8042bb1da2345a45bdd495bfd03386c9e65817814c61ef1c0acc975fb955912e

Sharing

Copy URL Twitter E-mail

General

Target
8042bb1da2345a45bdd495bfd03386c9e65817814c61ef1c0acc975fb955912e
Size 14.3MB
Sample260706-j6dr1sf14r
SHA256 8042bb1da2345a45bdd495bfd03386c9e65817814c61ef1c0acc975fb955912e
MD5 b05cec6a1c2af73ec7cae54320420afe
SHA1 c76896bb70d97a95690af03cad29c051ece24fdf
SHA512 1e829a8899a6edb2d12e9f648bd1245bcbca858cc14ad3d5a49d36dcc4e62aa765583abad278a63061958b9ae242bc21ffdb5dfbe7e2408cee2ef61c8fdfc5cf
SSDEEP 196608:kkQl3+HmF+Dch/F2ZIGULqo0VbncOKuHim7kKkPFWkyurrX2PUUR59M7ae92Z+:dQQGF+DO/AUuVcmlCFWkyurrmP59Zes
TLSH
T165E60143FA9986E9C09EC178875A5323EB72FC8D0620B39B67D44B212F57B602F5D358
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8042bb1da2345a45bdd495bfd03386c9e65817814c61ef1c0acc975fb955912e

File Explorer

8042bb1da2345a45bdd495bfd03386c9e65817814c61ef1c0acc975fb955912e

.exe 14.3MB

8042bb1da2345a45bdd495bfd03386c9e65817814c61ef1c0acc975fb955912e

IMPHASH f99a7686bc81fe87e187a3679c15e792
SHA256 8042bb1da2345a45bdd495bfd03386c9e65817814c61ef1c0acc975fb955912e
MD5 b05cec6a1c2af73ec7cae54320420afe
SHA1 c76896bb70d97a95690af03cad29c051ece24fdf
SHA512 1e829a8899a6edb2d12e9f648bd1245bcbca858cc14ad3d5a49d36dcc4e62aa765583abad278a63061958b9ae242bc21ffdb5dfbe7e2408cee2ef61c8fdfc5cf
SSDEEP 196608:kkQl3+HmF+Dch/F2ZIGULqo0VbncOKuHim7kKkPFWkyurrX2PUUR59M7ae92Z+:dQQGF+DO/AUuVcmlCFWkyurrmP59Zes
TLSH
T165E60143FA9986E9C09EC178875A5323EB72FC8D0620B39B67D44B212F57B602F5D358
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2959096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

rs.pdb

user32

SystemParametersInfoW

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

ntdll

NtOpenFile RtlLookupFunctionEntry RtlNtStatusToDosError NtQuerySystemInformation NtCancelIoFileEx RtlVirtualUnwind RtlGetVersion NtQueryInformationProcess NtCreateNamedPipeFile RtlCaptureContext NtCreateFile NtDeviceIoControlFile NtWriteFile NtReadFile

kernel32

SetLastError GetCurrentProcess GetCurrentProcessId CreateMutexA WaitForSingleObjectEx LoadLibraryA lstrlenW ReleaseMutex WideCharToMultiByte GetCurrentDirectoryW GetStdHandle GetConsoleMode GetConsoleOutputCP MultiByteToWideChar WriteConsoleW GetEnvironmentVariableW GetModuleHandleA QueryPerformanceFrequency FormatMessageW HeapReAlloc GetTempPathW GetModuleFileNameW GetFullPathNameW CreateFileW SetFilePointerEx FindNextFileW CreateDirectoryW FindFirstFileExW HeapFree GetProcessHeap GetCurrentThread SetThreadStackGuarantee CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetEnvironmentStringsW FreeEnvironmentStringsW GetFileAttributesW DuplicateHandle CreateThread ReadFileEx WriteFileEx SleepEx WaitForMultipleObjects GetOverlappedResult GetExitCodeProcess CreateEventW CancelIo ReadFile ExitProcess QueryPerformanceCounter GetSystemTimePreciseAsFileTime HeapAlloc DeleteFileW CopyFileExW GetDriveTypeW GetVolumeInformationW GetDiskFreeSpaceExW DeviceIoControl OpenProcess AddVectoredExceptionHandler ReadProcessMemory GetCommandLineW SetHandleInformation GetProcessTimes GetSystemTimes GetProcessIoCounters GetLogicalDrives GetFinalPathNameByHandleW GetQueuedCompletionStatusEx GetProcAddress LocalFree VirtualQueryEx GlobalMemoryStatusEx UnhandledExceptionFilter GetTickCount64 Sleep WaitForSingleObject SetWaitableTimer CreateWaitableTimerExW GetModuleHandleW SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent CreateIoCompletionPort PostQueuedCompletionStatus SwitchToThread SetFileInformationByHandle FlushFileBuffers GetTickCount MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime FreeLibrary SystemTimeToFileTime GetFileSize LockFileEx UnlockFile HeapDestroy HeapCompact LoadLibraryW DeleteFileA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate UnmapViewOfFile CreateMutexW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile HeapCreate AreFileApisANSI InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId GetLastError SetFileCompletionNotificationModes GetComputerNameExW GetFileInformationByHandleEx FindClose GetFileInformationByHandle CloseHandle GetSystemInfo

