fc1ce4e62c477226eab31f40639c779c9d627944fd0fbd35ab20cfb24f2c1ecf

Sharing

Copy URL Twitter E-mail

General

Target
fc1ce4e62c477226eab31f40639c779c9d627944fd0fbd35ab20cfb24f2c1ecf
Size 810KB
Sample260718-tefgmsat6v
SHA256 fc1ce4e62c477226eab31f40639c779c9d627944fd0fbd35ab20cfb24f2c1ecf
MD5 d665539de5a18b67cc15b90643950768
SHA1 0ddb845daa6631ec4b31251d28f601eb335be137
SHA512 3ac814aed29258b90b74395d54b9a2643423052bbb17b27eb893b6de50cedec15ea97cebcb33ce0e6afea2e4444b64649b2add01fa41cc746a51576c2c85ca5d
SSDEEP 12288:3MBYajqJAh1wgY65vaAxIVMhkOsem+zj+GtEUj7QSSVOD:3AhwgY65yAEMhkOsemG6it76
TLSH
T14A050821BA565AADD056C435C3568AB26A3138CF0B35A9FF00E961383F6D9F61F7C318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fc1ce4e62c477226eab31f40639c779c9d627944fd0fbd35ab20cfb24f2c1ecf

File Explorer

fc1ce4e62c477226eab31f40639c779c9d627944fd0fbd35ab20cfb24f2c1ecf

.exe 810KB

fc1ce4e62c477226eab31f40639c779c9d627944fd0fbd35ab20cfb24f2c1ecf

IMPHASH a54e8bd04f69ed197b8f03934e432ea2
SHA256 fc1ce4e62c477226eab31f40639c779c9d627944fd0fbd35ab20cfb24f2c1ecf
MD5 d665539de5a18b67cc15b90643950768
SHA1 0ddb845daa6631ec4b31251d28f601eb335be137
SHA512 3ac814aed29258b90b74395d54b9a2643423052bbb17b27eb893b6de50cedec15ea97cebcb33ce0e6afea2e4444b64649b2add01fa41cc746a51576c2c85ca5d
SSDEEP 12288:3MBYajqJAh1wgY65vaAxIVMhkOsem+zj+GtEUj7QSSVOD:3AhwgY65yAEMhkOsemG6it76
TLSH
T14A050821BA565AADD056C435C3568AB26A3138CF0B35A9FF00E961383F6D9F61F7C318
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

523376

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

pillowtome-dcd492a1860b6f76.pdb

ntdll

NtCreateNamedPipeFile NtOpenFile NtWriteFile NtReadFile RtlNtStatusToDosError

kernel32

WaitForMultipleObjects InitializeSListHead GetFileAttributesW GetProcAddress CloseHandle GetConsoleOutputCP GetModuleHandleA WriteConsoleW MultiByteToWideChar GetModuleFileNameW IsProcessorFeaturePresent GetCurrentThreadId GetLastError ReleaseMutex CreateMutexA WaitForSingleObjectEx WideCharToMultiByte SwitchToThread GetSystemInfo ExitProcess FindClose FindFirstFileExW GetCommandLineW GetEnvironmentVariableW GetCurrentDirectoryW GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler SetFilePointerEx LoadLibraryA GetExitCodeProcess GetFinalPathNameByHandleW GetModuleHandleW CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW GetEnvironmentStringsW GetFileInformationByHandleEx CancelIo GetSystemTimePreciseAsFileTime GetProcessHeap HeapFree HeapAlloc FormatMessageW RtlVirtualUnwind RtlLookupFunctionEntry IsDebuggerPresent lstrlenW GetSystemTimeAsFileTime GetFileInformationByHandle GetConsoleScreenBufferInfo SetConsoleTextAttribute GetConsoleMode UnhandledExceptionFilter GetFileType GetStdHandle CompareStringOrdinal FreeEnvironmentStringsW RtlCaptureContext DuplicateHandle WaitForSingleObject GetCurrentProcess WriteFileEx SleepEx SetLastError GetFullPathNameW SetFileInformationByHandle CreateFileW SetFileTime HeapReAlloc QueryPerformanceFrequency QueryPerformanceCounter GetOverlappedResult ReadFile ReadFileEx GetCurrentProcessId CreateEventW CreateThread SetUnhandledExceptionFilter

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

bcryptprimitives

ProcessPrng

userenv

GetUserProfileDirectoryW

vcruntime140

memcmp __C_specific_handler __current_exception_context __current_exception __CxxFrameHandler3 memcpy memmove memset _CxxThrowException

api-ms-win-crt-math-l1-1-0

floor fmod __setusermatherr

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _crt_atexit _initialize_onexit_table _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv __p___argc terminate _exit exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _set_app_type _seh_filter_exe

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

fc1ce4e62c477226eab31f40639c779c9d627944fd0fbd35ab20cfb24f2c1ecf

ntdll

kernel32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

userenv

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic