af7c8aec4684216ae87ce621bb3bc2432de8ef3a24c01d7b7a2ac1e668af8f98

Sharing

Copy URL Twitter E-mail

General

Target
af7c8aec4684216ae87ce621bb3bc2432de8ef3a24c01d7b7a2ac1e668af8f98
Size 1.4MB
Sample260727-qjbgpstsft
SHA256 af7c8aec4684216ae87ce621bb3bc2432de8ef3a24c01d7b7a2ac1e668af8f98
MD5 d5e58d272c665e859f68e22f13a14908
SHA1 2829a1b977f93b4c2b2604cae568e88ec02f9b1e
SHA512 6caef247dfa37aeb42e4dfd0de3d48496d60f229091ee2283459bb8a09f56d56bae4e046d0ea647b12d086c6f59bf41d97a1b59573817335e69e2519632d6c2c
SSDEEP 24576:vjTful0HTpL8+GPnYJ2iihTF9F6BkLEygFJUtO4KFA1J5eq:bTf9GPnYJ25hbYBZyg2d0A1JI
TLSH
T19765AE0AD65286BDC908C430C97A1E2E0CF538F95A3BDEEFC18761B723267601BED655
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
af7c8aec4684216ae87ce621bb3bc2432de8ef3a24c01d7b7a2ac1e668af8f98

File Explorer

af7c8aec4684216ae87ce621bb3bc2432de8ef3a24c01d7b7a2ac1e668af8f98

.exe 1.4MB

af7c8aec4684216ae87ce621bb3bc2432de8ef3a24c01d7b7a2ac1e668af8f98

IMPHASH 6741988acbc9b588766d9d2e16cc4dba
SHA256 af7c8aec4684216ae87ce621bb3bc2432de8ef3a24c01d7b7a2ac1e668af8f98
MD5 d5e58d272c665e859f68e22f13a14908
SHA1 2829a1b977f93b4c2b2604cae568e88ec02f9b1e
SHA512 6caef247dfa37aeb42e4dfd0de3d48496d60f229091ee2283459bb8a09f56d56bae4e046d0ea647b12d086c6f59bf41d97a1b59573817335e69e2519632d6c2c
SSDEEP 24576:vjTful0HTpL8+GPnYJ2iihTF9F6BkLEygFJUtO4KFA1J5eq:bTf9GPnYJ25hbYBZyg2d0A1JI
TLSH
T19765AE0AD65286BDC908C430C97A1E2E0CF538F95A3BDEEFC18761B723267601BED655
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

419480

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

AcquireSRWLockExclusive CloseHandle CopyFileW CreateDirectoryW CreateFileW CreateHardLinkW CreateMutexW CreateProcessW CreateSymbolicLinkW DeviceIoControl ExitProcess FindClose FindFirstFileExW FindFirstFileW FindNextFileW FindResourceW FormatMessageA GetActiveProcessorCount GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetFileAttributesExW GetFileInformationByHandle GetFileInformationByHandleEx GetLastError GetLocaleInfoEx GetModuleFileNameW GetModuleHandleW GetProcAddress GetStartupInfoW GetSystemTimeAsFileTime GetTempPathW InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent LoadResource LocalFree LockResource QueryPerformanceCounter ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetConsoleCP SetConsoleOutputCP SetFileInformationByHandle SetUnhandledExceptionFilter SizeofResource Sleep SleepConditionVariableSRW TerminateProcess UnhandledExceptionFilter VirtualAlloc WakeAllConditionVariable WideCharToMultiByte WriteFile

user32

FindWindowA GetAsyncKeyState GetWindowThreadProcessId wsprintfW

advapi32

RegCloseKey RegOpenKeyExA RegOpenKeyExW RegQueryValueExA RegQueryValueExW

msvcp140

??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0ios_base@std@@IEAA@XZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1ios_base@std@@UEAA@XZ ??4?$_Yarn@_W@std@@QEAAAEAV01@PEB_W@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_J@Z ?_Getcvt@_Locinfo@std@@QEBA?AU_Cvtvec@@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Syserror_map@std@@YAPEBDH@Z ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Winerror_map@std@@YAHH@Z ?_Xbad_alloc@std@@YAXXZ ?_Xbad_function_call@std@@YAXXZ ?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?fail@ios_base@std@@QEBA_NXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?init@?$basic_ios@DU?$char_traits@D@std@@@std@@IEAAXPEAV?$basic_streambuf@DU?$char_traits@D@std@@@2@_N@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z _Query_perf_counter _Query_perf_frequency _Xtime_get_ticks

winmm

PlaySoundW

vcruntime140

_CxxThrowException __C_specific_handler __CxxFrameHandler3 __current_exception __current_exception_context __std_exception_copy __std_exception_destroy __std_terminate _purecall memcmp memcpy memmove memset

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-time-l1-1-0

_W_Getdays _W_Getmonths

api-ms-win-crt-runtime-l1-1-0

_c_exit _cexit _configure_narrow_argv _crt_atexit _errno _exit _get_narrow_winmain_command_line _initialize_narrow_environment _initialize_onexit_table _initterm _initterm_e _invoke_watson _register_onexit_function _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type abort exit terminate

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode calloc free malloc

api-ms-win-crt-stdio-l1-1-0

__p__commode __stdio_common_vsprintf __stdio_common_vsprintf_s _set_fmode

api-ms-win-crt-math-l1-1-0

__setusermatherr ldexp

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv

api-ms-win-crt-string-l1-1-0

strcmp strlen strncpy tolower towlower wcslen

api-ms-win-crt-convert-l1-1-0

strtod strtol strtoll strtoul strtoull

Name

.text

Size

408KB

Virtual Size

407KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

75KB

Virtual Size

75KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

701KB

Virtual Size

702KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

171KB

Virtual Size

171KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

af7c8aec4684216ae87ce621bb3bc2432de8ef3a24c01d7b7a2ac1e668af8f98

kernel32

user32

advapi32

msvcp140

winmm

vcruntime140

vcruntime140_1

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

generic