9b7f46a81a3c00bba5e722acd6bd690d484eda5df4879622a628f5e8fe772322

Sharing

Copy URL Twitter E-mail

General

Target
9b7f46a81a3c00bba5e722acd6bd690d484eda5df4879622a628f5e8fe772322
Size 476KB
Sample260706-e24qesdv6l
SHA256 9b7f46a81a3c00bba5e722acd6bd690d484eda5df4879622a628f5e8fe772322
MD5 86385382f60ec46f7d276d2e1080c507
SHA1 bf721b4ef896574108642bd05720217b9df78acd
SHA512 b04261f01c633dd02d18e10006eee10bf7ae2ed0ee9c41ec75de950f7bed90d16ac17763e29c575ae077fb679de4faa88bd242a05d254694dc2db034beb13d98
SSDEEP 12288:AitvnZaLNc31DJo8kS0mY7GppZDUfWMNPe1ry0k9mimaUNvGMaYVA:kLN0Jo8kS0mY7GppZDUeMNPeu9mA
TLSH
T12DA4AE217082C072E4AE11712519ABB666FDF8310B7958DFABD05E7F5EB02C2A731E17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9b7f46a81a3c00bba5e722acd6bd690d484eda5df4879622a628f5e8fe772322

File Explorer

9b7f46a81a3c00bba5e722acd6bd690d484eda5df4879622a628f5e8fe772322

.dll 476KB

9b7f46a81a3c00bba5e722acd6bd690d484eda5df4879622a628f5e8fe772322

IMPHASH 70acdaa4ea78fa607c081f6c38099a06
SHA256 9b7f46a81a3c00bba5e722acd6bd690d484eda5df4879622a628f5e8fe772322
MD5 86385382f60ec46f7d276d2e1080c507
SHA1 bf721b4ef896574108642bd05720217b9df78acd
SHA512 b04261f01c633dd02d18e10006eee10bf7ae2ed0ee9c41ec75de950f7bed90d16ac17763e29c575ae077fb679de4faa88bd242a05d254694dc2db034beb13d98
SSDEEP 12288:AitvnZaLNc31DJo8kS0mY7GppZDUfWMNPe1ry0k9mimaUNvGMaYVA:kLN0Jo8kS0mY7GppZDUeMNPeu9mA
TLSH
T12DA4AE217082C072E4AE11712519ABB666FDF8310B7958DFABD05E7F5EB02C2A731E17
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

211952

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\Runner\builds\8d28cc3a\0\oray\client\oraysafeaddin\Release\process.pdb

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

kernel32

GetModuleFileNameW FindClose OpenProcess CreateToolhelp32Snapshot GetTimeZoneInformation CloseHandle Module32FirstW Module32NextW GetSystemTime FindNextFileW CreateFileW SetStdHandle TerminateProcess GetCurrentProcess WideCharToMultiByte DeleteCriticalSection DecodePointer RaiseException HeapSize GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW FindFirstFileExW ReadConsoleW ReadFile GetConsoleMode GetConsoleOutputCP WriteFile FlushFileBuffers SetFilePointerEx GetFileSizeEx GetCommandLineA GetLastError InitializeCriticalSectionEx lstrlenW LocalFree lstrcmpA LocalAlloc lstrcpynW WriteConsoleW IsValidCodePage GetACP InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS SleepConditionVariableSRW InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection GetCurrentThreadId MultiByteToWideChar QueryPerformanceCounter GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress EncodePointer LCMapStringEx GetLocaleInfoEx GetStringTypeW CompareStringEx GetCPInfo InitializeCriticalSectionAndSpinCount SetEvent ResetEvent WaitForSingleObjectEx CreateEventW UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead OutputDebugStringW RtlUnwind InterlockedFlushSList SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW HeapFree HeapReAlloc HeapAlloc GetStdHandle GetFileType GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetOEMCP

advapi32

LookupAccountSidW ConvertSidToStringSidW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW GetTokenInformation

ole32

CoInitializeSecurity CoSetProxyBlanket CoInitializeEx CoUninitialize CoCreateInstance

oleaut32

VariantChangeType SafeArrayGetUBound SafeArrayGetLBound VariantInit SysAllocString SafeArrayUnaccessData SafeArrayAccessData VariantClear SysFreeString

crypt32

CertFreeCertificateContext CertCloseStore CryptMsgClose CryptMsgOpenToDecode CryptQueryObject CryptMsgGetParam CertFindCertificateInStore CertGetNameStringW CertOpenStore CryptMsgUpdate

Sharing

General

Malware Config

Signatures

File Explorer

9b7f46a81a3c00bba5e722acd6bd690d484eda5df4879622a628f5e8fe772322

version

kernel32

advapi32

ole32

oleaut32

crypt32

generic