c72be13da09549bc1dbb19008a921a8cb655390e01e4226e817b9dd8a1f48f70

Sharing

Copy URL Twitter E-mail

General

Target
c72be13da09549bc1dbb19008a921a8cb655390e01e4226e817b9dd8a1f48f70
Size 4.5MB
Sample260720-phra4ab16s
SHA256 c72be13da09549bc1dbb19008a921a8cb655390e01e4226e817b9dd8a1f48f70
MD5 dfea1e75d4a48abe87eb4899cf335ad8
SHA1 fd1d27753ace0fdb1fa4cb61e0d1e1aa1286026e
SHA512 7ce78be4bb9f63a2dd602ebd1dd5028245b611af7f843b454a6ca448eb2e3725d9f380645b19f94c8780d56df68b47d1bcfca5e7cc4d137032a1ea9b1f6bbbfa
SSDEEP 98304:rE4o0FIFfjXF3cXAERE8EEEiEEE6EEEYEEE/EEEvEEEsr4jXF3cXAERE8EEEiEE:+jXF3cXAERE8EEEiEEE6EEEYEEE/EEE8
TLSH
T15126DD91B2101355E2FF50B56C931CEADF0026A517B913C68FC8A77A2F83E9B867E507
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c72be13da09549bc1dbb19008a921a8cb655390e01e4226e817b9dd8a1f48f70

File Explorer

c72be13da09549bc1dbb19008a921a8cb655390e01e4226e817b9dd8a1f48f70

.exe 4.5MB

c72be13da09549bc1dbb19008a921a8cb655390e01e4226e817b9dd8a1f48f70

IMPHASH f3631fa922171296fe4ca37760a75258
SHA256 c72be13da09549bc1dbb19008a921a8cb655390e01e4226e817b9dd8a1f48f70
MD5 dfea1e75d4a48abe87eb4899cf335ad8
SHA1 fd1d27753ace0fdb1fa4cb61e0d1e1aa1286026e
SHA512 7ce78be4bb9f63a2dd602ebd1dd5028245b611af7f843b454a6ca448eb2e3725d9f380645b19f94c8780d56df68b47d1bcfca5e7cc4d137032a1ea9b1f6bbbfa
SSDEEP 98304:rE4o0FIFfjXF3cXAERE8EEEiEEE6EEEYEEE/EEEvEEEsr4jXF3cXAERE8EEEiEE:+jXF3cXAERE8EEEiEEE6EEEYEEE/EEE8
TLSH
T15126DD91B2101355E2FF50B56C931CEADF0026A517B913C68FC8A77A2F83E9B867E507
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

99896

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

l:\WorkCode\ShareCode\trunk\360Thrust\x64\Release\360Thrust64.pdb

kernel32

FindResourceExW EnterCriticalSection LeaveCriticalSection GetModuleHandleW GetModuleFileNameW lstrlenW InitializeCriticalSection FreeLibrary LoadLibraryExW lstrcmpiW LocalFree LocalAlloc GetConsoleOutputCP WriteConsoleA SetStdHandle LCMapStringW LCMapStringA GetStringTypeW GetStringTypeA IsValidLocale EnumSystemLocalesA GetUserDefaultLCID GetTimeFormatA GetDateFormatA GetConsoleMode FlushInstructionCache SetFilePointer WideCharToMultiByte GetLocaleInfoA GetLocaleInfoW InitializeCriticalSectionAndSpinCount LoadLibraryA SetConsoleCtrlHandler IsValidCodePage GetOEMCP GetACP DeleteCriticalSection GetCurrentThreadId lstrlenA MultiByteToWideChar SetLastError CreateThread RaiseException CreatePipe GetStartupInfoW WaitForSingleObject ReadFile RemoveDirectoryW DeleteFileW GetVersionExW FindFirstFileW GetFileAttributesW FindNextFileW FindClose GetSystemDirectoryA DeleteFileA FindResourceW GetLastError LoadResource LockResource CloseHandle SetEnvironmentVariableA CompareStringW CompareStringA GetCPInfo FlushFileBuffers CreateFileA GetTimeZoneInformation FatalAppExitA GetSystemTimeAsFileTime GetCurrentProcessId GetTickCount QueryPerformanceCounter GetStartupInfoA GetFileType SetHandleCount GetCommandLineW SizeofResource SetFileAttributesW CreateFileW WriteFile GetModuleHandleA GetProcAddress GetCurrentProcess GetSystemDirectoryW CreateProcessW GetConsoleCP InterlockedPushEntrySList HeapFree HeapAlloc GetProcessHeap VirtualFree VirtualAlloc InterlockedPopEntrySList HeapDestroy HeapReAlloc HeapSize TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext RtlUnwindEx RtlPcToFileHeader EncodePointer DecodePointer TlsAlloc FlsGetValue FlsSetValue FlsFree GetCurrentThread FlsAlloc Sleep ExitProcess GetStdHandle GetModuleFileNameA HeapSetInformation HeapCreate FreeEnvironmentStringsW GetEnvironmentStringsW WriteConsoleW

user32

CharNextW SetWindowLongPtrW GetWindow GetWindowRect GetWindowLongW MonitorFromWindow UnregisterClassA GetClientRect MapWindowPoints SetWindowPos GetDlgItem GetParent SetDlgItemTextW SendDlgItemMessageW DestroyWindow SendMessageW EndDialog DialogBoxParamW wsprintfW GetSystemMetrics LoadImageW DefWindowProcW GetActiveWindow GetMonitorInfoW

advapi32

RegEnumKeyExW RegOpenKeyExW RegDeleteKeyW AdjustTokenPrivileges LookupPrivilegeValueW OpenProcessToken RegOpenKeyW RegQueryValueExW RegEnumKeyW GetUserNameW GetNamedSecurityInfoW BuildExplicitAccessWithNameW SetEntriesInAclW SetNamedSecurityInfoW GetExplicitEntriesFromAclW DeleteAce LookupAccountNameW LookupAccountSidW RegCreateKeyExW RegCreateKeyW RegSetValueExW RegDeleteValueW RegQueryInfoKeyW RegCloseKey

ole32

CoTaskMemRealloc CoTaskMemAlloc CoCreateInstance CoInitialize CoUninitialize CoTaskMemFree

oleaut32

SysFreeString VarUI4FromStr

shlwapi

PathAppendW PathFileExistsW PathRemoveFileSpecW StrStrIW StrCmpIW

comctl32

InitCommonControlsEx

crypt32

CertEnumCertificatesInStore CertCloseStore CertDeleteCertificateFromStore CertCompareCertificate CertDuplicateCertificateContext CertOpenStore CertGetNameStringW

Sharing

General

Malware Config

Signatures

File Explorer

c72be13da09549bc1dbb19008a921a8cb655390e01e4226e817b9dd8a1f48f70

kernel32

user32

advapi32

ole32

oleaut32

shlwapi

comctl32

crypt32

generic