tmpnegrc0re

Sharing

Copy URL Twitter E-mail

General

Target
tmpnegrc0re
Size 1.5MB
Sample260704-1jsfbses7w
SHA256 1a29470c92958381d61437a22fbbc1e2f2e9f00c7e09a4fc0c0b9426688ae6f4
MD5 8efcfb0c6fc85e528e6b5bb0cc186958
SHA1 0e2c236a55c97a4dde9f848a41d2c4e7fbe8796b
SHA512 33494d9d09daa08cc497dfd03bc879dfefbe37f3e5992dc293d8420e7ba53e9ab6989be645382d2a03be39788a397cb056b9245eb6d851dbfee422147a52a0c2
SSDEEP 24576:qxWVeyRYVw44RE5E/jYKDB8U4jYY0td7kt+X83BOcwsQxyCCPgSO5A:q8YVw44RgEMCr16
TLSH
T14C751701BFFD8045F4B327709D754AA14A66BC22FE74C56EB688371ECBB1B414826B27
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
tmpnegrc0re

File Explorer

tmpnegrc0re

.exe 1.5MB

IMPHASH d3eafac78b2f94eb6a014af9c2a27809
SHA256 1a29470c92958381d61437a22fbbc1e2f2e9f00c7e09a4fc0c0b9426688ae6f4
MD5 8efcfb0c6fc85e528e6b5bb0cc186958
SHA1 0e2c236a55c97a4dde9f848a41d2c4e7fbe8796b
SHA512 33494d9d09daa08cc497dfd03bc879dfefbe37f3e5992dc293d8420e7ba53e9ab6989be645382d2a03be39788a397cb056b9245eb6d851dbfee422147a52a0c2
SSDEEP 24576:qxWVeyRYVw44RE5E/jYKDB8U4jYY0td7kt+X83BOcwsQxyCCPgSO5A:q8YVw44RgEMCr16
TLSH
T14C751701BFFD8045F4B327709D754AA14A66BC22FE74C56EB688371ECBB1B414826B27
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

91945

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

urlmon

URLDownloadToCacheFileA

psapi

GetModuleBaseNameA GetModuleFileNameExA EnumProcessModules EnumProcesses

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

kernel32

DeleteFileA GetTempFileNameA CreateFileA lstrcpyA InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection GetVolumeInformationA GetDriveTypeA WaitForSingleObject CreateMutexA Thread32Next SuspendThread ResumeThread OpenThread Thread32First CreateToolhelp32Snapshot OpenProcess TerminateProcess CreateDirectoryA GetTempPathA CreateThread FreeResource UpdateResourceA LockResource LoadResource SizeofResource FindResourceExA EnumResourceLanguagesA EnumResourceNamesA SetFileTime GetFileTime FreeLibrary FindResourceA LoadLibraryExA GetCurrentProcess SetEvent OpenEventA Process32Next Process32First FindClose FindNextFileA FindFirstFileA EndUpdateResourceA EnumResourceTypesA BeginUpdateResourceA GetTickCount CopyFileA ReleaseMutex lstrlenA lstrcatA WriteFile GetModuleFileNameA CreateProcessA CloseHandle Sleep GetLastError HeapSize SetStdHandle WriteConsoleW GetConsoleOutputCP FlushFileBuffers WriteConsoleA InitializeCriticalSectionAndSpinCount GetLocaleInfoW LoadLibraryA GetStringTypeW GetStringTypeA IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID GetConsoleMode GetConsoleCP ReadFile HeapReAlloc lstrcmpA SetFilePointer GetSystemTimeAsFileTime GetLocalTime GetCurrentThreadId GetVersionExA GetCurrentProcessId GetFullPathNameA GetCurrentThread WideCharToMultiByte GetModuleHandleA HeapAlloc HeapFree GetProcessHeap InterlockedIncrement InterlockedDecrement UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RaiseException RtlUnwind GetCommandLineA GetStartupInfoA MultiByteToWideChar LCMapStringA LCMapStringW GetCPInfo GetModuleHandleW GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetACP GetOEMCP IsValidCodePage GetStdHandle ExitProcess FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType HeapCreate VirtualFree QueryPerformanceCounter VirtualAlloc

user32

wvsprintfA wsprintfA

advapi32

OpenProcessToken FreeSid OpenThreadToken GetTokenInformation EqualSid AllocateAndInitializeSid RegEnumKeyExA RegQueryValueExA RegEnumValueA RegOpenKeyExA RegSetValueExA RegCloseKey

shell32

SHGetSpecialFolderPathA ShellExecuteA

shlwapi

SHRegCloseUSKey SHRegCreateUSKeyA

wininet

InternetReadFile HttpOpenRequestA HttpSendRequestA InternetOpenA InternetCloseHandle InternetQueryOptionA HttpQueryInfoA InternetOpenUrlA InternetSetFilePointer InternetConnectA

ws2_32

WSAStartup gethostbyname