nfc9lGQSMLHStz[.]com

Sharing

Copy URL Twitter E-mail

General

Target
nfc9lGQSMLHStz.com
Size 20.2MB
Sample260424-cfyaeact9v
SHA256 0882df851864a0bb890c77d2d0485709274cd5862fe91e778c377cfeef98ef5a
MD5 bac3917aa0a491ee48ec49d65470c2d4
SHA1 c877aafaad97fa8878abb179747ce963415fdce8
SHA512 b962bb1812d10c370ae1c948795c306c675c4798cb8d49ac6252ebc314b9127416c4612439087f87484cc868338fefd4b42349b36a08cc04e477fc20fcd89408
SSDEEP 393216:DiSXFboNGh443U9Uj1Oy/gN3V2a1j/R9x59sBxNtJd6O/sYpVf3VM2:DnVbEW44YURZ/a30ILR9x4BXzXHVM
TLSH
T15027F14D67326EA324639875D413017288DC379DEB7579A14EFECA122B6C930B76C3CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
nfc9lGQSMLHStz.com

File Explorer

nfc9lGQSMLHStz.com

.exe 20.2MB

nfc9lGQSMLHStz.com

IMPHASH 15f78870a9a3c58c3e2804f4fdf47888
SHA256 0882df851864a0bb890c77d2d0485709274cd5862fe91e778c377cfeef98ef5a
MD5 bac3917aa0a491ee48ec49d65470c2d4
SHA1 c877aafaad97fa8878abb179747ce963415fdce8
SHA512 b962bb1812d10c370ae1c948795c306c675c4798cb8d49ac6252ebc314b9127416c4612439087f87484cc868338fefd4b42349b36a08cc04e477fc20fcd89408
SSDEEP 393216:DiSXFboNGh443U9Uj1Oy/gN3V2a1j/R9x59sBxNtJd6O/sYpVf3VM2:DnVbEW44YURZ/a30ILR9x4BXzXHVM
TLSH
T15027F14D67326EA324639875D413017288DC379DEB7579A14EFECA122B6C930B76C3CA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2367908

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

FindVolumeMountPointClose GetStartupInfoW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetModuleHandleW

msvcp140

?_Random_device@std@@YAIXZ ?_Xlength_error@std@@YAXPEBD@Z

shlwapi

PathRemoveArgsW PathRemoveBackslashA PathRenameExtensionA PathRenameExtensionW PathStripPathA PathStripPathW PathGetDriveNumberA PathCanonicalizeW PathBuildRootW PathBuildRootA PathAppendW PathAppendA PathAddExtensionA PathRemoveArgsA PathGetArgsW PathCombineA PathFindFileNameW PathFindExtensionW PathFindExtensionA PathFileExistsW PathStripToRootA PathFileExistsA PathCombineW

vcruntime140

__std_exception_copy __std_exception_destroy _CxxThrowException memset __current_exception_context __C_specific_handler memcpy memmove __current_exception

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _register_onexit_function _seh_filter_exe _invoke_watson _set_app_type terminate _initialize_onexit_table _register_thread_local_exe_atexit_callback _c_exit _cexit _configure_narrow_argv _exit exit _initterm_e _get_narrow_winmain_command_line _initialize_narrow_environment _initterm

api-ms-win-crt-heap-l1-1-0

free malloc _callnewh _set_new_mode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale