ab240a55cf148b8323b9b5c9128a543901ec8e2f91cf9a7981601810352f8df1

Sharing

Copy URL Twitter E-mail

General

Target
ab240a55cf148b8323b9b5c9128a543901ec8e2f91cf9a7981601810352f8df1
Size 1.6MB
Sample260719-3rdcgsbt7s
SHA256 ab240a55cf148b8323b9b5c9128a543901ec8e2f91cf9a7981601810352f8df1
MD5 46e0a518e28e98bb1a88b443c14472ef
SHA1 d45dd05f7e2d9c70d2c08ace4a9e14df20f94d13
SHA512 c5e8cc4af253c051578b1285c3b89a2bb686149a9ff936144785d7b985af36ef3ade2fa2f95299fc669e9038d6619aab6f7324a41a0dcc8a8fd0f9d8c822b3d8
SSDEEP 24576:Uoy3FRHejJ2oeUyuF6absLg7qJ7Qf2Tb5HaNny:UoUFde4ocuF6ysvQEb56Nny
TLSH
T15E756B03F6A584EEC45EC0B4C75A9637BB31BC8D0720B6AB5BD44A753E6AF902E1D344
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ab240a55cf148b8323b9b5c9128a543901ec8e2f91cf9a7981601810352f8df1

File Explorer

ab240a55cf148b8323b9b5c9128a543901ec8e2f91cf9a7981601810352f8df1

.exe 1.6MB

ab240a55cf148b8323b9b5c9128a543901ec8e2f91cf9a7981601810352f8df1

IMPHASH d5a2d36d48079e63c4a87f341a1be7a4
SHA256 ab240a55cf148b8323b9b5c9128a543901ec8e2f91cf9a7981601810352f8df1
MD5 46e0a518e28e98bb1a88b443c14472ef
SHA1 d45dd05f7e2d9c70d2c08ace4a9e14df20f94d13
SHA512 c5e8cc4af253c051578b1285c3b89a2bb686149a9ff936144785d7b985af36ef3ade2fa2f95299fc669e9038d6619aab6f7324a41a0dcc8a8fd0f9d8c822b3d8
SSDEEP 24576:Uoy3FRHejJ2oeUyuF6absLg7qJ7Qf2Tb5HaNny:UoUFde4ocuF6ysvQEb56Nny
TLSH
T15E756B03F6A584EEC45EC0B4C75A9637BB31BC8D0720B6AB5BD44A753E6AF902E1D344
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1088892

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

hello_world.pdb

kernel32

GetModuleHandleW GetProcAddress SetFileCompletionNotificationModes RtlUnwindEx SetLastError GetFinalPathNameByHandleW GetQueuedCompletionStatusEx SetUnhandledExceptionFilter SetHandleInformation GetCurrentDirectoryW RtlCaptureContext CreateIoCompletionPort WaitForSingleObjectEx LoadLibraryA GetCurrentProcess lstrlenW GetCurrentProcessId CreateMutexA ReleaseMutex RtlVirtualUnwind WideCharToMultiByte GetStdHandle GetConsoleMode GetConsoleOutputCP WaitForSingleObject UnhandledExceptionFilter WriteConsoleW TerminateProcess GetModuleHandleA QueryPerformanceFrequency GetTempPathW GetFullPathNameW CreateFileW SetFileInformationByHandle FindNextFileW CreateDirectoryW GetFileInformationByHandle GetFileInformationByHandleEx IsProcessorFeaturePresent EncodePointer RaiseException GetEnvironmentStringsW FreeEnvironmentStringsW CompareStringOrdinal GetSystemDirectoryW GetModuleFileNameW GetWindowsDirectoryW CreateProcessW GetFileAttributesW DuplicateHandle CreateNamedPipeW CreateThread WriteFileEx SleepEx ReadFileEx QueryPerformanceCounter PostQueuedCompletionStatus DeleteCriticalSection SwitchToThread MultiByteToWideChar HeapReAlloc GetCurrentThread GetCurrentThreadId SetThreadStackGuarantee AddVectoredExceptionHandler GetSystemTimePreciseAsFileTime InitializeCriticalSectionAndSpinCount GetSystemTimeAsFileTime InitializeSListHead GetGeoInfoA GetSystemInfo FindClose FindFirstFileExW CloseHandle GetEnvironmentVariableW IsDebuggerPresent TlsAlloc TlsGetValue LoadLibraryExA FormatMessageW GetLastError TlsSetValue TlsFree FreeLibrary LoadLibraryExW HeapAlloc HeapFree RtlLookupFunctionEntry GetProcessHeap RtlPcToFileHeader

oleaut32

SysStringLen SysFreeString

ntdll

NtDeviceIoControlFile NtCreateFile NtWriteFile RtlGetVersion RtlNtStatusToDosError NtCancelIoFileEx

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

user32

MessageBoxA

ws2_32

WSASocketW closesocket recv WSASend WSAIoctl ioctlsocket setsockopt getaddrinfo freeaddrinfo getsockname WSAGetLastError getpeername bind WSAStartup WSACleanup send shutdown connect getsockopt

crypt32

CertFreeCertificateContext CertCloseStore CertOpenStore CertDuplicateStore CertVerifyCertificateChainPolicy CertDuplicateCertificateContext CertGetCertificateChain CertEnumCertificatesInStore CertAddCertificateContextToStore CertDuplicateCertificateChain CertFreeCertificateChain

secur32

AcquireCredentialsHandleA FreeCredentialsHandle FreeContextBuffer ApplyControlToken EncryptMessage DecryptMessage DeleteSecurityContext InitializeSecurityContextW AcceptSecurityContext QueryContextAttributesW

advapi32

RegCreateKeyExW RegQueryValueExW RegOpenKeyExW RegCloseKey

api-ms-win-crt-string-l1-1-0

wcsncmp strcpy_s strlen

api-ms-win-crt-math-l1-1-0

pow __setusermatherr

api-ms-win-crt-heap-l1-1-0

malloc _set_new_mode free calloc

api-ms-win-crt-utility-l1-1-0

_rotl64

api-ms-win-crt-runtime-l1-1-0

_set_app_type _seh_filter_exe exit _exit _initialize_narrow_environment _initterm_e __p___argc _initialize_onexit_table _register_onexit_function _crt_atexit terminate abort _initterm __p___argv _configure_narrow_argv _get_initial_narrow_environment _cexit _c_exit _register_thread_local_exe_atexit_callback

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

ab240a55cf148b8323b9b5c9128a543901ec8e2f91cf9a7981601810352f8df1

kernel32

oleaut32

ntdll

bcryptprimitives

api-ms-win-core-synch-l1-2-0

user32

ws2_32

crypt32

secur32

advapi32

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic