ca13e17d921857c5453810328abd3338c593aa7e34dfd4f6b8f41579d55e0844

General

Target
ca13e17d921857c5453810328abd3338c593aa7e34dfd4f6b8f41579d55e0844
Size 1.5MB
Sample260706-mtq4csdy61
SHA256 ca13e17d921857c5453810328abd3338c593aa7e34dfd4f6b8f41579d55e0844
MD5 3479f954d50f4160128f147fa0b719c4
SHA1 2abc95f84091fdb4bbcf5b5b7cf0db92ae26b735
SHA512 2c17124eb479e93dd6507063108d23878579be158ad4be3a51acce2f42fbf2591d31a84dd6017b4a38e5d76d7eac969a00529c64ab17e11f1766f5911a4d0197
SSDEEP 24576:LtIEgmyDpksqjnhMgeiCl7G0nehbGZpbD:vyDeDmg27RnWGj
TLSH
T12C75D0307675C076D4210D320664D7A98C6FAD222F6448EFE3A76F7EDA303D19A31A67
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ca13e17d921857c5453810328abd3338c593aa7e34dfd4f6b8f41579d55e0844

File Explorer

ca13e17d921857c5453810328abd3338c593aa7e34dfd4f6b8f41579d55e0844

.exe 1.5MB

ca13e17d921857c5453810328abd3338c593aa7e34dfd4f6b8f41579d55e0844

IMPHASH b5e48362ae6f1b3f8fbd4cc579b06335
SHA256 ca13e17d921857c5453810328abd3338c593aa7e34dfd4f6b8f41579d55e0844
MD5 3479f954d50f4160128f147fa0b719c4
SHA1 2abc95f84091fdb4bbcf5b5b7cf0db92ae26b735
SHA512 2c17124eb479e93dd6507063108d23878579be158ad4be3a51acce2f42fbf2591d31a84dd6017b4a38e5d76d7eac969a00529c64ab17e11f1766f5911a4d0197
SSDEEP 24576:LtIEgmyDpksqjnhMgeiCl7G0nehbGZpbD:vyDeDmg27RnWGj
TLSH
T12C75D0307675C076D4210D320664D7A98C6FAD222F6448EFE3A76F7EDA303D19A31A67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

85437

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\.jenkins\workspace\CCMini_Windows\Win32\Products\Release_Win32\CCMini.pdb

ws2_32

recv listen htons ioctlsocket setsockopt closesocket bind accept htonl send socket WSAStartup gethostbyname __WSAFDIsSet connect select ntohs getsockname WSAGetLastError

shell32

CommandLineToArgvW

kernel32

GetStartupInfoW SetEndOfFile HeapSize GetProcessHeap SetEnvironmentVariableW GetCommandLineW Sleep EnterCriticalSection LeaveCriticalSection InitializeCriticalSection MultiByteToWideChar LoadLibraryW GetProcAddress DeleteCriticalSection WaitForSingleObject TerminateThread CloseHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc ReadConsoleW SetFilePointerEx GetFileSizeEx ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetStdHandle GetFullPathNameW GetCurrentDirectoryW TlsSetValue GetCurrentThreadId TlsAlloc TlsGetValue QueryPerformanceCounter WideCharToMultiByte EncodePointer DecodePointer InitializeCriticalSectionEx LCMapStringEx GetStringTypeW GetCPInfo UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent WriteConsoleW GetModuleHandleW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind RaiseException GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread ResumeThread FreeLibraryAndExitThread GetModuleHandleExW CreateFileW GetDriveTypeW GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetTimeZoneInformation ExitProcess GetModuleFileNameW GetStdHandle WriteFile HeapAlloc HeapFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW

Sharing

General

Malware Config

Signatures

File Explorer

ca13e17d921857c5453810328abd3338c593aa7e34dfd4f6b8f41579d55e0844

ws2_32

shell32

kernel32

generic