0a1d706926c1a68dae46b536d06aae968ab5bbc454ad06f8afdcc1ad4a7cb7ae

Sharing

Copy URL Twitter E-mail

General

Target
0a1d706926c1a68dae46b536d06aae968ab5bbc454ad06f8afdcc1ad4a7cb7ae
Size 1.3MB
Sample260707-e9r2lahz3w
SHA256 0a1d706926c1a68dae46b536d06aae968ab5bbc454ad06f8afdcc1ad4a7cb7ae
MD5 93f5a3da2cfd2a7e810bad400d7739de
SHA1 a1f81ed5c7ec8d7f3e6f0bc16c8bf46985f8df24
SHA512 684af3ed0d5cdc30373fa4c336946d1bf1f42cd1ad152158a631a0e51c921786a2c9229c8db4d846e3914be4cc97db15eaa6fc29c093368ddc2965322e9ec4d3
SSDEEP 12288:62oLFHrKbWpfjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:6CWpfjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A155125177CD81FAE55616B202A8E72D5037FA362B3008D7B7616C6BAF752E04C3A393
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0a1d706926c1a68dae46b536d06aae968ab5bbc454ad06f8afdcc1ad4a7cb7ae

File Explorer

0a1d706926c1a68dae46b536d06aae968ab5bbc454ad06f8afdcc1ad4a7cb7ae

.exe 1.3MB

0a1d706926c1a68dae46b536d06aae968ab5bbc454ad06f8afdcc1ad4a7cb7ae

IMPHASH f660ec42e005239fa61b0e0c4a9735d8
SHA256 0a1d706926c1a68dae46b536d06aae968ab5bbc454ad06f8afdcc1ad4a7cb7ae
MD5 93f5a3da2cfd2a7e810bad400d7739de
SHA1 a1f81ed5c7ec8d7f3e6f0bc16c8bf46985f8df24
SHA512 684af3ed0d5cdc30373fa4c336946d1bf1f42cd1ad152158a631a0e51c921786a2c9229c8db4d846e3914be4cc97db15eaa6fc29c093368ddc2965322e9ec4d3
SSDEEP 12288:62oLFHrKbWpfjXc3ajG+hjQKymY8efKCpD7Gj9G6G1qT8nQkCu83L3Wl/np9DBDR:6CWpfjsqjnhMgeiCl7G0nehbGZpbD
TLSH
T1A155125177CD81FAE55616B202A8E72D5037FA362B3008D7B7616C6BAF752E04C3A393
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

66043

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\DistributedAutoLink\Temp\CompileOutputDir\RavService.pdb

wtsapi32

WTSEnumerateSessionsW WTSFreeMemory WTSQueryUserToken

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

kernel32

LocalFileTimeToFileTime CreateProcessW OutputDebugStringW GlobalAlloc GetLastError GlobalFree GetProcessId CloseHandle GetVersion GetFileSize SetFilePointer VirtualQuery WriteFile InitializeCriticalSection CopyFileW LeaveCriticalSection GetModuleFileNameW CreateFileW EnterCriticalSection DeleteCriticalSection DeleteFileW GetCurrentProcessId LockResource LoadLibraryW GetProcAddress lstrcatW lstrcpyW FindFirstFileW FindFirstChangeNotificationW SetWaitableTimer GetCurrentProcess CancelWaitableTimer FindCloseChangeNotification SetEvent GetModuleHandleW GetTickCount Sleep WritePrivateProfileStringW FindClose CreateEventW FindNextChangeNotification WaitForMultipleObjects CreateWaitableTimerW GetVersionExW lstrcmpiW GetLocalTime GetPrivateProfileIntW lstrlenW MultiByteToWideChar SizeofResource WideCharToMultiByte GetPrivateProfileStringW HeapReAlloc SystemTimeToFileTime LoadResource FindResourceW FindResourceExW IsDebuggerPresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime HeapAlloc HeapFree FreeLibrary SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess GetStartupInfoW InterlockedCompareExchange InterlockedExchange GetProcessHeap HeapSize HeapDestroy RaiseException

advapi32

FreeSid SetServiceStatus RegisterServiceCtrlHandlerExW StartServiceCtrlDispatcherW RegCloseKey RegOpenKeyExW RevertToSelf RegDeleteValueW ImpersonateLoggedOnUser RegQueryValueExW OpenProcessToken AllocateAndInitializeSid DuplicateTokenEx LookupAccountSidW SetTokenInformation CreateProcessAsUserW EqualSid GetTokenInformation

shell32

SHGetFolderPathW

shlwapi

PathRemoveFileSpecW PathFileExistsW PathAppendW

msvcp90

?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z ?end@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE?AV?$_String_iterator@DU?$char_traits@D@std@@V?$allocator@D@2@@2@XZ ??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z ??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@PBD@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z ??$?8DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z ??$?6DU?$char_traits@D@std@@V?$allocator@D@1@@std@@YAAAV?$basic_ostream@DU?$char_traits@D@std@@@0@AAV10@ABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@@Z ?npos@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@2IB ?uncaught_exception@std@@YA_NXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHPBDH@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEXXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z ?reserve@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEXI@Z ??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z ??4?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ?peek@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ ?at@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAADI@Z ??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@ABV01@@Z ?append@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV12@PBDI@Z

msvcr90

_wcsicmp _mktime64 _vscwprintf ?what@exception@std@@UBEPBDXZ ??1exception@std@@UAE@XZ ??0exception@std@@QAE@XZ ??0exception@std@@QAE@ABQBD@Z ??0exception@std@@QAE@ABV01@@Z _itoa_s _wtoi _localtime64_s wcsnlen atoi vswprintf_s _invalid_parameter_noinfo ??_V@YAXPAX@Z rand strcpy_s memcpy_s iswspace wcsspn wcscspn strncpy_s _time64 ??2@YAPAXI@Z wcscpy_s _snwprintf wcsncpy wcsncat wcsrchr _vsnwprintf _purecall swprintf_s free malloc srand __wargv __argc fputc _vsnprintf_s fputs fopen fread fprintf ftell fseek fclose strncmp isspace strchr isalnum tolower isalpha memset ?terminate@@YAXXZ _unlock __dllonexit _encode_pointer _lock _onexit _decode_pointer _amsg_exit __wgetmainargs _cexit _exit _XcptFilter exit _wcmdln _initterm _initterm_e _configthreadlocale __setusermatherr _adjust_fdiv __p__commode __p__fmode __set_app_type _except_handler4_common _crt_debugger_hook ?_type_info_dtor_internal_method@type_info@@QAEXXZ _invoke_watson _controlfp_s ??3@YAXPAX@Z memcpy __CxxFrameHandler3 _CxxThrowException memmove_s

Sharing

General

Malware Config

Signatures

File Explorer

0a1d706926c1a68dae46b536d06aae968ab5bbc454ad06f8afdcc1ad4a7cb7ae

wtsapi32

userenv

kernel32

advapi32

shell32

shlwapi

msvcp90

msvcr90

generic