dxgi

CreateDXGIFactory1

d3d11

D3D11CreateDevice

psapi

GetModuleFileNameExW GetPerformanceInfo

pdh

PdhAddEnglishCounterW PdhCollectQueryData PdhGetFormattedCounterValue PdhRemoveCounter PdhCloseQuery PdhOpenQueryA

iphlpapi

FreeMibTable GetAdaptersAddresses GetIfTable2

netapi32

NetUserEnum NetApiBufferFree NetUserGetInfo NetUserGetLocalGroups

secur32

ApplyControlToken InitializeSecurityContextW AcceptSecurityContext FreeContextBuffer EncryptMessage DeleteSecurityContext LsaEnumerateLogonSessions AcquireCredentialsHandleA FreeCredentialsHandle DecryptMessage LsaFreeReturnBuffer LsaGetLogonSessionData QueryContextAttributesW

advapi32

LookupAccountSidW CopySid GetLengthSid IsValidSid GetTokenInformation OpenProcessToken RegCloseKey RegOpenKeyExW RegQueryValueExW

ws2_32

getsockname WSAIoctl closesocket WSASend WSASocketW ioctlsocket WSAGetLastError connect getsockopt bind getaddrinfo freeaddrinfo WSAStartup WSACleanup setsockopt recv send getpeername shutdown

crypt32

CertDuplicateCertificateContext CertGetCertificateChain CertAddCertificateContextToStore CertEnumCertificatesInStore CertCloseStore CertFreeCertificateChain CertFreeCertificateContext CertDuplicateStore CertOpenStore CertVerifyCertificateChainPolicy CertDuplicateCertificateChain

shell32

CommandLineToArgvW

ole32

CoInitializeEx CoCreateInstance CoUninitialize CoSetProxyBlanket CoInitializeSecurity

powrprof

CallNtPowerInformation

oleaut32

VariantClear SysAllocString SysFreeString

vcruntime140

__CxxFrameHandler3 memset memcpy memmove memcmp strrchr __C_specific_handler __current_exception __current_exception_context

api-ms-win-crt-string-l1-1-0

wcslen strlen strcmp strncmp strcspn

api-ms-win-crt-heap-l1-1-0

free malloc _msize _set_new_mode realloc

api-ms-win-crt-math-l1-1-0

_dclass __setusermatherr round roundf log

api-ms-win-crt-utility-l1-1-0

qsort _rotl64

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv exit _register_onexit_function _initialize_onexit_table _get_initial_narrow_environment _initterm_e _register_thread_local_exe_atexit_callback _crt_atexit _initterm _set_app_type _seh_filter_exe __p___argc _exit _initialize_narrow_environment _endthreadex terminate _c_exit _cexit __p___argv _beginthreadex

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

8042bb1da2345a45bdd495bfd03386c9e65817814c61ef1c0acc975fb955912e

user32

bcryptprimitives

api-ms-win-core-synch-l1-2-0

ntdll

kernel32

dxgi

d3d11

psapi

pdh

iphlpapi

netapi32

secur32

advapi32

ws2_32

crypt32

shell32

ole32

powrprof

oleaut32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic