d347be4f1192aef7fa04fae28cd91b950ab1dab3cfb77649c13cab7a147ef5bb

Sharing

Copy URL Twitter E-mail

General

Target
d347be4f1192aef7fa04fae28cd91b950ab1dab3cfb77649c13cab7a147ef5bb
Size 973KB
Sample260720-gyphfabs2w
SHA256 d347be4f1192aef7fa04fae28cd91b950ab1dab3cfb77649c13cab7a147ef5bb
MD5 98aa7dadff6c54d086b42200764ca4aa
SHA1 d6d852febb5ce0dac142752894744643c22b1b3a
SHA512 58a2067d3fb945e7fb75d8fc3a31ea9b676009242ce975d4ac43af0d750826a5054c14ae420e1cee99b74b932024372ee6b7727f4953132f2700d245ca62c29c
SSDEEP 24576:CorvqHi3Dpdflx+TEgAqOByoOJKR9OUXA4tzc:5jqHMDpdflx+TEgAqOBGwRg4to
TLSH
T162256D03E69880F8D4ADC074836AD633FE72B88A4A25B6BF1BD457122F65F905F2D705
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d347be4f1192aef7fa04fae28cd91b950ab1dab3cfb77649c13cab7a147ef5bb

File Explorer

d347be4f1192aef7fa04fae28cd91b950ab1dab3cfb77649c13cab7a147ef5bb

.exe 973KB

d347be4f1192aef7fa04fae28cd91b950ab1dab3cfb77649c13cab7a147ef5bb

IMPHASH 44e25f27533529830f27e8ccaf066694
SHA256 d347be4f1192aef7fa04fae28cd91b950ab1dab3cfb77649c13cab7a147ef5bb
MD5 98aa7dadff6c54d086b42200764ca4aa
SHA1 d6d852febb5ce0dac142752894744643c22b1b3a
SHA512 58a2067d3fb945e7fb75d8fc3a31ea9b676009242ce975d4ac43af0d750826a5054c14ae420e1cee99b74b932024372ee6b7727f4953132f2700d245ca62c29c
SSDEEP 24576:CorvqHi3Dpdflx+TEgAqOByoOJKR9OUXA4tzc:5jqHMDpdflx+TEgAqOBGwRg4to
TLSH
T162256D03E69880F8D4ADC074836AD633FE72B88A4A25B6BF1BD457122F65F905F2D705
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

802624

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

injector_rs.pdb

kernel32

HeapAlloc IsThreadAFiber GetModuleHandleW GetFullPathNameW CreateFileW GetModuleHandleExW SetFileInformationByHandle FindFirstFileExW FindClose WriteConsoleW GetFileInformationByHandleEx ExitProcess GetFileType LoadLibraryExA FormatMessageW ReleaseMutex GetConsoleOutputCP CreateMutexA GetCurrentProcessId HeapReAlloc HeapFree GetFileInformationByHandle GetStdHandle GetProcessHeap SetConsoleTextAttribute GetConsoleScreenBufferInfo SetConsoleMode GetConsoleMode GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler Sleep LoadLibraryA FlsAlloc SetWaitableTimer CreateWaitableTimerExW CreateProcessW CloseHandle WaitForSingleObject GetSystemTimeAsFileTime IsDebuggerPresent GetLastError GetModuleFileNameW WaitForSingleObjectEx RtlLookupFunctionEntry GetCurrentProcess RtlCaptureContext GetCurrentThreadId FlsFree Module32NextW Module32FirstW CreateRemoteThread WriteProcessMemory VirtualAllocEx GetProcAddress GetModuleHandleA OpenProcess VirtualFreeEx SetUnhandledExceptionFilter Process32NextW RtlVirtualUnwind Process32FirstW CreateToolhelp32Snapshot GetSystemTimePreciseAsFileTime FlsSetValue SetFileTime SetLastError InitializeSListHead QueryPerformanceFrequency GetCurrentDirectoryW lstrlenW WideCharToMultiByte MultiByteToWideChar GetEnvironmentVariableW QueryPerformanceCounter GetCommandLineW

psapi

GetDeviceDriverBaseNameW EnumDeviceDrivers

ntdll

NtWriteFile RtlNtStatusToDosError NtReadFile

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

oleaut32

SysFreeString SysStringLen

bcryptprimitives

ProcessPrng

vcruntime140

__CxxFrameHandler3 memcmp memmove memset __C_specific_handler __current_exception __current_exception_context memcpy

api-ms-win-crt-runtime-l1-1-0

__p___argc _exit exit _initterm_e _initterm _get_initial_narrow_environment __p___argv _set_app_type _c_exit _cexit _crt_atexit _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv terminate _seh_filter_exe _register_thread_local_exe_atexit_callback

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

d347be4f1192aef7fa04fae28cd91b950ab1dab3cfb77649c13cab7a147ef5bb

kernel32

psapi

ntdll

api-ms-win-core-synch-l1-2-0

oleaut32

bcryptprimitives

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic