cacbddab52a73c7dd5c50f7effafc2ce1f8613f69e14ba245ecbc233869209b5

Sharing

Copy URL Twitter E-mail

General

Target
cacbddab52a73c7dd5c50f7effafc2ce1f8613f69e14ba245ecbc233869209b5
Size 1.5MB
Sample260722-ewjs3aydja
SHA256 cacbddab52a73c7dd5c50f7effafc2ce1f8613f69e14ba245ecbc233869209b5
MD5 545c9d721cb2116c9eff9085301925a7
SHA1 cae6c964e4129efc55a5397b582c017770af9bc4
SHA512 5cb763743e264c16e2eecdf62a5a11d0f8aaf9892f48a9ad19c588a2776b21dc3594e1c7d84407546cfdd04313715a60db7dfc6a37c70ff45ccce515dd5254a2
SSDEEP 24576:/PN4lOnvmIpsO85QPDc/XbfYl/ypAKoOFkdkd5kLTM3Ymr79:XKlOnvmFv4Dc7Yl/ypAKo23PkLTM3YmX
TLSH
T1E9755D17E2A314FCC12BC17487ABE372B931F8191234BD6F5694DB312E61EA0576EB18
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cacbddab52a73c7dd5c50f7effafc2ce1f8613f69e14ba245ecbc233869209b5

File Explorer

cacbddab52a73c7dd5c50f7effafc2ce1f8613f69e14ba245ecbc233869209b5

.exe 1.5MB

cacbddab52a73c7dd5c50f7effafc2ce1f8613f69e14ba245ecbc233869209b5

IMPHASH 0271319d03559b3f5a1e10d2736676d8
SHA256 cacbddab52a73c7dd5c50f7effafc2ce1f8613f69e14ba245ecbc233869209b5
MD5 545c9d721cb2116c9eff9085301925a7
SHA1 cae6c964e4129efc55a5397b582c017770af9bc4
SHA512 5cb763743e264c16e2eecdf62a5a11d0f8aaf9892f48a9ad19c588a2776b21dc3594e1c7d84407546cfdd04313715a60db7dfc6a37c70ff45ccce515dd5254a2
SSDEEP 24576:/PN4lOnvmIpsO85QPDc/XbfYl/ypAKoOFkdkd5kLTM3Ymr79:XKlOnvmFv4Dc7Yl/ypAKo23PkLTM3YmX
TLSH
T1E9755D17E2A314FCC12BC17487ABE372B931F8191234BD6F5694DB312E61EA0576EB18
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

AllocateAndInitializeSid CheckTokenMembership CloseServiceHandle FreeSid OpenSCManagerA OpenServiceA QueryServiceStatus RegCloseKey RegCreateKeyExA RegDeleteKeyA RegDeleteValueA RegEnumKeyA RegOpenKeyExA RegQueryValueExA RegSetValueExA

bcrypt

BCryptCloseAlgorithmProvider BCryptDecrypt BCryptDestroyKey BCryptGenerateSymmetricKey BCryptHash BCryptOpenAlgorithmProvider BCryptSetProperty

crypt32

CryptUnprotectData

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateFontA CreateSolidBrush DeleteDC DeleteObject SelectObject SetBkMode SetTextColor

gdiplus

GdipAlloc GdipCloneImage GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipFree GdipGetImageEncoders GdipGetImageEncodersSize GdipSaveImageToFile GdiplusStartup

