6c35403247d2c02dbefff27b2c850eb66ca0d4f98a946a7ade58045c44bb0fd6

General

Target
6c35403247d2c02dbefff27b2c850eb66ca0d4f98a946a7ade58045c44bb0fd6
Size 3.5MB
Sample260715-drwrdsdv81
SHA256 6c35403247d2c02dbefff27b2c850eb66ca0d4f98a946a7ade58045c44bb0fd6
MD5 4aff7a816791051ca927aebcf0847276
SHA1 a38e5e4aac05339714d11d6f7fbc937560414f56
SHA512 8c34e72e899c4bacb5d6328d51ff869ff64d3d4ce014127aaa5e64dd08feb94f581c179a8e2c22f2a94491b7bacadeb6b24889a9fbf379dcdd239bd25904464b
SSDEEP 24576:EB0177ZaBfMwcicCXja4ZzxA1zntNF1RNiDsTOPTOPTnr0oH5e37nm7C5:E+GfMdqvdAxntN/x0ksnms
TLSH
T167066B01FF5605A7C89EC33894AF861AFB35F4994B6197DB13682525BE6B3D02E3B310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6c35403247d2c02dbefff27b2c850eb66ca0d4f98a946a7ade58045c44bb0fd6

File Explorer

6c35403247d2c02dbefff27b2c850eb66ca0d4f98a946a7ade58045c44bb0fd6

.exe 3.5MB

6c35403247d2c02dbefff27b2c850eb66ca0d4f98a946a7ade58045c44bb0fd6

IMPHASH c721d4736919649fb6fdb113bf459257
SHA256 6c35403247d2c02dbefff27b2c850eb66ca0d4f98a946a7ade58045c44bb0fd6
MD5 4aff7a816791051ca927aebcf0847276
SHA1 a38e5e4aac05339714d11d6f7fbc937560414f56
SHA512 8c34e72e899c4bacb5d6328d51ff869ff64d3d4ce014127aaa5e64dd08feb94f581c179a8e2c22f2a94491b7bacadeb6b24889a9fbf379dcdd239bd25904464b
SSDEEP 24576:EB0177ZaBfMwcicCXja4ZzxA1zntNF1RNiDsTOPTOPTnr0oH5e37nm7C5:E+GfMdqvdAxntN/x0ksnms
TLSH
T167066B01FF5605A7C89EC33894AF861AFB35F4994B6197DB13682525BE6B3D02E3B310
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

65872

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\src\RiptermsGhost-master\Injector\x64\Release\Nono.pdb

kernel32

GetTempPathW WaitForSingleObject CreateFileW GetFileAttributesW OpenProcess CreateToolhelp32Snapshot GetExitCodeThread GetTickCount64 GetLastError Process32NextW LockResource Process32FirstW CloseHandle LoadResource WriteFile GetProcAddress VirtualAllocEx GetModuleHandleW CreateRemoteThread VirtualFreeEx SetConsoleTitleW IsWow64Process WriteConsoleW HeapSize ReadConsoleW GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW FindNextFileW GetCurrentProcess WriteProcessMemory FindResourceW SizeofResource MultiByteToWideChar GetStringTypeW WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent GetStdHandle GetModuleFileNameW ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapFree VirtualProtect LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType SetStdHandle IsValidCodePage GetACP GetOEMCP GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile HeapReAlloc FindClose FindFirstFileExW RtlUnwind

user32

GetWindow IsWindowVisible EnumWindows GetWindowTextW GetWindowTextLengthW GetWindowThreadProcessId

advapi32

AdjustTokenPrivileges OpenProcessToken LookupPrivilegeValueW

Name

.text

Size

193KB

Virtual Size

193KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

81KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3.2MB

Virtual Size

3.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

6c35403247d2c02dbefff27b2c850eb66ca0d4f98a946a7ade58045c44bb0fd6

kernel32

user32

advapi32

generic