7cd9abacd1a83500ec1b0685c332bd486eb72bce62e175f81b650a6f69db20cb

Sharing

Copy URL Twitter E-mail

General

Target
7cd9abacd1a83500ec1b0685c332bd486eb72bce62e175f81b650a6f69db20cb
Size 1.5MB
Sample260527-lfyevact3w
SHA256 7cd9abacd1a83500ec1b0685c332bd486eb72bce62e175f81b650a6f69db20cb
MD5 d0fece5428b7e227f1fcc1ec0a4fb35c
SHA1 d7df93c65a5fb090a024e05dfe0b43f1b0245281
SHA512 e0dfcff435a36d1bc93f42928e421a3c0923c8227803575d66b30d1dda6fd6459296b24b78d15779c7ee8a86888125dc441080487c1d78d646a62ab49aaa69c8
SSDEEP 12288:143k3bQU2YuVuGp+CTkLHUJBv7fwp7P205Ul4U9QnliXhb2F8MTbddo:1M6SYkuGp+CN/PenI2FDddo
TLSH
T13775C55BF7B610D1F1BAC139A553222AFC7134A1473C9BE792858A4E5B30BE8AD7D700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7cd9abacd1a83500ec1b0685c332bd486eb72bce62e175f81b650a6f69db20cb

File Explorer

7cd9abacd1a83500ec1b0685c332bd486eb72bce62e175f81b650a6f69db20cb

.exe 1.5MB

7cd9abacd1a83500ec1b0685c332bd486eb72bce62e175f81b650a6f69db20cb

IMPHASH 933065863935aacf7dd57b0fa3dc05f7
SHA256 7cd9abacd1a83500ec1b0685c332bd486eb72bce62e175f81b650a6f69db20cb
MD5 d0fece5428b7e227f1fcc1ec0a4fb35c
SHA1 d7df93c65a5fb090a024e05dfe0b43f1b0245281
SHA512 e0dfcff435a36d1bc93f42928e421a3c0923c8227803575d66b30d1dda6fd6459296b24b78d15779c7ee8a86888125dc441080487c1d78d646a62ab49aaa69c8
SSDEEP 12288:143k3bQU2YuVuGp+CTkLHUJBv7fwp7P205Ul4U9QnliXhb2F8MTbddo:1M6SYkuGp+CN/PenI2FDddo
TLSH
T13775C55BF7B610D1F1BAC139A553222AFC7134A1473C9BE792858A4E5B30BE8AD7D700
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

572358

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\Hack Tools\泷羽C2远控\Project1\x64\Debug\Agent.pdb

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpSetOption WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse WinHttpOpen

gdiplus

GdipAlloc GdipSaveImageToStream GdipCloneImage GdipDisposeImage GdiplusShutdown GdiplusStartup GdipCreateBitmapFromHBITMAP GdipFree

ole32

CreateStreamOnHGlobal CLSIDFromString

ws2_32

gethostbyname inet_ntoa WSAStartup WSACleanup gethostname

advapi32

OpenProcessToken GetUserNameW GetTokenInformation

user32

ReleaseDC GetDC GetSystemMetrics wsprintfA

gdi32

DeleteObject CreateCompatibleBitmap BitBlt CreateDCW GetDeviceCaps CreateCompatibleDC DeleteDC SelectObject

kernel32

GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW SetConsoleCtrlHandler WriteConsoleW OutputDebugStringW GetConsoleMode GetCPInfo FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetStringTypeW HeapReAlloc HeapQueryInformation GetFileSizeEx SetFilePointerEx ReadConsoleW CreateFileW GetConsoleOutputCP WakeAllConditionVariable CreateFileA FindClose FindFirstFileA FindNextFileA GetDriveTypeA GetFileSize ReadFile SetFilePointer WriteFile CloseHandle GetLastError CreatePipe WaitForSingleObject Sleep GetCurrentProcess GetCurrentProcessId ExitProcess CreateProcessA GetTickCount GetModuleHandleA GetProcAddress lstrcpyA GetLogicalDriveStringsA GetComputerNameW FileTimeToSystemTime MultiByteToWideChar WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection ReleaseSRWLockExclusive AcquireSRWLockExclusive RtlUnwind SleepConditionVariableSRW GetCurrentThreadId SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW IsDebuggerPresent RaiseException QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary VirtualProtect RtlPcToFileHeader RtlLookupFunctionEntry RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList GetModuleFileNameW LoadLibraryExW SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EncodePointer TerminateProcess GetModuleHandleExW GetStdHandle GetCommandLineA GetCommandLineW HeapSize HeapValidate GetSystemInfo IsProcessorFeaturePresent GetCurrentThread RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter GetTempPathW IsThreadAFiber

Name

.textbss

Size

Virtual Size

547KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

265KB

Virtual Size

265KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

60KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

1024B

Virtual Size

589B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

1024B

Virtual Size

563B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

7cd9abacd1a83500ec1b0685c332bd486eb72bce62e175f81b650a6f69db20cb

winhttp

gdiplus

ole32

ws2_32

advapi32

user32

gdi32

kernel32

generic