iphlpapi

GetAdaptersInfo

kernel32

AddVectoredExceptionHandler AreFileApisANSI CloseHandle CopyFileA CreateDirectoryA CreateEventA CreateFileA CreateFileMappingW CreateFileW CreateMutexA CreateMutexW CreateProcessA CreateRemoteThread CreateSemaphoreA CreateThread DeleteCriticalSection DeleteFileA DeleteFileW DuplicateHandle EnterCriticalSection ExitProcess FindClose FindFirstFileA FindNextFileA FlushFileBuffers FlushViewOfFile FormatMessageA FormatMessageW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceA GetDiskFreeSpaceW GetEnvironmentVariableA GetFileAttributesA GetFileAttributesExA GetFileAttributesExW GetFileAttributesW GetFileSize GetFileSizeEx GetFullPathNameA GetFullPathNameW GetHandleInformation GetLastError GetLocalTime GetModuleFileNameA GetModuleHandleA GetProcAddress GetProcessAffinityMask GetProcessHeap GetStartupInfoA GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetTempPathA GetTempPathW GetThreadContext GetThreadPriority GetTickCount GetTickCount64 GetTimeZoneInformation GetVolumeInformationA GlobalAlloc GlobalLock GlobalMemoryStatusEx GlobalUnlock HeapAlloc HeapCompact HeapCreate HeapDestroy HeapFree HeapReAlloc HeapSize HeapValidate InitializeCriticalSection IsDebuggerPresent LeaveCriticalSection LocalFree LockFile LockFileEx MapViewOfFile MoveFileA MultiByteToWideChar OpenProcess OutputDebugStringA OutputDebugStringW QueryPerformanceCounter RaiseException ReadFile ReleaseSemaphore RemoveDirectoryA RemoveVectoredExceptionHandler ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetComputerNameExA SetEndOfFile SetEnvironmentVariableA SetErrorMode SetEvent SetFileAttributesA SetFilePointer SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread SystemTimeToFileTime TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection UnlockFile UnlockFileEx UnmapViewOfFile VirtualAllocEx VirtualFreeEx VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WideCharToMultiByte WriteFile WriteProcessMemory

api-ms-win-crt-convert-l1-1-0

_ultoa atol mbrtowc strtoul wcrtomb

api-ms-win-crt-environment-l1-1-0

__p__environ __p__wenviron getenv

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

localeconv

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-multibyte-l1-1-0

_ismbblead

api-ms-win-crt-private-l1-1-0

__C_specific_handler __intrinsic_setjmpex longjmp memchr memcmp memcpy memmove strchr strrchr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv __p___wargv __p__acmdln _beginthreadex _cexit _configure_narrow_argv _configure_wide_argv _crt_at_quick_exit _crt_atexit _endthreadex _errno _exit _initialize_narrow_environment _initialize_wide_environment _initterm _set_app_type _set_invalid_parameter_handler abort exit signal strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vfwprintf __stdio_common_vsprintf _read fputc fputs fwrite

api-ms-win-crt-string-l1-1-0

_strdup _strdup _stricmp isalnum isprint memset strcmp strcspn strlen strncmp strspn tolower wcscmp wcslen

api-ms-win-crt-time-l1-1-0

__daylight __timezone __tzname _gmtime64_s _localtime64 _tzset

api-ms-win-crt-utility-l1-1-0

rand_s

ole32

CoInitializeEx CoUninitialize

shell32

ShellExecuteA

user32

BeginPaint CallNextHookEx CloseClipboard CreateWindowExA DefWindowProcA DispatchMessageA DrawTextA EmptyClipboard EndPaint FillRect GetClientRect GetClipboardData GetDC GetKeyNameTextA GetKeyboardLayout GetKeyboardState GetMessageA GetSystemMetrics InvalidateRect MessageBoxA OpenClipboard PeekMessageA PostQuitMessage RegisterClassA ReleaseDC SetClipboardData SetTimer SetWindowsHookExA ToUnicodeEx TranslateMessage UnhookWindowsHookEx

version

GetFileVersionInfoA GetFileVersionInfoSizeA VerQueryValueA

winhttp

WinHttpAddRequestHeaders WinHttpCloseHandle WinHttpConnect WinHttpOpen WinHttpOpenRequest WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetTimeouts

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

319KB

Virtual Size

318KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

44KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

cacbddab52a73c7dd5c50f7effafc2ce1f8613f69e14ba245ecbc233869209b5

advapi32

bcrypt

crypt32

gdi32

gdiplus

iphlpapi

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

ole32

shell32

user32

version

winhttp

generic