fBLmNJY1drym

Sharing

Copy URL Twitter E-mail

General

Target
fBLmNJY1drym
Size 1.3MB
Sample260723-amn9zabn2w
SHA256 ba2015bea70f91d4578d7aeb4576c55f2aabe9a48a11cf834021151a25775f91
MD5 73f4bb3973ba9c846cf6bdac62ddcb5f
SHA1 8b38ce923bf875069321c422d36e4e672225ee69
SHA512 7fdd821289eac8489d07d91ac791c324784dc253b2847da15bdd74f0636d258f17a28d2db8b2787bb9ebb4c12412f04b32d59af4175391219e88a66a2f215dc4
SSDEEP 24576:LMm8/jzEaLzxwHBFVD8MXo/c2cnes7NMXD/jcUUQn652vOYK:LMm8/jzpCDD8MXo/c2cnes7N4boUrN
TLSH
T193554903F6D48A6AC45AC174C38B9732BA32B88D0726F7AB17D497303E96B546F0D758
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fBLmNJY1drym

File Explorer

fBLmNJY1drym

.exe 1.3MB

IMPHASH ce12f68deeaf0abadf1d20107ea1a812
SHA256 ba2015bea70f91d4578d7aeb4576c55f2aabe9a48a11cf834021151a25775f91
MD5 73f4bb3973ba9c846cf6bdac62ddcb5f
SHA1 8b38ce923bf875069321c422d36e4e672225ee69
SHA512 7fdd821289eac8489d07d91ac791c324784dc253b2847da15bdd74f0636d258f17a28d2db8b2787bb9ebb4c12412f04b32d59af4175391219e88a66a2f215dc4
SSDEEP 24576:LMm8/jzEaLzxwHBFVD8MXo/c2cnes7NMXD/jcUUQn652vOYK:LMm8/jzpCDD8MXo/c2cnes7N4boUrN
TLSH
T193554903F6D48A6AC45AC174C38B9732BA32B88D0726F7AB17D497303E96B546F0D758
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5312

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

AddVectoredExceptionHandler CloseHandle CompareStringOrdinal CopyFileExW CreateFileMappingA CreateFileW CreateIoCompletionPort CreateNamedPipeW CreateProcessA CreateProcessW CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW DeleteFileW DuplicateHandle ExitProcess FindClose FindFirstFileExW FormatMessageW FreeEnvironmentStringsW GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetEnvironmentStringsW GetEnvironmentVariableW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessHeap GetProcessIoCounters GetProcessTimes GetQueuedCompletionStatusEx GetStartupInfoA GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimePreciseAsFileTime GetSystemTimes GetTempPathW GetTickCount64 GetWindowsDirectoryW HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete IsDebuggerPresent LoadLibraryA LocalFree MapViewOfFile Module32FirstW Module32NextW MoveFileExW MultiByteToWideChar OpenProcess PostQueuedCompletionStatus QueryPerformanceCounter QueryPerformanceFrequency ReadFileEx ReadProcessMemory ResumeThread SetFileCompletionNotificationModes SetFileInformationByHandle SetHandleInformation SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepEx SwitchToThread TlsAlloc TlsFree TlsGetValue TlsSetValue UnmapViewOfFile VirtualAllocEx VirtualProtectEx VirtualQueryEx WaitForSingleObject WriteConsoleW WriteFileEx WriteProcessMemory DeleteCriticalSection EnterCriticalSection GetCurrentThreadId GetSystemTimeAsFileTime GetTickCount InitializeCriticalSection LeaveCriticalSection RaiseException RtlAddFunctionTable RtlUnwindEx TerminateProcess UnhandledExceptionFilter VirtualProtect VirtualQuery __C_specific_handler

ntdll

NtCancelIoFileEx NtCreateFile NtDeviceIoControlFile NtQueryInformationProcess NtQuerySystemInformation NtWriteFile RtlCaptureContext RtlGetVersion RtlLookupFunctionEntry RtlNtStatusToDosError RtlVirtualUnwind

ole32

CoUninitialize

pdh

PdhCloseQuery PdhRemoveCounter

powrprof

CallNtPowerInformation

psapi

GetModuleFileNameExW

shell32

CommandLineToArgvW

ws2_32

WSACleanup WSAGetLastError WSAIoctl WSASend WSASocketW WSAStartup bind closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket recv send setsockopt shutdown socket

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

advapi32

CopySid GetLengthSid GetTokenInformation IsValidSid OpenProcessToken RegCloseKey RegOpenKeyExW RegQueryValueExW SystemFunction036

bcrypt

BCryptGenRandom

msvcrt

__getmainargs __initenv __iob_func __lconv_init __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _errno _fmode _fpreset _initterm _onexit _wtoi64 abort calloc exit fprintf free fwrite malloc memcmp memcpy memmove memset pow signal strlen strncmp vfprintf wcslen

Name

.text

Size

851KB

Virtual Size

851KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

411KB

Virtual Size

410KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

38KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

120B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

fBLmNJY1drym

kernel32

ntdll

ole32

pdh

powrprof

psapi

shell32

ws2_32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

advapi32

bcrypt

msvcrt

generic