35bf79617f36d5cb175cbb7c80f4d951cbc28939e101eba97571caa31ed1257c[.]bin

General

Target
35bf79617f36d5cb175cbb7c80f4d951cbc28939e101eba97571caa31ed1257c.bin
Size 1.5MB
Sample260722-2r2jmsdb33
SHA256 35bf79617f36d5cb175cbb7c80f4d951cbc28939e101eba97571caa31ed1257c
MD5 92022adcb120e06f4a3023d7a03eab7e
SHA1 8d2f742b4e1a7a4b4a14b38e3660585f45506718
SHA512 41f91493c0f2157d32d980a51fccb49215ec0ff09eaff9b39aa445e6019b0a2f955785060914172484cc094fe4c90bea7c5f1fc433e06be9d927c42af4ca296a
SSDEEP 24576:GzlXN1zsJgDFmV82h61V1P+UkfKiHz2lAPTQeBBMrvzhlqFvt:Gltk8ioV12ZT2lA7XBBmPsV
TLSH
T1A975121277945CF9F627C03483865663AB39748A4F216EFF03A801E42F6AAE54F3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
35bf79617f36d5cb175cbb7c80f4d951cbc28939e101eba97571caa31ed1257c.bin

File Explorer

35bf79617f36d5cb175cbb7c80f4d951cbc28939e101eba97571caa31ed1257c.bin

.exe 1.5MB

35bf79617f36d5cb175cbb7c80f4d951cbc28939e101eba97571caa31ed1257c.bin

IMPHASH d10fc36a7f00b607f09003d3da0040cc
SHA256 35bf79617f36d5cb175cbb7c80f4d951cbc28939e101eba97571caa31ed1257c
MD5 92022adcb120e06f4a3023d7a03eab7e
SHA1 8d2f742b4e1a7a4b4a14b38e3660585f45506718
SHA512 41f91493c0f2157d32d980a51fccb49215ec0ff09eaff9b39aa445e6019b0a2f955785060914172484cc094fe4c90bea7c5f1fc433e06be9d927c42af4ca296a
SSDEEP 24576:GzlXN1zsJgDFmV82h61V1P+UkfKiHz2lAPTQeBBMrvzhlqFvt:Gltk8ioV12ZT2lA7XBBmPsV
TLSH
T1A975121277945CF9F627C03483865663AB39748A4F216EFF03A801E42F6AAE54F3DB15
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

102800

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

kernel32

SetFilePointerEx CloseHandle DeleteFileW GetLastError SetFileInformationByHandle AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetProcessHeap HeapFree HeapReAlloc SetLastError GetEnvironmentVariableW GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry GetCurrentProcessId CreateMutexA WaitForSingleObjectEx LoadLibraryA GetProcAddress GetCurrentProcess lstrlenW ReleaseMutex WideCharToMultiByte RtlVirtualUnwind GetStdHandle GetConsoleMode GetConsoleOutputCP WaitForSingleObject MultiByteToWideChar WriteConsoleW GetModuleHandleA GetModuleHandleW FormatMessageW GetTempPathW GetFullPathNameW CreateFileW HeapAlloc FlushFileBuffers HeapSize QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent RtlUnwindEx EncodePointer RaiseException EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW RtlPcToFileHeader WriteFile GetModuleFileNameW ExitProcess TerminateProcess GetModuleHandleExW GetCommandLineA GetCommandLineW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect CompareStringW LCMapStringW

ntdll

NtWriteFile RtlNtStatusToDosError

Name

.text

Size

155KB

Virtual Size

155KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text._Z

Size

512B

Virtual Size

15B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

35bf79617f36d5cb175cbb7c80f4d951cbc28939e101eba97571caa31ed1257c.bin

api-ms-win-core-synch-l1-2-0

kernel32

ntdll

generic