497097d2f02fea8890e94c41de3a7e72327951c02606e324e5900e2b16fa4e64

Sharing

Copy URL Twitter E-mail

General

Target
497097d2f02fea8890e94c41de3a7e72327951c02606e324e5900e2b16fa4e64
Size 282KB
Sample260728-eyaceayths
SHA256 497097d2f02fea8890e94c41de3a7e72327951c02606e324e5900e2b16fa4e64
MD5 50a067d5b4bce82dbd63c3198b46055f
SHA1 1d32c57a70377400a3f635d1251fee449d83be74
SHA512 f46a4f13d4722ede2df4e733302528c97a3c24720d992270f8bca16925f8cbca4c378a3a59a0f5604c98634046a262e773edbd27777d0553caeaf1afddff466b
SSDEEP 6144:Vi9c+Q5Fsb/bKLAHIaI0nlGHDFpknReWzYzSVohRjc5y:09ch5FM/GLAoaIS4HXW0+oM
TLSH
T101546C19B7A548B4E577D23D8D578906E3F238110B31DAEF03A4435A6F277E09A3BB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
497097d2f02fea8890e94c41de3a7e72327951c02606e324e5900e2b16fa4e64

File Explorer

497097d2f02fea8890e94c41de3a7e72327951c02606e324e5900e2b16fa4e64

.dll 282KB

497097d2f02fea8890e94c41de3a7e72327951c02606e324e5900e2b16fa4e64

IMPHASH 8bb7fb820fe7246b7b1c837d1e9244c1
SHA256 497097d2f02fea8890e94c41de3a7e72327951c02606e324e5900e2b16fa4e64
MD5 50a067d5b4bce82dbd63c3198b46055f
SHA1 1d32c57a70377400a3f635d1251fee449d83be74
SHA512 f46a4f13d4722ede2df4e733302528c97a3c24720d992270f8bca16925f8cbca4c378a3a59a0f5604c98634046a262e773edbd27777d0553caeaf1afddff466b
SSDEEP 6144:Vi9c+Q5Fsb/bKLAHIaI0nlGHDFpknReWzYzSVohRjc5y:09ch5FM/GLAoaIS4HXW0+oM
TLSH
T101546C19B7A548B4E577D23D8D578906E3F238110B31DAEF03A4435A6F277E09A3BB21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

56648

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

I:\CST Work Data\controller_SDK\CSTControllerDll\CSTControllerDemoV2.0\x64\Release\CSTControllerDll.pdb

kernel32

PurgeComm SetupComm Sleep CreateFileA GetCommState CloseHandle SetCommTimeouts SetCommState WriteConsoleW WriteFile FlushFileBuffers SetFilePointerEx GetConsoleMode GetConsoleCP HeapSize SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage ReadFile WideCharToMultiByte EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar SetLastError InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo SetEvent ResetEvent WaitForSingleObjectEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError FreeLibrary LoadLibraryExW InterlockedFlushSList HeapAlloc HeapReAlloc HeapFree ExitProcess GetModuleHandleExW GetModuleFileNameA GetACP GetStdHandle GetFileType IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetProcessHeap FindClose FindFirstFileExA FindNextFileA CreateFileW

user32

MessageBoxA

ws2_32

closesocket select WSAStartup inet_addr send socket bind recvfrom recv getsockopt htons sendto ioctlsocket setsockopt WSACleanup connect

iphlpapi

GetAdaptersInfo

Name

.text

Size

174KB

Virtual Size

174KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

87KB

Virtual Size

87KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

484B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

497097d2f02fea8890e94c41de3a7e72327951c02606e324e5900e2b16fa4e64

kernel32

user32

ws2_32

iphlpapi

generic