tmp9xx191cc

Sharing

Copy URL Twitter E-mail

General

Target
tmp9xx191cc
Size 3.5MB
Sample260710-rt67ssbs6m
SHA256 f57d00c4b273dcd3b8d5fa73c63d26a861dba2d4d240c555c8e78c928a24f4a2
MD5 7740f8a2a0353a6973eb98d883f426d4
SHA1 37a33fc1463b4568bc7783d629a64d02bb2d40ba
SHA512 b87862da5438dd0fce29252504fbf79cac0ad049ca2f3ed86f74121f6eaca782f5d2acae32b4f526478319b12c9fa929857cd51c61ebc5443e864b35fd2e127d
SSDEEP 49152:vi+RGR+18/UhF1BBFWE5XHkob6SNwRDe2Ij+DJ1vknJADm3VJmc/py9QW5iKG11k:BB35jLKm3VI9Q0jhv
TLSH
T17A066C70D351B065D1A7C430CED60EF464A1703B52366D1F1BC5E82A25FBEA1ABAD3A3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
tmp9xx191cc

File Explorer

tmp9xx191cc

.exe 3.5MB

IMPHASH 52fc4cd1f0148f6789c566674a94e859
SHA256 f57d00c4b273dcd3b8d5fa73c63d26a861dba2d4d240c555c8e78c928a24f4a2
MD5 7740f8a2a0353a6973eb98d883f426d4
SHA1 37a33fc1463b4568bc7783d629a64d02bb2d40ba
SHA512 b87862da5438dd0fce29252504fbf79cac0ad049ca2f3ed86f74121f6eaca782f5d2acae32b4f526478319b12c9fa929857cd51c61ebc5443e864b35fd2e127d
SSDEEP 49152:vi+RGR+18/UhF1BBFWE5XHkob6SNwRDe2Ij+DJ1vknJADm3VJmc/py9QW5iKG11k:BB35jLKm3VI9Q0jhv
TLSH
T17A066C70D351B065D1A7C430CED60EF464A1703B52366D1F1BC5E82A25FBEA1ABAD3A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

403532

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

RegCloseKey RegEnumKeyExW RegOpenKeyExW RegQueryValueExW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW

bcrypt

BCryptGenRandom

kernel32

RtlUnwind TlsFree RaiseFailFastException GetTickCount64 GetProcAddress InitializeConditionVariable WakeConditionVariable CloseThreadpoolIo InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection FileTimeToSystemTime GetLastError GetConsoleOutputCP GetCPInfo GetCurrentProcess GetStdHandle GetSystemTime LocalAlloc LocalFree QueryPerformanceCounter QueryPerformanceFrequency SetLastError SystemTimeToFileTime WaitForMultipleObjectsEx WaitForSingleObject GetCurrentThread TzSpecificLocalTimeToSystemTime WideCharToMultiByte Sleep SleepConditionVariableCS CreateFileW CreateThreadpoolIo StartThreadpoolIo CancelThreadpoolIo DeleteFileW DeviceIoControl ExpandEnvironmentStringsW FreeLibrary GetFileInformationByHandleEx GetFileType GetFullPathNameW GetLongPathNameW GetModuleFileNameW GetOverlappedResult LoadLibraryExW SetFileInformationByHandle SetThreadErrorMode CreateThread ResumeThread DuplicateHandle GetThreadPriority SetThreadPriority GetDynamicTimeZoneInformation GetTimeZoneInformation WriteFile GetCurrentProcessorNumberEx CloseHandle SetEvent CreateEventExW GetEnvironmentVariableW FormatMessageW FreeConsole GetModuleHandleA LoadLibraryA FlushProcessWriteBuffers WaitForSingleObjectEx RtlVirtualUnwind RtlCaptureContext RtlRestoreContext AddVectoredExceptionHandler FlsAlloc FlsGetValue FlsSetValue CreateEventW TerminateProcess SwitchToThread GetCurrentThreadId SuspendThread GetThreadContext SetThreadContext FlushInstructionCache VirtualAlloc VirtualProtect VirtualFree QueryInformationJobObject GetModuleHandleW GetModuleHandleExW GetProcessAffinityMask InitializeContext GetEnabledXStateFeatures SetXStateFeaturesMask VirtualQuery InitializeCriticalSectionEx GetSystemTimeAsFileTime ResetEvent DebugBreak SleepEx GlobalMemoryStatusEx GetSystemInfo GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer RaiseException RtlPcToFileHeader RtlUnwindEx IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlLookupFunctionEntry InitializeSListHead GetCurrentProcessId

ole32

CoWaitForMultipleHandles CoUninitialize CoGetApartmentType CoInitializeEx

api-ms-win-crt-math-l1-1-0

modf sqrt pow ceil __setusermatherr

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc _callnewh free malloc

api-ms-win-crt-string-l1-1-0

strlen _stricmp wcsncmp strcpy_s strcmp

api-ms-win-crt-convert-l1-1-0

strtoull

vcruntime140

_purecall memmove memset memcpy

api-ms-win-crt-runtime-l1-1-0

abort terminate _crt_atexit _seh_filter_exe _register_onexit_function _configure_wide_argv _initialize_wide_environment _get_initial_wide_environment _initterm _initterm_e exit _exit _initialize_onexit_table __p___argc __p___wargv _cexit _c_exit _register_thread_local_exe_atexit_callback _set_app_type

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

409KB

Virtual Size

409KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.managed

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

hydrated

Size

Virtual Size

342KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

108KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

tmp9xx191cc

advapi32

bcrypt

kernel32

ole32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic