b32ec19df6624ef31e2cada8af6f53a0f3b18be9b3f6e74d3e8262c0800c5f28

Sharing

Copy URL Twitter E-mail

General

Target
b32ec19df6624ef31e2cada8af6f53a0f3b18be9b3f6e74d3e8262c0800c5f28
Size 3.9MB
Sample260706-j95pxact5s
SHA256 b32ec19df6624ef31e2cada8af6f53a0f3b18be9b3f6e74d3e8262c0800c5f28
MD5 cecaf52ca5955d3963b56c2777a2aeef
SHA1 cff7393c7a9223a906faa524075f3deb45fd5d7a
SHA512 3cf2be891a1f9b132c5f18ed284803c8aaac7d8905c6f59767831a6e9545c7d0c7ff64c49ec22ebc52eeecb69bdbd52580911e481c4c51a155f7e36abb738a25
SSDEEP 98304:N7gdtD61dWjuTW3/QDUjsmATYegBHj7q0/0+uOeC:8gWqTW3/QNslBi0/juu
TLSH
T1E216234C6292A0E8E0CAA1F426409A6999F2B1D27F1F7E6B07F5443C5E74DCD0518FBE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b32ec19df6624ef31e2cada8af6f53a0f3b18be9b3f6e74d3e8262c0800c5f28

File Explorer

b32ec19df6624ef31e2cada8af6f53a0f3b18be9b3f6e74d3e8262c0800c5f28

.exe 3.9MB

b32ec19df6624ef31e2cada8af6f53a0f3b18be9b3f6e74d3e8262c0800c5f28

IMPHASH 4532043815f314896faef5a00eca8e13
SHA256 b32ec19df6624ef31e2cada8af6f53a0f3b18be9b3f6e74d3e8262c0800c5f28
MD5 cecaf52ca5955d3963b56c2777a2aeef
SHA1 cff7393c7a9223a906faa524075f3deb45fd5d7a
SHA512 3cf2be891a1f9b132c5f18ed284803c8aaac7d8905c6f59767831a6e9545c7d0c7ff64c49ec22ebc52eeecb69bdbd52580911e481c4c51a155f7e36abb738a25
SSDEEP 98304:N7gdtD61dWjuTW3/QDUjsmATYegBHj7q0/0+uOeC:8gWqTW3/QNslBi0/juu
TLSH
T1E216234C6292A0E8E0CAA1F426409A6999F2B1D27F1F7E6B07F5443C5E74DCD0518FBE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

kernel32

AddVectoredExceptionHandler CloseHandle CreateFileMappingA CreateFileW CreateToolhelp32Snapshot DeleteCriticalSection DuplicateHandle EnterCriticalSection FreeLibrary GetConsoleMode GetCurrentDirectoryW GetCurrentProcess GetCurrentThread GetEnvironmentVariableW GetFileInformationByHandle GetFileInformationByHandleEx GetFullPathNameW GetLastError GetModuleHandleA GetProcAddress GetProcessHeap GetStdHandle HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete InitializeCriticalSection LeaveCriticalSection LoadLibraryA MapViewOfFile Module32FirstW Module32NextW MultiByteToWideChar RaiseException RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter Sleep TlsAlloc TlsFree TlsGetValue TlsSetValue UnmapViewOfFile VirtualAlloc VirtualProtect VirtualQuery WaitForSingleObject WriteConsoleW __C_specific_handler

api-ms-win-crt-environment-l1-1-0

__p__environ __p__wenviron

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-private-l1-1-0

memcmp memcpy memmove

api-ms-win-crt-runtime-l1-1-0

_set_app_type __p___argc __p___argv __p___wargv _cexit _configure_narrow_argv _configure_wide_argv _crt_at_quick_exit _crt_atexit _exit _fpreset _initialize_narrow_environment _initialize_wide_environment _initterm _set_invalid_parameter_handler abort exit signal

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vfwprintf fwrite

api-ms-win-crt-string-l1-1-0

memset strlen strncmp

api-ms-win-crt-time-l1-1-0

__daylight __timezone __tzname _tzset

ntdll

NtWriteFile RtlNtStatusToDosError

Name

.text

Size

209KB

Virtual Size

208KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

336B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

3.7MB

Virtual Size

3.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

672B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1024B

Virtual Size

860B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

b32ec19df6624ef31e2cada8af6f53a0f3b18be9b3f6e74d3e8262c0800c5f28

api-ms-win-core-synch-l1-2-0

kernel32

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

ntdll

generic