bcd39c2f940b9e82cecb43dc18aef7b4c9ac249a65e0246eface6e702f8b6c56

Sharing

Copy URL Twitter E-mail

General

Target
bcd39c2f940b9e82cecb43dc18aef7b4c9ac249a65e0246eface6e702f8b6c56
Size 5.0MB
Sample260722-sdadkatvfs
SHA256 bcd39c2f940b9e82cecb43dc18aef7b4c9ac249a65e0246eface6e702f8b6c56
MD5 7d5b0f43db812d0069c812168118f5e7
SHA1 8f73cf8fc070067d956dfca2f102d5c624e99201
SHA512 d9f520dbd2bfd0002d41dffcf5b6b2574531cd25ebb5aaccbebf6e2dde0efe3b38230f9f3c2629eb141e580f175736ca7b9003a724cccca8c318543661a9aa88
SSDEEP 98304:G7gFyzuMSbv/PI4c9+1C7uOFsKapi7b9pOwNWwY+:HyaMSbQg1C7uWsKapi1LwwY
TLSH
T1FE36AE1553A804A1D96FD734CB56C733CAB0B992A635D10F098EE24A1F77E62CB2F712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bcd39c2f940b9e82cecb43dc18aef7b4c9ac249a65e0246eface6e702f8b6c56

File Explorer

bcd39c2f940b9e82cecb43dc18aef7b4c9ac249a65e0246eface6e702f8b6c56

.dll 5.0MB

bcd39c2f940b9e82cecb43dc18aef7b4c9ac249a65e0246eface6e702f8b6c56

IMPHASH 9932a24fffbf7a34a27673393b3e16e3
SHA256 bcd39c2f940b9e82cecb43dc18aef7b4c9ac249a65e0246eface6e702f8b6c56
MD5 7d5b0f43db812d0069c812168118f5e7
SHA1 8f73cf8fc070067d956dfca2f102d5c624e99201
SHA512 d9f520dbd2bfd0002d41dffcf5b6b2574531cd25ebb5aaccbebf6e2dde0efe3b38230f9f3c2629eb141e580f175736ca7b9003a724cccca8c318543661a9aa88
SSDEEP 98304:G7gFyzuMSbv/PI4c9+1C7uOFsKapi7b9pOwNWwY+:HyaMSbQg1C7uWsKapi1LwwY
TLSH
T1FE36AE1553A804A1D96FD734CB56C733CAB0B992A635D10F098EE24A1F77E62CB2F712
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

482128

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\a\_work\1\s\src\shared\AI\AIServicesCS\bin\x64\Release\net8.0-windows10.0.26100.0\win-x64\native\AIServicesCS.pdb

advapi32

RegCloseKey RegEnumKeyExW RegEnumValueW RegOpenKeyExW RegQueryValueExW OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueW

bcrypt

BCryptDestroyHash BCryptGenRandom BCryptCloseAlgorithmProvider BCryptCreateHash BCryptFinishHash BCryptHashData BCryptGetProperty BCryptOpenAlgorithmProvider

kernel32

TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer RaiseException RtlPcToFileHeader InterlockedFlushSList MultiByteToWideChar GetStdHandle RaiseFailFastException TzSpecificLocalTimeToSystemTime SystemTimeToFileTime FileTimeToSystemTime GetSystemTime GetCalendarInfoEx CompareStringOrdinal CompareStringEx FindNLSStringEx GetLocaleInfoEx ResolveLocaleName GetUserPreferredUILanguages SetLastError GetLastError FindStringOrdinal GetTickCount64 GetCurrentProcess GetCurrentThread WaitForSingleObject Sleep DeleteCriticalSection LocalFree EnterCriticalSection SleepConditionVariableCS LeaveCriticalSection WakeConditionVariable QueryPerformanceCounter InitializeCriticalSection InitializeConditionVariable CreateThreadpoolTimer SetThreadpoolTimer WaitForMultipleObjectsEx CreateThreadpoolWork CloseThreadpoolWork SubmitThreadpoolWork QueryPerformanceFrequency GetFullPathNameW GetLongPathNameW LocalAlloc GetConsoleOutputCP WideCharToMultiByte GetProcAddress LocaleNameToLCID LCMapStringEx EnumTimeFormatsEx EnumCalendarInfoExEx CreateIoCompletionPort ExpandEnvironmentStringsW FindClose FindFirstFileExW FreeLibrary GetFileAttributesExW GetModuleFileNameW GetSystemDirectoryW LoadLibraryExW QueryUnbiasedInterruptTime SetThreadErrorMode CreateThread ResumeThread DuplicateHandle GetThreadPriority SetThreadPriority GetDynamicTimeZoneInformation GetTimeZoneInformation WriteFile GetCurrentProcessorNumberEx CloseHandle SetEvent ResetEvent CreateEventExW GetEnvironmentVariableW FormatMessageW FlushProcessWriteBuffers WaitForSingleObjectEx RtlVirtualUnwind RtlCaptureContext RtlRestoreContext AddVectoredExceptionHandler FlsAlloc FlsGetValue FlsSetValue CreateEventW TerminateProcess SwitchToThread GetCurrentThreadId SuspendThread GetThreadContext SetThreadContext FlushInstructionCache VirtualAlloc VirtualProtect VirtualFree QueryInformationJobObject GetModuleHandleW GetModuleHandleExW GetProcessAffinityMask InitializeContext GetEnabledXStateFeatures SetXStateFeaturesMask VirtualQuery GetSystemTimeAsFileTime InitializeCriticalSectionEx DebugBreak SleepEx GlobalMemoryStatusEx GetSystemInfo GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo RtlUnwindEx IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlLookupFunctionEntry InitializeSListHead GetCurrentProcessId

ole32

CoCreateGuid CoWaitForMultipleHandles CoGetContextToken CoGetApartmentType CoInitializeEx CoUninitialize CoTaskMemFree CoTaskMemAlloc

oleaut32

SysFreeString SetErrorInfo SysAllocStringLen

user32

LoadStringW

api-ms-win-crt-math-l1-1-0

modf pow floor cos tan ceil sin

api-ms-win-crt-heap-l1-1-0

free calloc malloc realloc _callnewh

api-ms-win-crt-string-l1-1-0

strcpy_s strlen strncpy_s wcsncmp _stricmp strcmp

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-runtime-l1-1-0

_execute_onexit_table _crt_atexit terminate _register_onexit_function abort _cexit _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _seh_filter_dll _initterm_e _initterm

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsscanf __stdio_common_vsprintf_s __stdio_common_vfprintf __acrt_iob_func

Name

.text

Size

497KB

Virtual Size

496KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.managed

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

hydrated

Size

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

1.9MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

27KB

Virtual Size

141KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

238KB

Virtual Size

237KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

924B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

bcd39c2f940b9e82cecb43dc18aef7b4c9ac249a65e0246eface6e702f8b6c56

advapi32

bcrypt

kernel32

ole32

oleaut32

user32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

generic