4b57e82da0528dbcd71a8fd60535da114af063ca736caa4bc18cad44e3c500cb

Sharing

Copy URL Twitter E-mail

General

Target
4b57e82da0528dbcd71a8fd60535da114af063ca736caa4bc18cad44e3c500cb
Size 54KB
Sample260713-e32bpaby8q
SHA256 4b57e82da0528dbcd71a8fd60535da114af063ca736caa4bc18cad44e3c500cb
MD5 60fe7a6878effb9160475e88976fd619
SHA1 d178847f32ea482a028611904f658ebe704d4866
SHA512 6e32b776a67078e14da5ffa797bc46e3c547d8e79bbb99466388c7f23653fafca8dea78b4183a0dc10d119df382afcc9cf47d91c931221da0d4fa3bfabb168e5
SSDEEP 768:2Kccyp+Ad8zD8/VNWRmXLI/KYaY1Zw7K3cw:2K3A2/8ltfNw
TLSH
T1B143FA26DE1A50AFD35E8D74D9035A02DF32BCC647D2A5CFA7910DE20D659E4AF3A202
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4b57e82da0528dbcd71a8fd60535da114af063ca736caa4bc18cad44e3c500cb

File Explorer

4b57e82da0528dbcd71a8fd60535da114af063ca736caa4bc18cad44e3c500cb

.exe 54KB

4b57e82da0528dbcd71a8fd60535da114af063ca736caa4bc18cad44e3c500cb

IMPHASH cddea00172fa8141499d61800ec87f7e
SHA256 4b57e82da0528dbcd71a8fd60535da114af063ca736caa4bc18cad44e3c500cb
MD5 60fe7a6878effb9160475e88976fd619
SHA1 d178847f32ea482a028611904f658ebe704d4866
SHA512 6e32b776a67078e14da5ffa797bc46e3c547d8e79bbb99466388c7f23653fafca8dea78b4183a0dc10d119df382afcc9cf47d91c931221da0d4fa3bfabb168e5
SSDEEP 768:2Kccyp+Ad8zD8/VNWRmXLI/KYaY1Zw7K3cw:2K3A2/8ltfNw
TLSH
T1B143FA26DE1A50AFD35E8D74D9035A02DF32BCC647D2A5CFA7910DE20D659E4AF3A202
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

28224

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Jacky\source\repos\Poc\x64\Release\trident.pdb

msvcp140

??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??Bios_base@std@@QEBA_NXZ ?_Xout_of_range@std@@YAXPEBD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z

ws2_32

setsockopt closesocket inet_pton WSAStartup send socket connect recv htons WSACleanup

rpcrt4

RpcBindingFree RpcMgmtEpEltInqNextA RpcMgmtEpEltInqDone RpcStringFreeA RpcBindingFromStringBindingA RpcMgmtEpEltInqBegin

dnsapi

DnsFree DnsQuery_A

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcpy memset memcmp _CxxThrowException __current_exception __current_exception_context memchr __std_terminate __std_exception_copy __std_exception_destroy __C_specific_handler memmove

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf __stdio_common_vsprintf_s __acrt_iob_func _set_fmode __stdio_common_vsprintf __p__commode

api-ms-win-crt-convert-l1-1-0

atoi

api-ms-win-crt-string-l1-1-0

isspace

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _register_onexit_function __p___argv _cexit terminate _initialize_narrow_environment __p___argc _configure_narrow_argv _get_initial_narrow_environment _c_exit exit _register_thread_local_exe_atexit_callback _set_app_type _seh_filter_exe _initterm _invalid_parameter_noinfo_noreturn _exit _crt_atexit _initterm_e

api-ms-win-crt-heap-l1-1-0

malloc _callnewh free _set_new_mode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

kernel32

SetUnhandledExceptionFilter GetCurrentProcess UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry GetModuleHandleW TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent RtlCaptureContext

Sharing

General

Malware Config

Signatures

File Explorer

4b57e82da0528dbcd71a8fd60535da114af063ca736caa4bc18cad44e3c500cb

msvcp140

ws2_32

rpcrt4

dnsapi

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

kernel32

generic