db79dd93e37f09ef4dcd4d7f5027e6b7cc75e356e20385fe9f9df770949c1d8d

Sharing

Copy URL Twitter E-mail

General

Target
db79dd93e37f09ef4dcd4d7f5027e6b7cc75e356e20385fe9f9df770949c1d8d
Size 2.8MB
Sample260706-kc3dyscw2v
SHA256 db79dd93e37f09ef4dcd4d7f5027e6b7cc75e356e20385fe9f9df770949c1d8d
MD5 bd60aea2ebe6a2a203ad57f14d416d26
SHA1 89c9b2ea6d445a2ca49523b82309ad976f247dfb
SHA512 172b06c609bdc650246bd87f259ab13f3943356adf062f2a6c2933023f2caa72fcda4b1cf2290e1bfde172c6ea176a9f6f355300c483f1f0227af0c2cfdd265f
SSDEEP 49152:AHqCjlQbatNPVDcV2rzgwzJdGZ6QiXYQbatNPVDcV2rzgwzJdGZ6QiX:AHqq6MNtDcOpCxiI6MNtDcOpCxi
TLSH
T112D51229D29172E9ED6781B589925690F873F82382691FEF43E0D3336F272D14E2D724
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
db79dd93e37f09ef4dcd4d7f5027e6b7cc75e356e20385fe9f9df770949c1d8d

File Explorer

db79dd93e37f09ef4dcd4d7f5027e6b7cc75e356e20385fe9f9df770949c1d8d

.exe 2.8MB

db79dd93e37f09ef4dcd4d7f5027e6b7cc75e356e20385fe9f9df770949c1d8d

IMPHASH 3132b97acae9eb7f3053e4d14c497a51
SHA256 db79dd93e37f09ef4dcd4d7f5027e6b7cc75e356e20385fe9f9df770949c1d8d
MD5 bd60aea2ebe6a2a203ad57f14d416d26
SHA1 89c9b2ea6d445a2ca49523b82309ad976f247dfb
SHA512 172b06c609bdc650246bd87f259ab13f3943356adf062f2a6c2933023f2caa72fcda4b1cf2290e1bfde172c6ea176a9f6f355300c483f1f0227af0c2cfdd265f
SSDEEP 49152:AHqCjlQbatNPVDcV2rzgwzJdGZ6QiXYQbatNPVDcV2rzgwzJdGZ6QiX:AHqq6MNtDcOpCxiI6MNtDcOpCxi
TLSH
T112D51229D29172E9ED6781B589925690F873F82382691FEF43E0D3336F272D14E2D724
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

276528

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

AcquireSRWLockExclusive CloseHandle CompareStringW CreateFileW DecodePointer DeleteCriticalSection EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FreeConsole FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetFileSizeEx GetFileType GetLastError GetLocaleInfoW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTimeAsFileTime GetUserDefaultLCID HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryExW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetEndOfFile SetEnvironmentVariableW SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

user32

AppendMenuW CreateMenu CreatePopupMenu CreateWindowExW DefWindowProcW DestroyWindow LoadCursorW LoadIconW MessageBoxA MessageBoxW PostQuitMessage RegisterClassExW SetMenu

Name

.text

Size

416KB

Virtual Size

420KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

65KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gxfg

Size

9KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.world

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.world

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

db79dd93e37f09ef4dcd4d7f5027e6b7cc75e356e20385fe9f9df770949c1d8d

kernel32

user32

generic