dc791ebc23954c0bb94496d85c5abbc28b9f9afe7337d2e1b0dd07d8f94dc957

Sharing

Copy URL Twitter E-mail

General

Target
dc791ebc23954c0bb94496d85c5abbc28b9f9afe7337d2e1b0dd07d8f94dc957
Size 61KB
Sample260709-nc84aaht5k
SHA256 dc791ebc23954c0bb94496d85c5abbc28b9f9afe7337d2e1b0dd07d8f94dc957
MD5 6c5b8a6034d912d3a576f5d08ed224b6
SHA1 ce84b5f14ffdbaa4e0968670ae464b3070899cb8
SHA512 20b5aa80bd5704c852ec762dcb53d84347e4ab45de588090274305125012a5d74c69318d2a1e8bc0da1f2d585910d2fceb1d7327916d3217a6b84c186563fd5f
SSDEEP 384:J3OqlsE8zaZ5n5qvq9RrseTIlZy2DfsO4IHkj6xZnUHkXpSTQfBFOtnUVuAy9Xu:NlN8uXBMfy2r7HZtCkXpSKB0DAy9
TLSH
T14A53E64F779960F7D87AC17A99925228B7B070A013325BCB110949395FB27F83D3E399
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dc791ebc23954c0bb94496d85c5abbc28b9f9afe7337d2e1b0dd07d8f94dc957

File Explorer

dc791ebc23954c0bb94496d85c5abbc28b9f9afe7337d2e1b0dd07d8f94dc957

.exe 61KB

dc791ebc23954c0bb94496d85c5abbc28b9f9afe7337d2e1b0dd07d8f94dc957

IMPHASH de3b4dbf4fc220a971b67aeb74a8bc87
SHA256 dc791ebc23954c0bb94496d85c5abbc28b9f9afe7337d2e1b0dd07d8f94dc957
MD5 6c5b8a6034d912d3a576f5d08ed224b6
SHA1 ce84b5f14ffdbaa4e0968670ae464b3070899cb8
SHA512 20b5aa80bd5704c852ec762dcb53d84347e4ab45de588090274305125012a5d74c69318d2a1e8bc0da1f2d585910d2fceb1d7327916d3217a6b84c186563fd5f
SSDEEP 384:J3OqlsE8zaZ5n5qvq9RrseTIlZy2DfsO4IHkj6xZnUHkXpSTQfBFOtnUVuAy9Xu:NlN8uXBMfy2r7HZtCkXpSKB0DAy9
TLSH
T14A53E64F779960F7D87AC17A99925228B7B070A013325BCB110949395FB27F83D3E399
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

70262

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Fiona\Desktop\api_sensitive_dynamic\x64\Debug\api_sensitive_dynamic.pdb

kernel32

GetProcAddress LoadLibraryA IsDebuggerPresent RaiseException MultiByteToWideChar WideCharToMultiByte RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter FreeLibrary VirtualQuery GetProcessHeap HeapFree HeapAlloc GetLastError GetModuleHandleW GetStartupInfoW InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess GetCurrentProcess GetCurrentThreadId

vcruntime140d

__current_exception_context __vcrt_GetModuleHandleW __std_type_info_destroy_list __C_specific_handler_noexcept __C_specific_handler __current_exception __vcrt_GetModuleFileNameW __vcrt_LoadLibraryExW memcpy

ucrtbased

_seh_filter_dll _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit _crt_at_quick_exit terminate _wmakepath_s _wsplitpath_s wcscpy_s strcat_s strcpy_s __p__commode _set_new_mode _configthreadlocale _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv __p___argc _set_fmode _exit exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv __setusermatherr _set_app_type _seh_filter_exe _CrtDbgReportW _CrtDbgReport __stdio_common_vfprintf __acrt_iob_func __stdio_common_vsprintf_s

Name

.textbss

Size

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

32KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

512B

Virtual Size

455B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

612B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

dc791ebc23954c0bb94496d85c5abbc28b9f9afe7337d2e1b0dd07d8f94dc957

kernel32

vcruntime140d

ucrtbased

generic