146f909ab579b803fbeaf02058ec2d7deec3b10c1f7a7410c15ab577a244dfcc

Sharing

Copy URL Twitter E-mail

General

Target
146f909ab579b803fbeaf02058ec2d7deec3b10c1f7a7410c15ab577a244dfcc
Size 316KB
Sample260706-jvx2hsbw2z
SHA256 146f909ab579b803fbeaf02058ec2d7deec3b10c1f7a7410c15ab577a244dfcc
MD5 89bf8a5f538921c680f86f13535ce928
SHA1 cff31ee6d9e97e54e6a728c4e850910bf408106b
SHA512 ba5ead5a9086ca62931b3deadebcdd8636ba8f7c533b1f438b2395410186ae68dea68a9c2d6f121fbc8632daaf3552412b835b3038566d8efd19a1dae56331de
SSDEEP 6144:xFfq87v2/J0s6RP+AigOTs4nyjdvSHwpP8hP0EaX:xNhiJ0s6R8Ts4n0zkZZaX
TLSH
T17B646C117285D031D56252B22B39EFB6866DED304FA559CBA3C45E3BDE202C16F31F2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
146f909ab579b803fbeaf02058ec2d7deec3b10c1f7a7410c15ab577a244dfcc

File Explorer

146f909ab579b803fbeaf02058ec2d7deec3b10c1f7a7410c15ab577a244dfcc

.exe 316KB

146f909ab579b803fbeaf02058ec2d7deec3b10c1f7a7410c15ab577a244dfcc

IMPHASH e0d4183bfb97a177eb3b4e4ab96dd319
SHA256 146f909ab579b803fbeaf02058ec2d7deec3b10c1f7a7410c15ab577a244dfcc
MD5 89bf8a5f538921c680f86f13535ce928
SHA1 cff31ee6d9e97e54e6a728c4e850910bf408106b
SHA512 ba5ead5a9086ca62931b3deadebcdd8636ba8f7c533b1f438b2395410186ae68dea68a9c2d6f121fbc8632daaf3552412b835b3038566d8efd19a1dae56331de
SSDEEP 6144:xFfq87v2/J0s6RP+AigOTs4nyjdvSHwpP8hP0EaX:xNhiJ0s6R8Ts4n0zkZZaX
TLSH
T17B646C117285D031D56252B22B39EFB6866DED304FA559CBA3C45E3BDE202C16F31F2A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

119008

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\sv\source\repos\svchost\svchost\Release\svchost.pdb

kernel32

CopyFileA GetLastError GetFileAttributesA DeleteFileA GetTempPathA GetCurrentProcessId CreateProcessA CreateDirectoryA SetEndOfFile GetVolumeInformationA GetCurrentProcess CloseHandle GetModuleFileNameA WriteConsoleW HeapSize CreateFileW SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc ReadConsoleW ReadFile EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapFree GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapAlloc GetFileType SetFilePointerEx GetFileSizeEx WriteFile GetStdHandle GetModuleFileNameW ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW FreeLibrary MultiByteToWideChar WideCharToMultiByte LocalFree WaitForSingleObjectEx Sleep SwitchToThread GetCurrentThreadId GetExitCodeThread QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable InitializeCriticalSectionEx GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsDebuggerPresent GetStartupInfoW InitializeSListHead RtlUnwind RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree

advapi32

OpenProcessToken GetTokenInformation GetUserNameA

shell32

SHGetFolderPathA ShellExecuteA

ole32

CoCreateInstance CoSetProxyBlanket CoInitializeSecurity CoUninitialize CoInitializeEx

oleaut32

VariantInit SysFreeString SysAllocString VariantClear

ws2_32

connect inet_ntop htons freeaddrinfo sendto ioctlsocket setsockopt WSAGetLastError socket send WSAStartup getaddrinfo inet_pton closesocket WSACleanup ntohs

rpcrt4

UuidCreate UuidToStringA RpcStringFreeA

bcrypt

BCryptSetProperty BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptGenerateSymmetricKey BCryptDecrypt BCryptDestroyKey

winhttp

WinHttpCrackUrl WinHttpConnect WinHttpSetTimeouts WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData WinHttpOpen WinHttpReceiveResponse WinHttpQueryDataAvailable

Name

.text

Size

239KB

Virtual Size

238KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

55KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

146f909ab579b803fbeaf02058ec2d7deec3b10c1f7a7410c15ab577a244dfcc

kernel32

advapi32

shell32

ole32

oleaut32

ws2_32

rpcrt4

bcrypt

winhttp

generic