4c493bee99ea9189119a97cadc75f8d5b084616181484761011099d324d1887e

Sharing

Copy URL Twitter E-mail

General

Target
4c493bee99ea9189119a97cadc75f8d5b084616181484761011099d324d1887e
Size 1.3MB
Sample260716-ctfbraex2z
SHA256 4c493bee99ea9189119a97cadc75f8d5b084616181484761011099d324d1887e
MD5 c915f779799252700766c2dc12480090
SHA1 f5732ff8b3317cdf0b03f6b7e53585fdc1f68acd
SHA512 92d79fb6036c5065eb3ae0810c3492fa3cd03a3ee3fd365d6fe555e966d45e829833295c3ef064930d9a1b9ed1f527dbe44cb6ed2555e4e0437ad7cfed281029
SSDEEP 12288:ozZJdEY9EnYEMKTK6olfdLLvJvTG0JgWINthQQ/Kp3LslYgy7o5E:qNEY9EnYE76lFzSELzT7V
TLSH
T14355032166E8CFD4C06F6135DC56B1F4A263AD01CE209FDF3E94BE1A3972295A93520F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4c493bee99ea9189119a97cadc75f8d5b084616181484761011099d324d1887e

File Explorer

4c493bee99ea9189119a97cadc75f8d5b084616181484761011099d324d1887e

.exe 1.3MB

4c493bee99ea9189119a97cadc75f8d5b084616181484761011099d324d1887e

IMPHASH 54e5db29da13354fb5538b2325863c7e
SHA256 4c493bee99ea9189119a97cadc75f8d5b084616181484761011099d324d1887e
MD5 c915f779799252700766c2dc12480090
SHA1 f5732ff8b3317cdf0b03f6b7e53585fdc1f68acd
SHA512 92d79fb6036c5065eb3ae0810c3492fa3cd03a3ee3fd365d6fe555e966d45e829833295c3ef064930d9a1b9ed1f527dbe44cb6ed2555e4e0437ad7cfed281029
SSDEEP 12288:ozZJdEY9EnYEMKTK6olfdLLvJvTG0JgWINthQQ/Kp3LslYgy7o5E:qNEY9EnYE76lFzSELzT7V
TLSH
T14355032166E8CFD4C06F6135DC56B1F4A263AD01CE209FDF3E94BE1A3972295A93520F
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

49712

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptOpenAlgorithmProvider BCryptGenerateSymmetricKey BCryptDecrypt BCryptDestroyKey BCryptCloseAlgorithmProvider

mscoree

CLRCreateInstance

shell32

SHGetSpecialFolderLocation SHGetFolderPathW SHGetPathFromIDListW

advapi32

RegQueryValueExA RegOpenKeyExA RegCreateKeyExA RegCloseKey RegSetValueExA

kernel32

GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW HeapReAlloc GetTimeZoneInformation ReadConsoleW SetFilePointerEx SetStdHandle HeapSize WriteConsoleW GetACP CreateFileW DeleteFileW FindClose FindFirstFileW FindNextFileW GetLastError GetCurrentProcessId TerminateProcess OpenProcess VirtualProtect FreeLibrary GetModuleHandleA GetModuleHandleW GetProcAddress LoadLibraryA LoadLibraryW GetFileSizeEx ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW HeapFree HeapAlloc MultiByteToWideChar WideCharToMultiByte LocalFree GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx RtlUnwind GetCPInfo CloseHandle InitializeCriticalSectionAndSpinCount SetEvent ResetEvent WaitForSingleObjectEx CreateEventW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetCurrentProcess RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile

oleaut32

VariantClear SafeArrayCreateVector SafeArrayUnaccessData SafeArrayAccessData SafeArrayCreate

Name

.text

Size

192KB

Virtual Size

191KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

488KB

Virtual Size

487KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

661KB

Virtual Size

664KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

4c493bee99ea9189119a97cadc75f8d5b084616181484761011099d324d1887e

bcrypt

mscoree

shell32

advapi32

kernel32

oleaut32

generic