ae2d4ba59afc362c22c0972816495e520f32d029af0dc5085449d41a8f0c52b0

Sharing

Copy URL Twitter E-mail

General

Target
ae2d4ba59afc362c22c0972816495e520f32d029af0dc5085449d41a8f0c52b0
Size 238KB
Sample260728-m2eejavdkd
SHA256 ae2d4ba59afc362c22c0972816495e520f32d029af0dc5085449d41a8f0c52b0
MD5 6fa55541bae36fafa9ca62cb3842b14a
SHA1 e3b5e0d8ef499b2d425c6a39ba7e81a04f313d75
SHA512 d2c4597ce112fae5e0db636ae8a3104e53cb0224062ef03136abc8e0f69fd623530f9fffcb32160d4e69faf39d098ce1c3475114fd1b9a19421f0790d4c71a37
SSDEEP 3072:uPKfs81Skj8gTGKaeEJJiN9FfwOJDlDPgp6jE17Zya+NeCb+OtLOncTXibBuXUgl:5shoLEuN9Ffl3dGYMnc
TLSH
T17F34CF8B3A041C30CC5B37B5FD9189186ABE7922D5FD58F108F39E955865E83B222B1F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ae2d4ba59afc362c22c0972816495e520f32d029af0dc5085449d41a8f0c52b0

File Explorer

ae2d4ba59afc362c22c0972816495e520f32d029af0dc5085449d41a8f0c52b0

.dll 238KB

ae2d4ba59afc362c22c0972816495e520f32d029af0dc5085449d41a8f0c52b0

IMPHASH da3ad9135054259d7324f75585997aa8
SHA256 ae2d4ba59afc362c22c0972816495e520f32d029af0dc5085449d41a8f0c52b0
MD5 6fa55541bae36fafa9ca62cb3842b14a
SHA1 e3b5e0d8ef499b2d425c6a39ba7e81a04f313d75
SHA512 d2c4597ce112fae5e0db636ae8a3104e53cb0224062ef03136abc8e0f69fd623530f9fffcb32160d4e69faf39d098ce1c3475114fd1b9a19421f0790d4c71a37
SSDEEP 3072:uPKfs81Skj8gTGKaeEJJiN9FfwOJDlDPgp6jE17Zya+NeCb+OtLOncTXibBuXUgl:5shoLEuN9Ffl3dGYMnc
TLSH
T17F34CF8B3A041C30CC5B37B5FD9189186ABE7922D5FD58F108F39E955865E83B222B1F
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4592

