7b16382c24a5fdfa20c22ba76f483b6c840ace2cc0fc1e7934a37b67adc54627

Sharing

Copy URL Twitter E-mail

General

Target
7b16382c24a5fdfa20c22ba76f483b6c840ace2cc0fc1e7934a37b67adc54627
Size 652KB
Sample260718-v1devabz5w
SHA256 7b16382c24a5fdfa20c22ba76f483b6c840ace2cc0fc1e7934a37b67adc54627
MD5 6ef6c69fa1b924a2a2dcdb72926c22d1
SHA1 b6f3a37a1d9a12bea3a1548bea256067d9369b7b
SHA512 fb0e337c787f10b3a119d10c753875c3a3332c97511412cd0fe17430d38538cf8ab376dd2c8044412b482f70fc4f566e7532be43865cc85308f84a6b3e0e938a
SSDEEP 6144:BfDKo6eWOkROP5xRhgr+3d1R4CvucmD2KMqaHZpq+KGr7uWK32ZYr21u:dKoClOzgrKd1R4KfU2Bq4ZrQ32aq1u
TLSH
T110E49F6177E412EAD1B7D13E8AD68F6AF6B2B8150720D7C701D442592F2BAE84E3F311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7b16382c24a5fdfa20c22ba76f483b6c840ace2cc0fc1e7934a37b67adc54627

File Explorer

7b16382c24a5fdfa20c22ba76f483b6c840ace2cc0fc1e7934a37b67adc54627

.exe 652KB

7b16382c24a5fdfa20c22ba76f483b6c840ace2cc0fc1e7934a37b67adc54627

IMPHASH 3eda90cc2a587ef176f1f8004e71ff03
SHA256 7b16382c24a5fdfa20c22ba76f483b6c840ace2cc0fc1e7934a37b67adc54627
MD5 6ef6c69fa1b924a2a2dcdb72926c22d1
SHA1 b6f3a37a1d9a12bea3a1548bea256067d9369b7b
SHA512 fb0e337c787f10b3a119d10c753875c3a3332c97511412cd0fe17430d38538cf8ab376dd2c8044412b482f70fc4f566e7532be43865cc85308f84a6b3e0e938a
SSDEEP 6144:BfDKo6eWOkROP5xRhgr+3d1R4CvucmD2KMqaHZpq+KGr7uWK32ZYr21u:dKoClOzgrKd1R4KfU2Bq4ZrQ32aq1u
TLSH
T110E49F6177E412EAD1B7D13E8AD68F6AF6B2B8150720D7C701D442592F2BAE84E3F311
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11841

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\15201\OneDrive\桌面\MalwareAnalysis实验\02_dynamic\dynamic.pdb

kernel32

FreeLibrary GetProcAddress LoadLibraryA QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW WriteConsoleW RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess GetModuleHandleExW GetCommandLineA GetCommandLineW GetCurrentThread OutputDebugStringW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetTempPathW FlsAlloc FlsGetValue FlsSetValue FlsFree IsThreadAFiber InitializeCriticalSectionEx VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetProcessHeap SetConsoleCtrlHandler HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx ReadFile ReadConsoleW CreateFileW CloseHandle RtlUnwind

Name

.text

Size

524KB

Virtual Size

523KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

91KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

1024B

Virtual Size

563B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

7b16382c24a5fdfa20c22ba76f483b6c840ace2cc0fc1e7934a37b67adc54627

kernel32

generic