70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6

Sharing

Copy URL Twitter E-mail

General

Target
70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6
Size 24.1MB
Sample260703-q5vgpsat21
SHA256 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6
MD5 5e8dad881659b6535ece40596f1e02d2
SHA1 0d2461ca1a3f4bdc4512bcd6c54192e2a1e99656
SHA512 e8379e955d679f2662d022efe498e9b30acb0eb4b75e5cef70aee019db500826240deeb5c9cfaf24755385e755b1f3487282ae431f8ae5d79f7c9d08dc23077c
SSDEEP 98304:33XLIuzhFgMw/fy5KrW2DW3yErO4siImgwR/zFls3S/wb8z1qP5E6my+aBMC+6y3:3L/Q3ynfrO4soHsieM1qP5EjVQa5Zh
TLSH
T197475B82F7844ADEC65099798DAA53C23371FC251F27E3D36B09BA3E2D726C59E64700
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6

File Explorer

70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6

.exe 24.1MB

70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6

IMPHASH 50a91fb010acd8802950282bb422907c
SHA256 70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6
MD5 5e8dad881659b6535ece40596f1e02d2
SHA1 0d2461ca1a3f4bdc4512bcd6c54192e2a1e99656
SHA512 e8379e955d679f2662d022efe498e9b30acb0eb4b75e5cef70aee019db500826240deeb5c9cfaf24755385e755b1f3487282ae431f8ae5d79f7c9d08dc23077c
SSDEEP 98304:33XLIuzhFgMw/fy5KrW2DW3yErO4siImgwR/zFls3S/wb8z1qP5E6my+aBMC+6y3:3L/Q3ynfrO4soHsieM1qP5EjVQa5Zh
TLSH
T197475B82F7844ADEC65099798DAA53C23371FC251F27E3D36B09BA3E2D726C59E64700
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5344

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

AddVectoredExceptionHandler AreFileApisANSI CloseHandle CreateEventA CreateFileA CreateFileMappingA CreateFileMappingW CreateFileW CreateIoCompletionPort CreateMutexW CreateSemaphoreA CreateThread CreateWaitableTimerExW DeleteCriticalSection DeleteFileA DeleteFileW DuplicateHandle EnterCriticalSection ExitProcess FlushFileBuffers FlushViewOfFile FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary GetConsoleMode GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceA GetDiskFreeSpaceW GetEnvironmentStringsW GetFileAttributesA GetFileAttributesExW GetFileAttributesW GetFileSize GetFullPathNameA GetFullPathNameW GetHandleInformation GetLastError GetProcAddress GetProcessAffinityMask GetProcessHeap GetQueuedCompletionStatusEx GetStartupInfoA GetStdHandle GetSystemDirectoryA GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetTempPathA GetTempPathW GetThreadContext GetThreadPriority GetTickCount GetVersionExA GetVersionExW HeapAlloc HeapCompact HeapCreate HeapDestroy HeapFree HeapReAlloc HeapSize HeapValidate InitializeCriticalSection IsDBCSLeadByteEx IsDebuggerPresent LeaveCriticalSection LoadLibraryA LoadLibraryW LocalFree LockFile LockFileEx MapViewOfFile MultiByteToWideChar OpenProcess OutputDebugStringA OutputDebugStringW PostQueuedCompletionStatus QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReleaseSemaphore RemoveVectoredExceptionHandler ResetEvent ResumeThread SetConsoleCtrlHandler SetEndOfFile SetErrorMode SetEvent SetFilePointer SetLastError SetProcessAffinityMask SetProcessPriorityBoost SetThreadContext SetThreadPriority SetUnhandledExceptionFilter SetWaitableTimer Sleep SuspendThread SwitchToThread SystemTimeToFileTime TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection UnlockFile UnlockFileEx UnmapViewOfFile VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteConsoleW WriteFile __C_specific_handler

msvcrt

___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __lconv_init __set_app_type __setusermatherr _acmdln _amsg_exit _beginthread _beginthreadex _cexit _commode _endthreadex _errno _fmode _initterm _localtime64 _lock _onexit _setjmp _ultoa _unlock abort calloc exit fprintf fputc free fwrite localeconv malloc memcmp memcpy memmove memset printf realloc signal strcmp strcspn strerror strlen strncmp strrchr vfprintf wcslen longjmp _strdup

Name

.text

Size

3.9MB

Virtual Size

3.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

793KB

Virtual Size

792KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

3.4MB

Virtual Size

3.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

29KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

394KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

337B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

112B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

568B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

153KB

Virtual Size

153KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

4.6MB

Virtual Size

4.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

30KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

455KB

Virtual Size

454KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

6.4MB

Virtual Size

6.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/92

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/106

Size

512B

Virtual Size

42B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

70c9149ee26e31765e7bfb6d9d1882bc41a834ba9c88a4fd8ef4a706be0ae1a6

kernel32

msvcrt

generic