetStdHandle GetStringTypeW GetFileSizeEx WriteConsoleW

advapi32

EventSetInformation EventUnregister EventRegister EventWriteTransfer

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

?RegisterUndefinedBehaviorReport@__ubsan@@YAXPAUUndefinedBehaviorReport@1@@Z ?__sancov_lowest_stack@@3KA _CrtCheckMemory _CrtDoForAllClientObjects _CrtDumpMemoryLeaks _CrtGetAllocHook _CrtGetDumpClient _CrtIsMemoryBlock _CrtIsValidHeapPointer _CrtIsValidPointer _CrtMemCheckpoint _CrtMemDifference _CrtMemDumpAllObjectsSince _CrtMemDumpStatistics _CrtReportBlockType _CrtSetAllocHook _CrtSetBreakAlloc _CrtSetDbgBlockType _CrtSetDbgFlag _CrtSetDumpClient ___asan_wrap_CreateThread@24 ___asan_wrap_GlobalAlloc@8 ___asan_wrap_GlobalFree@4 ___asan_wrap_GlobalHandle@4 ___asan_wrap_GlobalLock@4 ___asan_wrap_GlobalReAlloc@12 ___asan_wrap_GlobalSize@4 ___asan_wrap_GlobalUnlock@4 ___asan_wrap_LocalAlloc@8 ___asan_wrap_LocalFree@4 ___asan_wrap_LocalHandle@4 ___asan_wrap_LocalLock@4 ___asan_wrap_LocalReAlloc@12 ___asan_wrap_LocalSize@4 ___asan_wrap_LocalUnlock@4 ___asan_wrap_RaiseException@16 ___asan_wrap_RtlAllocateHeap@12 ___asan_wrap_RtlDestroyHeap@4 ___asan_wrap_RtlFreeHeap@12 ___asan_wrap_RtlRaiseException@4 ___asan_wrap_RtlReAllocateHeap@16 ___asan_wrap_RtlSizeHeap@12 ___asan_wrap_RtlValidateHeap@12 ___asan_wrap_SetUnhandledExceptionFilter@4 __asan_addr_is_in_fake_stack __asan_address_is_poisoned __asan_after_dynamic_init __asan_alloca_poison __asan_allocas_unpoison __asan_before_dynamic_init __asan_default_options__dll __asan_default_suppressions__dll __asan_delete __asan_delete_align __asan_delete_array __asan_delete_array_align __asan_delete_array_size __asan_delete_array_size_align __asan_delete_size __asan_delete_size_align __asan_describe_address __asan_exp_load1 __asan_exp_load16 __asan_exp_load2 __asan_exp_load4 __asan_exp_load8 __asan_exp_loadN __asan_exp_store1 __asan_exp_store16 __asan_exp_store2 __asan_exp_store4 __asan_exp_store8 __asan_exp_storeN __asan_get_alloc_stack __asan_get_current_fake_stack __asan_get_free_stack __asan_get_report_access_size __asan_get_report_access_type __asan_get_report_address __asan_get_report_bp __asan_get_report_description __asan_get_report_pc __asan_get_report_sp __asan_get_shadow_mapping __asan_get_shadow_memory_dynamic_address __asan_handle_no_return __asan_handle_vfork __asan_init __asan_load1 __asan_load16 __asan_load16_noabort __asan_load1_noabort __asan_load2 __asan_load2_noabort __asan_load4 __asan_load4_noabort __asan_load8 __asan_load8_noabort __asan_loadN __asan_loadN_noabort __asan_load_cxx_array_cookie __asan_locate_address __asan_memcpy __asan_memmove __asan_memset __asan_new __asan_new_align __asan_new_align_nothrow __asan_new_array __asan_new_array_align __asan_new_array_align_nothrow __asan_new_array_nothrow __asan_new_nothrow __asan_on_error__dll __asan_option_detect_stack_use_after_return __asan_poison_cxx_array_cookie __asan_poison_intra_object_redzone __asan_poison_memory_region __asan_poison_stack_memory __asan_print_accumulated_stats __asan_region_is_poisoned __asan_register_elf_globals __asan_register_globals __asan_register_image_globals __asan_report_error __asan_report_exp_load1 __asan_report_exp_load16 __asan_report_exp_load2 __asan_report_exp_load4 __asan_report_exp_load8 __asan_report_exp_load_n __asan_report_exp_store1 __asan_report_exp_store16 __asan_report_exp_store2 __asan_report_exp_store4 __asan_report_exp_store8 __asan_report_exp_store_n __asan_report_load1 __asan_report_load16 __asan_report_load16_noabort __asan_report_load1_noabort __asan_report_load2 __asan_report_load2_noabort __asan_report_load4 __asan_report_load4_noabort __asan_report_load8 __asan_report_load8_noabort __asan_report_load_n __asan_report_load_n_noabort __asan_report_present __asan_report_store1 __asan_report_store16 __asan_report_store16_noabort __asan_report_store1_noabort __asan_report_store2 __asan_report_store2_noabort __asan_report_store4 __asan_report_store4_noabort __asan_report_store8 __asan_report_store8_noabort __asan_report_store_n __asan_report_store_n_noabort __asan_set_death_callback __asan_set_error_report_callback __asan_set_seh_filter __asan_set_shadow_00 __asan_set_shadow_f1 __asan_set_shadow_f2 __asan_set_shadow_f3 __asan_set_shadow_f5 __asan_set_shadow_f8 __asan_shadow_memory_dynamic_address __asan_should_detect_stack_use_after_return __asan_stack_free_0 __asan_stack_free_1 __asan_stack_free_10 __asan_stack_free_2 __asan_stack_free_3 __asan_stack_free_4 __asan_stack_free_5 __asan_stack_free_6 __asan_stack_free_7 __asan_stack_free_8 __asan_stack_free_9 __asan_stack_malloc_0 __asan_stack_malloc_1 __asan_stack_malloc_10 __asan_stack_malloc_2 __asan_stack_malloc_3 __asan_stack_malloc_4 __asan_stack_malloc_5 __asan_stack_malloc_6 __asan_stack_malloc_7 __asan_stack_malloc_8 __asan_stack_malloc_9 __asan_stack_malloc_always_0 __asan_stack_malloc_always_1 __asan_stack_malloc_always_10 __asan_stack_malloc_always_2 __asan_stack_malloc_always_3 __asan_stack_malloc_always_4 __asan_stack_malloc_always_5 __asan_stack_malloc_always_6 __asan_stack_malloc_always_7 __asan_stack_malloc_always_8 __asan_stack_malloc_always_9 __asan_store1 __asan_store16 __asan_store16_noabort __asan_store1_noabort __asan_store2 __asan_store2_noabort __asan_store4 __asan_store4_noabort __asan_store8 __asan_store8_noabort __asan_storeN __asan_storeN_noabort __asan_test_only_reported_buggy_pointer __asan_unhandled_exception_filter __asan_unpoison_intra_object_redzone __asan_unpoison_memory_region __asan_unpoison_stack_memory __asan_unregister_elf_globals __asan_unregister_globals __asan_unregister_image_globals __asan_update_allocation_context __asan_version_mismatch_check_v8 __asan_wrap__except_handler3 __asan_wrap__except_handler4 __asan_wrap__strdup __asan_wrap_atoi __asan_wrap_atol __asan_wrap_frexp __asan_wrap_longjmp __asan_wrap_memchr __asan_wrap_memcmp __asan_wrap_memcpy __asan_wrap_memmove __asan_wrap_memset __asan_wrap_strcat __asan_wrap_strchr __asan_wrap_strcmp __asan_wrap_strcpy __asan_wrap_strcspn __asan_wrap_strlen __asan_wrap_strncat __asan_wrap_strncmp __asan_wrap_strncpy __asan_wrap_strnlen __asan_wrap_strpbrk __asan_wrap_strspn __asan_wrap_strstr __asan_wrap_strtok __asan_wrap_strtol __asan_wrap_wcslen __asan_wrap_wcsnlen __lsan_default_options__dll __lsan_default_suppressions __lsan_disable __lsan_do_leak_check __lsan_do_recoverable_leak_check __lsan_enable __lsan_ignore_object __lsan_is_turned_off __lsan_register_root_region __lsan_unregister_root_region __p__crtBreakAlloc __p__crtDbgFlag __sancov_default_options__dll __sanitizer_acquire_crash_state __sanitizer_annotate_contiguous_container __sanitizer_contiguous_container_find_bad_address __sanitizer_cov_8bit_counters_init__dll __sanitizer_cov_bool_flag_init__dll __sanitizer_cov_dump __sanitizer_cov_pcs_init__dll __sanitizer_cov_reset __sanitizer_cov_trace_cmp1__dll __sanitizer_cov_trace_cmp2__dll __sanitizer_cov_trace_cmp4__dll __sanitizer_cov_trace_cmp8__dll __sanitizer_cov_trace_cmp__dll __sanitizer_cov_trace_const_cmp1__dll __sanitizer_cov_trace_const_cmp2__dll __sanitizer_cov_trace_const_cmp4__dll __sanitizer_cov_trace_const_cmp8__dll __sanitizer_cov_trace_div4__dll __sanitizer_cov_trace_div8__dll __sanitizer_cov_trace_gep__dll __sanitizer_cov_trace_pc_guard__dll __sanitizer_cov_trace_pc_guard_init__dll __sanitizer_cov_trace_pc_indir__dll __sanitizer_cov_trace_switch__dll __sanitizer_dump_coverage __sanitizer_dump_trace_pc_guard_coverage __sanitizer_finish_switch_fiber __sanitizer_free_hook__dll __sanitizer_get_allocated_size __sanitizer_get_current_allocated_bytes __sanitizer_get_estimated_allocated_size __sanitizer_get_free_bytes __sanitizer_get_heap_size __sanitizer_get_module_and_offset_for_pc __sanitizer_get_ownership __sanitizer_get_report_path __sanitizer_get_unmapped_bytes __sanitizer_install_malloc_and_free_hooks __sanitizer_malloc_hook__dll __sanitizer_on_print__dll __sanitizer_print_memory_profile __sanitizer_print_stack_trace __sanitizer_ptr_cmp __sanitizer_ptr_sub __sanitizer_purge_allocator __sanitizer_report_error_summary__dll __sanitizer_sandbox_on_notify__dll __sanitizer_set_death_callback __sanitizer_set_report_fd __sanitizer_set_report_path __sanitizer_start_switch_fiber __sanitizer_symbolize_global __sanitizer_symbolize_pc __sanitizer_unaligned_load16 __sanitizer_unaligned_load32 __sanitizer_unaligned_load64 __sanitizer_unaligned_store16 __sanitizer_unaligned_store32 __sanitizer_unaligned_store64 __sanitizer_verify_contiguous_container __sanitizer_virtual_alloc __sanitizer_virtual_protect __sanitizer_virtual_query __sanitizer_weak_hook_memcmp__dll __sanitizer_weak_hook_strcmp__dll __sanitizer_weak_hook_strncmp__dll __sanitizer_weak_hook_strstr__dll __ubsan_default_options__dll __ubsan_get_current_report_data __ubsan_handle_add_overflow __ubsan_handle_add_overflow_abort __ubsan_handle_alignment_assumption __ubsan_handle_alignment_assumption_abort __ubsan_handle_builtin_unreachable __ubsan_handle_cfi_bad_type __ubsan_handle_cfi_check_fail __ubsan_handle_cfi_check_fail_abort __ubsan_handle_divrem_overflow __ubsan_handle_divrem_overflow_abort __ubsan_handle_dynamic_type_cache_miss __ubsan_handle_dynamic_type_cache_miss_abort __ubsan_handle_float_cast_overflow __ubsan_handle_float_cast_overflow_abort __ubsan_handle_function_type_mismatch_v1 __ubsan_handle_function_type_mismatch_v1_abort __ubsan_handle_implicit_conversion __ubsan_handle_implicit_conversion_abort __ubsan_handle_invalid_builtin __ubsan_handle_invalid_builtin_abort __ubsan_handle_invalid_objc_cast __ubsan_handle_invalid_objc_cast_abort __ubsan_handle_load_invalid_value __ubsan_handle_load_invalid_value_abort __ubsan_handle_missing_return __ubsan_handle_mul_overflow __ubsan_handle_mul_overflow_abort __ubsan_handle_negate_overflow __ubsan_handle_negate_overflow_abort __ubsan_handle_nonnull_arg __ubsan_handle_nonnull_arg_abort __ubsan_handle_nonnull_return_v1 __ubsan_handle_nonnull_return_v1_abort __ubsan_handle_nullability_arg __ubsan_handle_nullability_arg_abort __ubsan_handle_nullability_return_v1 __ubsan_handle_nullability_return_v1_abort __ubsan_handle_out_of_bounds __ubsan_handle_out_of_bounds_abort __ubsan_handle_pointer_overflow __ubsan_handle_pointer_overflow_abort __ubsan_handle_shift_out_of_bounds __ubsan_handle_shift_out_of_bounds_abort __ubsan_handle_sub_overflow __ubsan_handle_sub_overflow_abort __ubsan_handle_type_mismatch_v1 __ubsan_handle_type_mismatch_v1_abort __ubsan_handle_vla_bound_not_positive __ubsan_handle_vla_bound_not_positive_abort __ubsan_on_report __ubsan_vptr_type_cache _aligned_free _aligned_free_dbg _aligned_malloc _aligned_malloc_dbg _aligned_msize _aligned_msize_dbg _aligned_offset_malloc _aligned_offset_malloc_dbg _aligned_offset_realloc _aligned_offset_realloc_dbg _aligned_offset_recalloc _aligned_offset_recalloc_dbg _aligned_realloc _aligned_realloc_dbg _aligned_recalloc _aligned_recalloc_dbg _calloc_base _calloc_dbg _calloc_impl _expand _expand_dbg _free_base _free_dbg _malloc_base _malloc_dbg _msize _msize_base _msize_dbg _realloc_base _realloc_dbg _recalloc _recalloc_base _recalloc_dbg calloc free malloc realloc

Sharing

General

Malware Config

Signatures

File Explorer

8970c45b6098e59c1fd5567f9f77c8c4ec5eaaae4de3e81df89a8a2eeeb88d2a

kernel32

advapi32

api-ms-win-core-synch-l1-2-0

generic