67fb52788d1b989f5823748cb6256af98add1545d4d6fb992e3a2f09412c85ee

Sharing

Copy URL Twitter E-mail

General

Target
67fb52788d1b989f5823748cb6256af98add1545d4d6fb992e3a2f09412c85ee
Size 6.5MB
Sample260722-rh5jtsff62
SHA256 67fb52788d1b989f5823748cb6256af98add1545d4d6fb992e3a2f09412c85ee
MD5 b0c07afe12addebb07cd595ca1d77d7e
SHA1 21100240620a3f360503ceca14a09765b6eb4b78
SHA512 1930adeb5aafe58b6ab850409a3264db3eba5e66e945fa961f3692e487ed88d02f633a6519e2a7aeb3b1f6ad753d46d3b8ab545a50cd496d2aaf4b26563e5ba4
SSDEEP 196608:F2UWWWLRtZwtD//W0ONkR6FNwxNf577ZO:VWWWLRzwtD//WlNkR6FNwxNf577
TLSH
T1B7663B53EB9572D9D01DD330469B6713B631F84C472136FBEE58A7202E61BE09EB6B20
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
67fb52788d1b989f5823748cb6256af98add1545d4d6fb992e3a2f09412c85ee

File Explorer

67fb52788d1b989f5823748cb6256af98add1545d4d6fb992e3a2f09412c85ee

.exe 6.5MB

67fb52788d1b989f5823748cb6256af98add1545d4d6fb992e3a2f09412c85ee

IMPHASH 272c9b63780756a1c2d3199abed8839e
SHA256 67fb52788d1b989f5823748cb6256af98add1545d4d6fb992e3a2f09412c85ee
MD5 b0c07afe12addebb07cd595ca1d77d7e
SHA1 21100240620a3f360503ceca14a09765b6eb4b78
SHA512 1930adeb5aafe58b6ab850409a3264db3eba5e66e945fa961f3692e487ed88d02f633a6519e2a7aeb3b1f6ad753d46d3b8ab545a50cd496d2aaf4b26563e5ba4
SSDEEP 196608:F2UWWWLRtZwtD//W0ONkR6FNwxNf577ZO:VWWWLRzwtD//WlNkR6FNwxNf577
TLSH
T1B7663B53EB9572D9D01DD330469B6713B631F84C472136FBEE58A7202E61BE09EB6B20
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vfwprintf __stdio_common_vsprintf _fileno _fseeki64 _ftelli64 _setmode _wfopen _write fclose fflush fgetwc fopen fputc fputwc fread fseek fwrite getc setbuf setvbuf ungetc ungetwc

api-ms-win-crt-runtime-l1-1-0

_assert __p___argc __p___argv __sys_nerr _beginthreadex _cexit _configure_narrow_argv _crt_atexit _endthreadex _errno _exit _initialize_narrow_environment _initterm _initterm_e _seh_filter_exe _set_app_type _set_invalid_parameter_handler abort exit strerror strerror_s

api-ms-win-crt-string-l1-1-0

_iswalpha_l _iswcntrl_l _iswdigit_l _iswlower_l _iswprint_l _iswpunct_l _iswspace_l _iswupper_l _iswxdigit_l _strcoll_l _strdup _strxfrm_l _tolower_l _toupper_l _towlower_l _towupper_l _wcscoll_l _wcsxfrm_l isdigit islower isspace isxdigit mbrlen memset strcmp strlen strncmp strnlen tolower toupper wcslen wcsnlen

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func ___mb_cur_max_func __pctype_func _configthreadlocale _create_locale _free_locale localeconv setlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr ceilf exp log log10 pow round

api-ms-win-crt-heap-l1-1-0

_aligned_free _aligned_malloc _set_new_mode calloc free malloc realloc

api-ms-win-crt-private-l1-1-0

__intrinsic_setjmp longjmp memchr memcmp memcpy memmove

api-ms-win-crt-convert-l1-1-0

_strtod_l mbrtowc mbsrtowcs strtof strtol strtoll strtoul strtoull wcrtomb wcrtomb_s wcstod wcstol wcstoll wcstoul wcstoull

shell32

CommandLineToArgvW

kernel32

AcquireSRWLockExclusive AreFileApisANSI CloseHandle CreateEventA CreateFileMappingA CreateMutexA CreateSemaphoreA DeleteCriticalSection DuplicateHandle EnterCriticalSection FlsAlloc FlsGetValue FlsSetValue FormatMessageA GetActiveProcessorCount GetActiveProcessorGroupCount GetCommandLineW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetLargePageMinimum GetLastError GetLogicalProcessorInformationEx GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetNumaProcessorNodeEx GetProcAddress GetProcessAffinityMask GetProcessGroupAffinity GetSystemTimeAsFileTime GetSystemTimePreciseAsFileTime GetThreadContext GetThreadId GetThreadPriority GetTickCount InitOnceExecuteOnce InitializeCriticalSection IsProcessorFeaturePresent LeaveCriticalSection LoadLibraryA LocalFree MapViewOfFile MultiByteToWideChar OpenProcess OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseMutex ReleaseSRWLockExclusive ReleaseSemaphore ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlRestoreContext RtlUnwindEx RtlVirtualUnwind SetConsoleCP SetConsoleOutputCP SetEvent SetLastError SetProcessAffinityMask SetThreadContext SetThreadGroupAffinity SetThreadPriority SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SuspendThread SwitchToThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryAcquireSRWLockExclusive TryEnterCriticalSection UnmapViewOfFile VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte

api-ms-win-crt-time-l1-1-0

_strftime_l

api-ms-win-crt-multibyte-l1-1-0

_mbtowc_l

api-ms-win-crt-environment-l1-1-0

__p__environ getenv

api-ms-win-crt-utility-l1-1-0

rand_s

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

Name

.text

Size

4.5MB

Virtual Size

4.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

176.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

52KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

512B

Virtual Size

464B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

x86_64_a

Size

512B

Virtual Size

120B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

x86_64_a

Size

512B

Virtual Size

120B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

x86_64_a

Size

512B

Virtual Size

120B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

x86_64_a

Size

512B

Virtual Size

120B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

x86_64_b

Size

512B

Virtual Size

120B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

x86_64_i

Size

512B

Virtual Size

120B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

x86_64_s

Size

512B

Virtual Size

120B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

x86_64_v

Size

512B

Virtual Size

120B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

67fb52788d1b989f5823748cb6256af98add1545d4d6fb992e3a2f09412c85ee

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-convert-l1-1-0

shell32

kernel32

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

generic