b56a5c90beee163008676a42ae1a001c3f22003be0dae093d67460f47317a1db

Sharing

Copy URL Twitter E-mail

General

Target
b56a5c90beee163008676a42ae1a001c3f22003be0dae093d67460f47317a1db
Size 1.2MB
Sample260703-ejyrfsf15n
SHA256 b56a5c90beee163008676a42ae1a001c3f22003be0dae093d67460f47317a1db
MD5 6adc58b623651e2b364d33b3df852e97
SHA1 e275c5b09bde9d259adea3bed91fcac0eac12d1d
SHA512 e16f23b29ee815192507fc3e80fc2d6ade86ba153f7476085f8a8e8103897accbc73d3b0eb3b9d88cadea1584b91b952d89f76e609c56c01ef13c4a4616303a9
SSDEEP 12288:MLIxGkfIcVHjm4yA50Rlj0yEJt02QHGWUJeNtaBtdBHToNA:MLIxbfIJA50jo3yGWUJgsBR
TLSH
T172454A03EB9484EAC89DC038C3579536BA76B88E4735B6EB17DC5A343E67B905B1D308
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b56a5c90beee163008676a42ae1a001c3f22003be0dae093d67460f47317a1db

File Explorer

b56a5c90beee163008676a42ae1a001c3f22003be0dae093d67460f47317a1db

.dll 1.2MB

b56a5c90beee163008676a42ae1a001c3f22003be0dae093d67460f47317a1db

IMPHASH 3c4913e2b3acd30f8ca9f1a7ab8437a1
SHA256 b56a5c90beee163008676a42ae1a001c3f22003be0dae093d67460f47317a1db
MD5 6adc58b623651e2b364d33b3df852e97
SHA1 e275c5b09bde9d259adea3bed91fcac0eac12d1d
SHA512 e16f23b29ee815192507fc3e80fc2d6ade86ba153f7476085f8a8e8103897accbc73d3b0eb3b9d88cadea1584b91b952d89f76e609c56c01ef13c4a4616303a9
SSDEEP 12288:MLIxGkfIcVHjm4yA50Rlj0yEJt02QHGWUJeNtaBtdBHToNA:MLIxbfIJA50jo3yGWUJgsBR
TLSH
T172454A03EB9484EAC89DC038C3579536BA76B88E4735B6EB17DC5A343E67B905B1D308
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

815232

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

srvhost_dll.pdb

kernel32

GetProcessHeap SetFileInformationByHandle GetCurrentThreadId WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex GetStdHandle GetConsoleMode GetConsoleOutputCP GetSystemTimePreciseAsFileTime WriteConsoleW HeapAlloc DeleteFileW ReadFileEx SleepEx WriteFileEx GetLogicalDrives GetVersionExW CreateThread GetCurrentThread SetThreadStackGuarantee GetFullPathNameW SetFileTime GetFileInformationByHandle GetFileInformationByHandleEx TerminateProcess ExitProcess CreateEventW CancelIo GetOverlappedResult GetSystemDirectoryW GetWindowsDirectoryW GetFileAttributesW HeapReAlloc DuplicateHandle ReadFile WaitForMultipleObjects GetExitCodeProcess FindFirstFileExW PeekNamedPipe CreateWaitableTimerExW SwitchToThread HeapFree PostQueuedCompletionStatus IsProcessorFeaturePresent DisableThreadLibraryCalls DeleteProcThreadAttributeList GetSystemTimeAsFileTime SetLastError CreateProcessW GetFinalPathNameByHandleW UpdateProcThreadAttribute GetQueuedCompletionStatusEx CreateIoCompletionPort InitializeProcThreadAttributeList GlobalMemoryStatusEx GetSystemInfo GetComputerNameExW SetHandleInformation CreatePipe GetProcAddress GetModuleHandleA OpenProcess Sleep WaitForSingleObject SetWaitableTimer CreateWaitableTimerW GetCurrentProcessId VirtualProtect GetCurrentProcess UnmapViewOfFile MapViewOfFile CreateFileMappingW CreateFileW GetModuleHandleW GetLastError FindClose FindNextFileW GetModuleFileNameW SetFileCompletionNotificationModes CloseHandle GetEnvironmentStringsW QueryPerformanceCounter FreeEnvironmentStringsW QueryPerformanceFrequency GetEnvironmentVariableW RtlVirtualUnwind CompareStringOrdinal InitializeSListHead FormatMessageW SetUnhandledExceptionFilter WideCharToMultiByte lstrlenW RtlLookupFunctionEntry RtlCaptureContext GetCurrentDirectoryW MultiByteToWideChar CreateToolhelp32Snapshot UnhandledExceptionFilter Process32NextW ProcessIdToSessionId Process32FirstW IsDebuggerPresent

advapi32

GetTokenInformation SystemFunction036 OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges LookupAccountSidW GetUserNameW RegOpenKeyExW RegQueryValueExW RegCloseKey

ws2_32

shutdown WSASocketW closesocket setsockopt getsockopt bind WSAStartup WSACleanup getaddrinfo WSASend WSAIoctl freeaddrinfo recv send gethostname getsockname WSAGetLastError getpeername ioctlsocket connect

netapi32

NetUserEnum NetApiBufferFree NetShareEnum

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

ntdll

NtReadFile NtCancelIoFileEx NtWriteFile RtlNtStatusToDosError NtDeviceIoControlFile NtOpenFile NtCreateFile NtCreateNamedPipeFile

bcrypt

BCryptGenRandom

crypt32

CertOpenStore CertCloseStore CertDuplicateCertificateContext CertFreeCertificateChain CertVerifyCertificateChainPolicy CertEnumCertificatesInStore CertDuplicateCertificateChain CertAddCertificateContextToStore CertDuplicateStore CertGetCertificateChain CertFreeCertificateContext

secur32

EncryptMessage DeleteSecurityContext DecryptMessage FreeContextBuffer AcceptSecurityContext ApplyControlToken InitializeSecurityContextW QueryContextAttributesW AcquireCredentialsHandleA FreeCredentialsHandle

bcryptprimitives

ProcessPrng

iphlpapi

GetAdaptersAddresses

user32

GetSystemMetrics ReleaseDC GetDC

gdi32

CreateCompatibleBitmap CreateCompatibleDC SelectObject SetStretchBltMode StretchBlt GetDIBits DeleteObject DeleteDC

vcruntime140

__std_type_info_destroy_list memmove __C_specific_handler memset __CxxFrameHandler3 memcmp memcpy

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _initialize_narrow_environment _cexit _execute_onexit_table _initialize_onexit_table _initterm _initterm_e _seh_filter_dll

api-ms-win-crt-heap-l1-1-0

free

Sharing

General

Malware Config

Signatures

File Explorer

b56a5c90beee163008676a42ae1a001c3f22003be0dae093d67460f47317a1db

kernel32

advapi32

ws2_32

netapi32

api-ms-win-core-synch-l1-2-0

ntdll

bcrypt

crypt32

secur32

bcryptprimitives

iphlpapi

user32

gdi32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic