PrCITq9AS

Sharing

Copy URL Twitter E-mail

General

Target
PrCITq9AS
Size 1.3MB
Sample260723-amn9zabn2v
SHA256 99d15376a4615a23dd998d921833f236e87df03c64ae03e9881e9c37019bfcbf
MD5 62cf1dd98432f5d4eabaeaabf9dbed93
SHA1 9c12e6cd46f3fa5081497e2ef0ec9d20797c87a5
SHA512 3ebd354bc30a2cb7abbb5c59bba427ccc62d9912c2216e682e2a29b27f9be57e81fb948ed6e13f770368d128d659d5c5f56bc3e53e27e279e674c04657f48355
SSDEEP 24576:LMm8/jzEaLzxwHBFVD8MXo/c2cnes7NMXD/ucUUQn652vOYK:LMm8/jzpCDD8MXo/c2cnes7N4bRUrN
TLSH
T11D554903F6D48A6AC45AC174C38B9732BA32B88D0726F7AB17D497303E96B546F0D758
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
PrCITq9AS

File Explorer

PrCITq9AS

.exe 1.3MB

IMPHASH ce12f68deeaf0abadf1d20107ea1a812
SHA256 99d15376a4615a23dd998d921833f236e87df03c64ae03e9881e9c37019bfcbf
MD5 62cf1dd98432f5d4eabaeaabf9dbed93
SHA1 9c12e6cd46f3fa5081497e2ef0ec9d20797c87a5
SHA512 3ebd354bc30a2cb7abbb5c59bba427ccc62d9912c2216e682e2a29b27f9be57e81fb948ed6e13f770368d128d659d5c5f56bc3e53e27e279e674c04657f48355
SSDEEP 24576:LMm8/jzEaLzxwHBFVD8MXo/c2cnes7NMXD/ucUUQn652vOYK:LMm8/jzpCDD8MXo/c2cnes7N4bRUrN
TLSH
T11D554903F6D48A6AC45AC174C38B9732BA32B88D0726F7AB17D497303E96B546F0D758
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5312

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

AddVectoredExceptionHandler CloseHandle CompareStringOrdinal CopyFileExW CreateFileMappingA CreateFileW CreateIoCompletionPort CreateNamedPipeW CreateProcessA CreateProcessW CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DeleteFileW DuplicateHandle ExitProcess FindClose FindFirstFileExW FormatMessageW FreeEnvironmentStringsW GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetEnvironmentStringsW GetEnvironmentVariableW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessHeap GetProcessIoCounters GetProcessTimes GetQueuedCompletionStatusEx GetStartupInfoA GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimePreciseAsFileTime GetSystemTimes GetTempPathW GetTickCount64 GetWindowsDirectoryW HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete IsDebuggerPresent LoadLibraryA LocalFree MapViewOfFile Module32FirstW Module32NextW MoveFileExW MultiByteToWideChar OpenProcess PostQueuedCompletionStatus QueryPerformanceCounter QueryPerformanceFrequency ReadFileEx ReadProcessMemory ResumeThread SetFileCompletionNotificationModes SetFileInformationByHandle SetHandleInformation SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepEx SwitchToThread TlsAlloc TlsFree TlsGetValue TlsSetValue UnmapViewOfFile VirtualAllocEx VirtualProtectEx VirtualQueryEx WaitForSingleObject WriteConsoleW WriteFileEx WriteProcessMemory DeleteCriticalSection EnterCriticalSection GetCurrentThreadId GetSystemTimeAsFileTime GetTickCount InitializeCriticalSection LeaveCriticalSection RaiseException RtlAddFunctionTable RtlUnwindEx TerminateProcess UnhandledExceptionFilter VirtualProtect VirtualQuery __C_specific_handler

ntdll

NtCancelIoFileEx NtCreateFile NtDeviceIoControlFile NtQueryInformationProcess NtQuerySystemInformation NtWriteFile RtlCaptureContext RtlGetVersion RtlLookupFunctionEntry RtlNtStatusToDosError RtlVirtualUnwind

ole32

CoUninitialize

pdh

PdhCloseQuery PdhRemoveCounter

powrprof

CallNtPowerInformation

psapi

GetModuleFileNameExW

shell32

CommandLineToArgvW

ws2_32

WSACleanup WSAGetLastError WSAIoctl WSASend WSASocketW WSAStartup bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket recv send setsockopt shutdown socket

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

advapi32

CopySid GetLengthSid GetTokenInformation IsValidSid OpenProcessToken RegCloseKey RegOpenKeyExW RegQueryValueExW SystemFunction036

bcrypt

BCryptGenRandom

msvcrt

__getmainargs __initenv __iob_func __lconv_init __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _errno _fmode _fpreset _initterm _onexit _wtoi64 abort calloc exit fprintf free fwrite malloc memcmp memcpy memmove memset pow signal strlen strncmp vfprintf wcslen

Name

.text

Size

851KB

Virtual Size

851KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

411KB

Virtual Size

410KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

38KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

120B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

PrCITq9AS

kernel32

ntdll

ole32

pdh

powrprof

psapi

shell32

ws2_32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

advapi32

bcrypt

msvcrt

generic