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

MpAddDynamicSignatureFile MpAllocMemory MpAmsiCloseSession MpAmsiNotify MpAmsiScan MpAsrSetHipsUserExclusion MpChangeCapability MpCheckAccessForClipboardOperation MpCheckAccessForClipboardOperationEx MpCheckAccessForClipboardOperationEx2 MpCheckAccessForDragDropOperation MpCheckAccessForDragDropOperation2 MpCheckAccessForPrintOperation MpCheckAccessForPrintOperation2 MpCleanControl MpCleanOpen MpCleanPrecheckStart MpCleanStart MpClientUtilExportFunctions MpClose MpConfigClose MpConfigDelValue MpConfigGetValue MpConfigGetValueAlloc MpConfigInitialize MpConfigIteratorClose MpConfigIteratorEnum MpConfigIteratorEnumV2 MpConfigIteratorOpen MpConfigOpen MpConfigQueryProtection MpConfigRegisterForNotifications MpConfigSetValue MpConfigUninitialize MpConfigUnregisterNotifications MpConveyDlpBypass MpConveySampleSubmissionResult MpConveyUserChoiceForDlpNotification MpConveyUserChoiceForDlpNotificationEx MpConveyUserChoiceForSampleList MpCreateComInstance MpDbgAllocMemory MpDebugExportFunctions MpDefenderIsPrintAccessCheckNeeded MpDefenderPrintAccessCheck MpDefenderPrintDataProvide MpDelegateCopyFile MpDeleteAsrHistory MpDetectionEnumerate MpDetectionQuery MpDeviceControlAuthenticateNetworkShare MpDlpDelegateEnforcement MpDlpGetOperationEnforcmentMode MpDlpInitializeEnforcementMode MpDlpNotifyCloseDocumentFile MpDlpNotifyPostOpenDocumentFile MpDlpNotifyPostSaveAsDocument MpDlpNotifyPostStartPrint MpDlpNotifyPreOpenDocumentFile MpDlpNotifyPrePrint MpDlpNotifyPreSaveAsDocument MpDynamicSignatureEnumerate MpDynamicSignatureOpen MpElevateCleanHandle MpElevationHandleAcquire MpElevationHandleActivate MpElevationHandleAttach MpElevationHandleOpen MpErrorMessageFormat MpFastMemoryScan MpFastMemoryScanOpen MpFlushLowfiCache MpForcedReboot MpFreeFileTrustExtraInfo MpFreeMemory MpFreeTSModeInfo MpGenerateSignature MpGenerateSignatureEx MpGenerateThreatReport MpGetASRPerRuleExclusions MpGetAsrBlockedActionInfos MpGetAsrBlockedActions MpGetAsrBlockedProcesses MpGetCallistoDetections MpGetCopyAcceleratorProcessStatus MpGetDevMode MpGetDeviceControlSecurityPolicies MpGetDeviceControlStatus MpGetDlpEvents MpGetEngineVersion MpGetFCValue MpGetHIPSRuleInfo MpGetHybridMode MpGetMAPSConnectivityStatusInfo MpGetNpSupportFile MpGetRunningMode MpGetSampleChunk MpGetSampleListRequiringConsent MpGetTDTFeatureStatus MpGetTDTFeatureStatusEx MpGetTPStateInfo MpGetTSModeInfo MpGetTaskSchedulerStrings MpGetThreatExecutionInfo MpHandleClose MpIsDeviceControlAvailable MpIsGivenRunningModeSupported MpIsRtpAutoEnable MpManagerDisable MpManagerEnable MpManagerOpen MpManagerStatusQuery MpManagerStatusQueryEx MpManagerVersionQuery MpManagerXBGMDisable MpManagerXBGMEnable MpMemoryScanStart MpNetworkCapture MpNotificationRegister MpOfflineScanInstall MpOfflineScanStatusQuery MpOpen MpProductGenuineCheck MpQuarantineRequest MpQueryDefaultFolderGuardList MpQueryEngineConfigDword MpQueryFileTrustByHandle MpQueryFileTrustByHandle2 MpRemapCallistoDetections MpRemoveDynamicSignatureFile MpReportClipboardOwner MpRequestSnooze MpRollbackPlatform MpSampleQuery MpSampleSubmit MpScanControl MpScanResult MpScanStart MpScanStartEx MpSendBrowserHeartbeat MpSetBreakTheGlassStatus MpSetTPState MpSetUacElevationDefaultWindowHandle MpShowDlpDetailsDialog MpShutdownCopyAcceleratorProcess MpSmartLockerEnable MpTelemetryAddToAverageDWORD MpTelemetryAddToStreamDWORD MpTelemetryAddToStreamDWORD64 MpTelemetryAddToStreamString MpTelemetryIncrementDWORD MpTelemetryInitialize MpTelemetryIsOptIn MpTelemetryLiteralAddToAverageDWORD MpTelemetryLiteralAddToStreamDWORD MpTelemetryLiteralAddToStreamDWORD64 MpTelemetryLiteralAddToStreamString MpTelemetryLiteralIncrementDWORD MpTelemetryLiteralSetDWORD MpTelemetryLiteralSetDWORD64 MpTelemetryLiteralSetIfMaxDWORD MpTelemetryLiteralSetIfMinDWORD MpTelemetryLiteralSetString MpTelemetrySetConsent MpTelemetrySetDWORD MpTelemetrySetDWORD64 MpTelemetrySetIfMaxDWORD MpTelemetrySetIfMinDWORD MpTelemetrySetString MpTelemetryUninitialize MpTelemetryUpdateUserConsent MpTelemetryUpload MpThreatAction MpThreatEnumerate MpThreatHistoryRequest MpThreatLocalizedInfoQuery MpThreatOpen MpThreatQuery MpThreatRollup MpTriggerErrorHeartbeatReport MpTriggerHeartbeatOnUninstall MpTriggerStatusRefreshNotification MpUnblockEngine MpUnblockPlatform MpUnblockSignatures MpUpdateBrowserActiveTab MpUpdateControl MpUpdateDevMode MpUpdateEngine MpUpdatePlatform MpUpdateStart MpUpdateStartEx MpUpdateTSMode MpUpdateTSModeEx MpUtilsExportFunctions MpWDEnable MpXBGMEnable MpXBGMFreeEvent MpXBGMGetData MpXBGMPutData MpXBGMUpdateIV MputAddToAverageDWORD64Rpc MputAddToAverageDWORDRpc MputIncrementDWORD64Rpc MputIncrementDWORDRpc MputSetBoolRpc MputSetDWORD64Rpc MputSetDWORDRpc MputSetIfMaxDWORD64Rpc MputSetIfMaxDWORDRpc MputSetIfMinDWORD64Rpc MputSetIfMinDWORDRpc MputSetStringRpc WDEnable WDStatus

Name

.text

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

184KB

Virtual Size

183KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

512B

Virtual Size

444B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

308B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

ae2d4ba59afc362c22c0972816495e520f32d029af0dc5085449d41a8f0c52b0

kernel32

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

user32

generic