c9efc6926fbd4b800cc9cde8aaf3205fceda4b5c0b9cbb02569eb9954a18200d

Sharing

Copy URL Twitter E-mail

General

Target
c9efc6926fbd4b800cc9cde8aaf3205fceda4b5c0b9cbb02569eb9954a18200d
Size 412KB
Sample260722-p33jvsvgrd
SHA256 c9efc6926fbd4b800cc9cde8aaf3205fceda4b5c0b9cbb02569eb9954a18200d
MD5 4262ef9428ee3a2de788db37bdf26755
SHA1 9ecce0b0e31e77b2bd6fc2b0bcf7c1b66b61137f
SHA512 2d2250d900f5c47eb37f5731068d155ffc0dc3dad4fdfbdbd3820eab5b13daf0c415f6cbf3118d8421f21eefb8ff9a02ea46347d7cb5132b6bbc10f17255d316
SSDEEP 6144:YQRKnwPNfGlcE23o8hk4XfvVSvzwN7hVxfeelOH7n+7ECg4DQSvAWGRtzOf7lO2:Y/wPlEcEo3z7hWelOHT+QCg6QYAx+lO2
TLSH
T177946C96E3A408E9D5A7D03CC5538217E2B6B429131097CB07B4CB7A1F237E5BA3B761
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c9efc6926fbd4b800cc9cde8aaf3205fceda4b5c0b9cbb02569eb9954a18200d

File Explorer

c9efc6926fbd4b800cc9cde8aaf3205fceda4b5c0b9cbb02569eb9954a18200d

.exe 412KB

c9efc6926fbd4b800cc9cde8aaf3205fceda4b5c0b9cbb02569eb9954a18200d

IMPHASH b5384bb656d231e3ba1dc0d59ce4ca70
SHA256 c9efc6926fbd4b800cc9cde8aaf3205fceda4b5c0b9cbb02569eb9954a18200d
MD5 4262ef9428ee3a2de788db37bdf26755
SHA1 9ecce0b0e31e77b2bd6fc2b0bcf7c1b66b61137f
SHA512 2d2250d900f5c47eb37f5731068d155ffc0dc3dad4fdfbdbd3820eab5b13daf0c415f6cbf3118d8421f21eefb8ff9a02ea46347d7cb5132b6bbc10f17255d316
SSDEEP 6144:YQRKnwPNfGlcE23o8hk4XfvVSvzwN7hVxfeelOH7n+7ECg4DQSvAWGRtzOf7lO2:Y/wPlEcEo3z7hWelOHT+QCg6QYAx+lO2
TLSH
T177946C96E3A408E9D5A7D03CC5538217E2B6B429131097CB07B4CB7A1F237E5BA3B761
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

309712

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

E:\CPP\x1Ldr-dy\x64\Release\BypassAV-1.pdb

ws2_32

WSAStartup WSACleanup __WSAFDIsSet select getaddrinfo freeaddrinfo listen recvfrom sendto ioctlsocket gethostname htonl ntohl WSAIoctl socket accept recv send bind closesocket connect getpeername getsockname getsockopt htons ntohs setsockopt WSASetLastError WSAGetLastError

wldap32

ord147 ord133 ord79 ord142 ord167 ord127 ord145 ord301 ord26 ord118 ord41 ord208 ord73 ord216 ord219 ord27 ord46 ord14

crypt32

CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertAddCertificateContextToStore CryptStringToBinaryW CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore CertOpenStore

kernel32

IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter WideCharToMultiByte MultiByteToWideChar CreateFileW FormatMessageA SetLastError WaitForMultipleObjects PeekNamedPipe GetFileType GetStdHandle ExpandEnvironmentStringsA GetModuleHandleA GetLastError WaitForSingleObjectEx CloseHandle GetTickCount QueryPerformanceCounter Sleep VerifyVersionInfoW LoadLibraryW GetProcAddress GetModuleHandleW FreeLibrary GetSystemDirectoryW QueryPerformanceFrequency RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind CreateThread ReadFile GetFileSizeEx VirtualProtect VirtualAlloc WaitForSingleObject CreateFileA EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection SleepEx VerSetConditionMask

user32

MessageBoxA

advapi32

CryptHashData CryptEncrypt CryptImportKey CryptDestroyKey CryptDestroyHash CryptAcquireContextW CryptCreateHash CryptGenRandom CryptGetHashParam CryptReleaseContext

msvcp140

?always_noconv@codecvt_base@std@@QEBA_NXZ ?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z ?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??Bid@locale@std@@QEAA_KXZ ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception _CxxThrowException __C_specific_handler wcschr memchr memcmp __current_exception_context memmove strrchr strchr memset memcpy __std_exception_copy __std_exception_destroy strstr

api-ms-win-crt-stdio-l1-1-0

fwrite _lseeki64 _set_fmode __stdio_common_vfprintf fgets fgetc __stdio_common_vsprintf fclose fflush __p__commode ftell fseek fgetpos __acrt_iob_func fputc __stdio_common_vsscanf fputs fopen _get_stream_buffer_pointers _read _write _close _open _fseeki64 fread fsetpos setvbuf ungetc

api-ms-win-crt-heap-l1-1-0

free _callnewh calloc _set_new_mode malloc realloc

api-ms-win-crt-filesystem-l1-1-0

_access _unlock_file _stat64 _fstat64 _lock_file

api-ms-win-crt-runtime-l1-1-0

strerror _initialize_onexit_table _c_exit _errno _cexit _beginthreadex __p___argc _register_onexit_function _crt_atexit _exit _getpid exit __sys_nerr __p___argv _initterm_e terminate _invalid_parameter_noinfo_noreturn _seh_filter_exe _set_app_type _register_thread_local_exe_atexit_callback _configure_narrow_argv _initialize_narrow_environment _initterm _get_initial_narrow_environment

api-ms-win-crt-string-l1-1-0

strncmp _wcsdup strcmp _strdup strpbrk isupper wcsncpy strspn strcspn tolower wcsncmp strncpy wcspbrk

api-ms-win-crt-time-l1-1-0

_time64 _gmtime64

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-convert-l1-1-0

atoi strtoll strtol strtoul

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

c9efc6926fbd4b800cc9cde8aaf3205fceda4b5c0b9cbb02569eb9954a18200d

ws2_32

wldap32

crypt32

kernel32

user32

advapi32

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic