f48210db3356756b8d3f4f25b0600b20e6b31ef7be48bd4ec0aab6bb3cfaa92a

Sharing

Copy URL Twitter E-mail

General

Target
f48210db3356756b8d3f4f25b0600b20e6b31ef7be48bd4ec0aab6bb3cfaa92a
Size 4.0MB
Sample260724-qwh3bage42
SHA256 f48210db3356756b8d3f4f25b0600b20e6b31ef7be48bd4ec0aab6bb3cfaa92a
MD5 59714ebdb4db975d1d73142da02ffd5c
SHA1 44186c686fa3222b6cd8bd0d9f93329c67ca367b
SHA512 b8b78ec4827b8a1274227ece2dc2a0ed11142cf7d2d7c536e52df2db10ed1325d62ee34788f09f34f3e9e780a71784944c7096514f0ceda6d6d96d9dd14ac1fc
SSDEEP 49152:m1EAkFPR+gdvs+GXjzc8IsA3ZyHUo+UK8MYK0B9qeVnxaFXNknjd+dij8MuCDFAS:syUqZyHP3r6RYcdkeUO5n+wGPt9
TLSH
T19F168D03F69581E8C0AEC178836B9633EB72F88D5620B6DB17D44A122F67F605F5E358
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f48210db3356756b8d3f4f25b0600b20e6b31ef7be48bd4ec0aab6bb3cfaa92a

File Explorer

f48210db3356756b8d3f4f25b0600b20e6b31ef7be48bd4ec0aab6bb3cfaa92a

.exe 4.0MB

f48210db3356756b8d3f4f25b0600b20e6b31ef7be48bd4ec0aab6bb3cfaa92a

IMPHASH 5ef5b4442867c4c7697272d12f6d422e
SHA256 f48210db3356756b8d3f4f25b0600b20e6b31ef7be48bd4ec0aab6bb3cfaa92a
MD5 59714ebdb4db975d1d73142da02ffd5c
SHA1 44186c686fa3222b6cd8bd0d9f93329c67ca367b
SHA512 b8b78ec4827b8a1274227ece2dc2a0ed11142cf7d2d7c536e52df2db10ed1325d62ee34788f09f34f3e9e780a71784944c7096514f0ceda6d6d96d9dd14ac1fc
SSDEEP 49152:m1EAkFPR+gdvs+GXjzc8IsA3ZyHUo+UK8MYK0B9qeVnxaFXNknjd+dij8MuCDFAS:syUqZyHP3r6RYcdkeUO5n+wGPt9
TLSH
T19F168D03F69581E8C0AEC178836B9633EB72F88D5620B6DB17D44A122F67F605F5E358
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2834352

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bridgehop.pdb

kernel32

GetStdHandle WideCharToMultiByte TerminateProcess UnregisterWaitEx ReleaseMutex GetExitCodeProcess CreateMutexA GetCurrentProcessId FlushFileBuffers GetTickCount MapViewOfFile CreateFileMappingW GetSystemTime GetSystemTimeAsFileTime FreeLibrary GetFileSize LockFileEx LocalFree UnlockFile HeapDestroy HeapCompact LoadLibraryW DeleteFileW DeleteFileA CreateFileA FlushViewOfFile GetConsoleOutputCP GetFileAttributesA GetDiskFreeSpaceA GetTempPathA Sleep HeapSize HeapValidate UnmapViewOfFile CreateMutexW ExitProcess SetEndOfFile GetFullPathNameA SetFilePointer LockFile GetDiskFreeSpaceW HeapCreate AreFileApisANSI GetProcAddress LoadLibraryA WaitForSingleObjectEx GetCurrentProcess GetTempPathW GetFileType CreateDirectoryW CreateThread GetCurrentThreadId GetSystemTimePreciseAsFileTime FindClose FindNextFileW FindFirstFileExW ReadConsoleW DuplicateHandle GetModuleFileNameW GetFileAttributesW CreateProcessW GetWindowsDirectoryW GetSystemDirectoryW GetFileAttributesExW CreateFileW CancelIoEx WriteFile SetFileCompletionNotificationModes CreateIoCompletionPort GetOverlappedResult ReadFile PostQueuedCompletionStatus GetQueuedCompletionStatusEx GetFinalPathNameByHandleW WaitForSingleObject lstrlenW CompareStringOrdinal GetFileInformationByHandle SetFileTime GetFullPathNameW SwitchToThread GetModuleHandleA SetFileInformationByHandle RegisterWaitForSingleObject GetFileInformationByHandleEx SetLastError SetHandleInformation SetConsoleTextAttribute GetConsoleScreenBufferInfo SetConsoleMode GetConsoleMode HeapReAlloc MultiByteToWideChar WriteConsoleW GetModuleHandleW WriteFileEx SleepEx UnlockFileEx GetCurrentThread SetThreadStackGuarantee GetSystemInfo FormatMessageW GetLastError HeapAlloc HeapFree GetProcessHeap ReadFileEx CloseHandle SetUnhandledExceptionFilter GetCommandLineW AddVectoredExceptionHandler GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind InitializeSListHead GetEnvironmentVariableW QueryPerformanceFrequency QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW FormatMessageA SystemTimeToFileTime OutputDebugStringW OutputDebugStringA RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection DeleteCriticalSection

advapi32

SystemFunction036 RegCloseKey RegOpenKeyExW RegQueryValueExW

ws2_32

freeaddrinfo setsockopt bind recv send getsockopt WSAStartup WSASend getsockname WSAGetLastError getpeername WSACleanup connect ioctlsocket WSASocketW shutdown getaddrinfo closesocket WSAIoctl

ntdll

NtOpenFile RtlNtStatusToDosError NtDeviceIoControlFile NtCancelIoFileEx NtCreateFile NtCreateNamedPipeFile NtWriteFile NtReadFile

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

shell32

SHGetKnownFolderPath

combase

CoTaskMemFree

crypt32

CertEnumCertificatesInStore CertFreeCertificateContext CertCloseStore CertGetEnhancedKeyUsage CertVerifyTimeValidity CertDuplicateCertificateContext CertOpenStore

bcrypt

BCryptGenRandom

bcryptprimitives

ProcessPrng

vcruntime140

__C_specific_handler strrchr strchr memchr memset memcmp memmove __CxxFrameHandler3 __current_exception __current_exception_context memcpy

api-ms-win-crt-string-l1-1-0

strspn strlen strcmp strncmp strcspn

api-ms-win-crt-math-l1-1-0

fabs log _dclass pow __setusermatherr

api-ms-win-crt-heap-l1-1-0

_msize _set_new_mode realloc free malloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment _crt_atexit _seh_filter_exe terminate _set_app_type _endthreadex _get_initial_narrow_environment _initterm _initterm_e exit _exit __p___argc __p___argv _cexit _configure_narrow_argv _beginthreadex _c_exit _register_thread_local_exe_atexit_callback _register_onexit_function _initialize_onexit_table

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

f48210db3356756b8d3f4f25b0600b20e6b31ef7be48bd4ec0aab6bb3cfaa92a

kernel32

advapi32

ws2_32

ntdll

api-ms-win-core-synch-l1-2-0

shell32

combase

crypt32

bcrypt

bcryptprimitives

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic