6f033f5a97b2402e02564cc1b897919463afbe53b4c77b16e79599dd91c1b917

Sharing

Copy URL Twitter E-mail

General

Target
6f033f5a97b2402e02564cc1b897919463afbe53b4c77b16e79599dd91c1b917
Size 25KB
Sample260714-ragg2aes2k
SHA256 6f033f5a97b2402e02564cc1b897919463afbe53b4c77b16e79599dd91c1b917
MD5 9aabc53d7f2e3434b3e4240ec87e74a7
SHA1 10fb5abc5597d6abefc849516c22abaf83bc3ab2
SHA512 d364b9917defdac5721172de0e90298027bc970f1c378f445659b7c062fdf993aa710717d73f55ab2999925d7bb66a64e2ee4749319419ca6d7a5ed329672e18
SSDEEP 384:ScysZbUE1eGeJGNbXXXiUol2YbwodpYasDwDmoihxx:tlZNoLGNLnkfw4p2qFwx
TLSH
T101C2D83E720244F8E609CD3C89F60E7565B2B502F2121A1D2568F2E55FFD720DE3D5A9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6f033f5a97b2402e02564cc1b897919463afbe53b4c77b16e79599dd91c1b917

File Explorer

6f033f5a97b2402e02564cc1b897919463afbe53b4c77b16e79599dd91c1b917

.exe 25KB

6f033f5a97b2402e02564cc1b897919463afbe53b4c77b16e79599dd91c1b917

IMPHASH 991c8776665615711c6c997be4ac923b
SHA256 6f033f5a97b2402e02564cc1b897919463afbe53b4c77b16e79599dd91c1b917
MD5 9aabc53d7f2e3434b3e4240ec87e74a7
SHA1 10fb5abc5597d6abefc849516c22abaf83bc3ab2
SHA512 d364b9917defdac5721172de0e90298027bc970f1c378f445659b7c062fdf993aa710717d73f55ab2999925d7bb66a64e2ee4749319419ca6d7a5ed329672e18
SSDEEP 384:ScysZbUE1eGeJGNbXXXiUol2YbwodpYasDwDmoihxx:tlZNoLGNLnkfw4p2qFwx
TLSH
T101C2D83E720244F8E609CD3C89F60E7565B2B502F2121A1D2568F2E55FFD720DE3D5A9
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5104

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

AddVectoredExceptionHandler CloseHandle CreateProcessA CreateRemoteThread DeleteCriticalSection EnterCriticalSection GetConsoleMode GetCurrentThread GetExitCodeProcess GetExitCodeThread GetFileAttributesA GetLastError GetModuleFileNameA GetModuleHandleW GetProcAddress GetStdHandle GetThreadContext InitializeCriticalSection LeaveCriticalSection LoadLibraryA RemoveVectoredExceptionHandler ResumeThread SetConsoleCP SetConsoleMode SetConsoleOutputCP SetThreadContext SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue VirtualAllocEx VirtualFreeEx VirtualProtect VirtualQuery WaitForSingleObject WriteProcessMemory

api-ms-win-crt-environment-l1-1-0

__p__environ __p__wenviron

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-private-l1-1-0

__C_specific_handler memcpy strrchr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv __p___wargv _cexit _configure_narrow_argv _configure_wide_argv _crt_at_quick_exit _crt_atexit _exit _initialize_narrow_environment _initialize_wide_environment _initterm _set_app_type _set_invalid_parameter_handler abort exit signal system

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vfwprintf fwrite getchar puts

api-ms-win-crt-string-l1-1-0

memset strcat strcmp strlen strncmp strncpy

api-ms-win-crt-time-l1-1-0

__daylight __timezone __tzname _tzset

Name

.text

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1024B

Virtual Size

732B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1024B

Virtual Size

584B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

768B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

144B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

6f033f5a97b2402e02564cc1b897919463afbe53b4c77b16e79599dd91c1b917

kernel32

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

generic