a221c4ff96b141679cc44e95aaabc6392f057c6e192325c3aa1175c3488b28da

Sharing

Copy URL Twitter E-mail

General

Target
a221c4ff96b141679cc44e95aaabc6392f057c6e192325c3aa1175c3488b28da
Size 1.2MB
Sample260703-jv9ejsdw2v
SHA256 a221c4ff96b141679cc44e95aaabc6392f057c6e192325c3aa1175c3488b28da
MD5 f49313d35bcb70682e9903c77f0a8090
SHA1 097d79a90579e2321f08c579f9da6d2610d838e8
SHA512 b3e63b1bae26dcb6fdd9dbc7292478c4f95bd99505c1af1432aa86ae649d71b5056f4cbf3940dc0aa8f42951daf5b168ff034a6895cc4b370fef719cf9d18c4b
SSDEEP 12288:nLIxGkfIcVHjm4yA50Rlj0yEJt02QHGWUJeNtaBtdBHToIA:nLIxbfIJA50jo3yGWUJgsBR
TLSH
T193454A03EB9484EAC89DC038C3579536BA76B88E4735B6EB17DC5A343E67B905B1D308
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a221c4ff96b141679cc44e95aaabc6392f057c6e192325c3aa1175c3488b28da

File Explorer

a221c4ff96b141679cc44e95aaabc6392f057c6e192325c3aa1175c3488b28da

.dll 1.2MB

a221c4ff96b141679cc44e95aaabc6392f057c6e192325c3aa1175c3488b28da

IMPHASH 3c4913e2b3acd30f8ca9f1a7ab8437a1
SHA256 a221c4ff96b141679cc44e95aaabc6392f057c6e192325c3aa1175c3488b28da
MD5 f49313d35bcb70682e9903c77f0a8090
SHA1 097d79a90579e2321f08c579f9da6d2610d838e8
SHA512 b3e63b1bae26dcb6fdd9dbc7292478c4f95bd99505c1af1432aa86ae649d71b5056f4cbf3940dc0aa8f42951daf5b168ff034a6895cc4b370fef719cf9d18c4b
SSDEEP 12288:nLIxGkfIcVHjm4yA50Rlj0yEJt02QHGWUJeNtaBtdBHToIA:nLIxbfIJA50jo3yGWUJgsBR
TLSH
T193454A03EB9484EAC89DC038C3579536BA76B88E4735B6EB17DC5A343E67B905B1D308
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

815232

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

srvhost_dll.pdb

kernel32

GetProcessHeap SetFileInformationByHandle GetCurrentThreadId WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex GetStdHandle GetConsoleMode GetConsoleOutputCP GetSystemTimePreciseAsFileTime WriteConsoleW HeapAlloc DeleteFileW ReadFileEx SleepEx WriteFileEx GetLogicalDrives GetVersionExW CreateThread GetCurrentThread SetThreadStackGuarantee GetFullPathNameW SetFileTime GetFileInformationByHandle GetFileInformationByHandleEx TerminateProcess ExitProcess CreateEventW CancelIo GetOverlappedResult GetSystemDirectoryW GetWindowsDirectoryW GetFileAttributesW HeapReAlloc DuplicateHandle ReadFile WaitForMultipleObjects GetExitCodeProcess FindFirstFileExW PeekNamedPipe CreateWaitableTimerExW SwitchToThread HeapFree PostQueuedCompletionStatus IsProcessorFeaturePresent DisableThreadLibraryCalls DeleteProcThreadAttributeList GetSystemTimeAsFileTime SetLastError CreateProcessW GetFinalPathNameByHandleW UpdateProcThreadAttribute GetQueuedCompletionStatusEx CreateIoCompletionPort InitializeProcThreadAttributeList GlobalMemoryStatusEx GetSystemInfo GetComputerNameExW SetHandleInformation CreatePipe GetProcAddress GetModuleHandleA OpenProcess Sleep WaitForSingleObject SetWaitableTimer CreateWaitableTimerW GetCurrentProcessId VirtualProtect GetCurrentProcess UnmapViewOfFile MapViewOfFile CreateFileMappingW CreateFileW GetModuleHandleW GetLastError FindClose FindNextFileW GetModuleFileNameW SetFileCompletionNotificationModes CloseHandle GetEnvironmentStringsW QueryPerformanceCounter FreeEnvironmentStringsW QueryPerformanceFrequency GetEnvironmentVariableW RtlVirtualUnwind CompareStringOrdinal InitializeSListHead FormatMessageW SetUnhandledExceptionFilter WideCharToMultiByte lstrlenW RtlLookupFunctionEntry RtlCaptureContext GetCurrentDirectoryW MultiByteToWideChar CreateToolhelp32Snapshot UnhandledExceptionFilter Process32NextW ProcessIdToSessionId Process32FirstW IsDebuggerPresent

advapi32

GetTokenInformation SystemFunction036 OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges LookupAccountSidW GetUserNameW RegOpenKeyExW RegQueryValueExW RegCloseKey

ws2_32

shutdown WSASocketW closesocket setsockopt getsockopt bind WSAStartup WSACleanup getaddrinfo WSASend WSAIoctl freeaddrinfo recv send gethostname getsockname WSAGetLastError getpeername ioctlsocket connect

netapi32

NetUserEnum NetApiBufferFree NetShareEnum

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

ntdll

NtReadFile NtCancelIoFileEx NtWriteFile RtlNtStatusToDosError NtDeviceIoControlFile NtOpenFile NtCreateFile NtCreateNamedPipeFile

bcrypt

BCryptGenRandom

crypt32

CertOpenStore CertCloseStore CertDuplicateCertificateContext CertFreeCertificateChain CertVerifyCertificateChainPolicy CertEnumCertificatesInStore CertDuplicateCertificateChain CertAddCertificateContextToStore CertDuplicateStore CertGetCertificateChain CertFreeCertificateContext

secur32

EncryptMessage DeleteSecurityContext DecryptMessage FreeContextBuffer AcceptSecurityContext ApplyControlToken InitializeSecurityContextW QueryContextAttributesW AcquireCredentialsHandleA FreeCredentialsHandle

bcryptprimitives

ProcessPrng

iphlpapi

GetAdaptersAddresses

user32

GetSystemMetrics ReleaseDC GetDC

gdi32

CreateCompatibleBitmap CreateCompatibleDC SelectObject SetStretchBltMode StretchBlt GetDIBits DeleteObject DeleteDC

vcruntime140

__std_type_info_destroy_list memmove __C_specific_handler memset __CxxFrameHandler3 memcmp memcpy

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _initialize_narrow_environment _cexit _execute_onexit_table _initialize_onexit_table _initterm _initterm_e _seh_filter_dll

api-ms-win-crt-heap-l1-1-0

free

Sharing

General

Malware Config

Signatures

File Explorer

a221c4ff96b141679cc44e95aaabc6392f057c6e192325c3aa1175c3488b28da

kernel32

advapi32

ws2_32

netapi32

api-ms-win-core-synch-l1-2-0

ntdll

bcrypt

crypt32

secur32

bcryptprimitives

iphlpapi

user32

gdi32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic