f10eda4fcb320c141fb51452dbb076b1ac37c22b4c2dd9d64fb4ecdf8442c39b

Sharing

Copy URL Twitter E-mail

General

Target
f10eda4fcb320c141fb51452dbb076b1ac37c22b4c2dd9d64fb4ecdf8442c39b
Size 949KB
Sample260729-eqx4hatfph
SHA256 f10eda4fcb320c141fb51452dbb076b1ac37c22b4c2dd9d64fb4ecdf8442c39b
MD5 3e8514fcbc2f1f203af924dc3e76169a
SHA1 eda1ecae357f488833aa31a99141b2a524fc3dae
SHA512 060cb749a73ee422a83208193c7a290803a9267f27865234f661ca2055fe788b8c28c40a994eca8c00e1095237c5c8153e0060f13221e83460f79cea67912e46
SSDEEP 6144:AoVPNHuVIo1HAHnLASZxt47y3lrhQoTta4Yg0Tta4Yy7uJ87uJGFcFWLd:JPZeentIKlriQa4Yg8a4YqMYMGFcF8d
TLSH
T1E225A7D076D86C93E922833D58EBE2313379F79257638B07D504593A6D37BC22EC660A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f10eda4fcb320c141fb51452dbb076b1ac37c22b4c2dd9d64fb4ecdf8442c39b

File Explorer

f10eda4fcb320c141fb51452dbb076b1ac37c22b4c2dd9d64fb4ecdf8442c39b

.exe 949KB

f10eda4fcb320c141fb51452dbb076b1ac37c22b4c2dd9d64fb4ecdf8442c39b

IMPHASH d02a02c8ecedb70823a9d0178cd7b7fc
SHA256 f10eda4fcb320c141fb51452dbb076b1ac37c22b4c2dd9d64fb4ecdf8442c39b
MD5 3e8514fcbc2f1f203af924dc3e76169a
SHA1 eda1ecae357f488833aa31a99141b2a524fc3dae
SHA512 060cb749a73ee422a83208193c7a290803a9267f27865234f661ca2055fe788b8c28c40a994eca8c00e1095237c5c8153e0060f13221e83460f79cea67912e46
SSDEEP 6144:AoVPNHuVIo1HAHnLASZxt47y3lrhQoTta4Yg0Tta4Yy7uJ87uJGFcFWLd:JPZeentIKlriQa4Yg8a4YqMYMGFcF8d
TLSH
T1E225A7D076D86C93E922833D58EBE2313379F79257638B07D504593A6D37BC22EC660A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16736

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

ConvertSidToStringSidW GetTokenInformation GetUserNameW OpenProcessToken RegCloseKey RegCreateKeyExW RegCreateKeyW RegDeleteValueW RegEnumValueW RegOpenKeyExW RegOpenKeyW RegQueryInfoKeyW RegQueryValueExW RegSetValueExW

kernel32

CreateToolhelp32Snapshot DelayLoadFailureHook GetComputerNameW GetPrivateProfileSectionW GetProcAddress HeapReAlloc IsBadStringPtrA IsBadStringPtrW Process32FirstW Process32NextW ResolveDelayLoadedAPI

kernelbase

CloseHandle CreateEventW CreateFileA CreateFileW CreateProcessW DeleteFileW ExitProcess FindClose FindFirstFileW FindNextFileW GetCommandLineW GetExitCodeProcess GetModuleHandleW GetSystemDirectoryW GetSystemFirmwareTable GetSystemWow64Directory2W GetTickCount GetWindowsDirectoryW HeapAlloc IsWow64Process LocalFree MapViewOfFile MoveFileExW MultiByteToWideChar OpenProcess ReadFile RemoveDirectoryW ResetEvent SetComputerNameExA SetCurrentDirectoryW SetEvent Sleep TerminateProcess UnmapViewOfFile VerFindFileW WaitForMultipleObjects WaitForSingleObject Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection lstrcmpiW

ntdll

NtClose NtCreateDirectoryObject NtCreateEvent NtCreateSection NtCreateSymbolicLinkObject NtOpenFile NtOpenSection NtPowerInformation NtQuerySystemInformation NtQuerySystemInformationEx RtlGetSystemTimePrecise RtlGetVersion RtlImageDirectoryEntryToData RtlInitUnicodeString _vsnprintf

ucrtbase

__acrt_iob_func __p___argc __p___argv __stdio_common_vsprintf __stdio_common_vswprintf _chsize _close _configure_narrow_argv _errno _fstat64i32 _get_initial_narrow_environment _initialize_narrow_environment _lseek _putenv _read _set_app_type _strdup _stricmp _wcsicmp _wgetenv _wopen _write exit free fwrite getenv malloc memcmp memmove memset qsort realloc strchr strcmp strcpy strcspn strerror strlen strncmp strtoul wcscat wcschr wcscmp wcscpy wcslen wcsncmp wcsstr

ws2_32

gethostname freeaddrinfo getaddrinfo

Name

.text

Size

36KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

72KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

4KB

Virtual Size

696B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

4KB

Virtual Size

660B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

32KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

4KB

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

4KB

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

4KB

Virtual Size

20B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

4KB

Virtual Size

92B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

4KB

Virtual Size

72B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

4KB

Virtual Size

156B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

4KB

Virtual Size

142B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

f10eda4fcb320c141fb51452dbb076b1ac37c22b4c2dd9d64fb4ecdf8442c39b

advapi32

kernel32

kernelbase

ntdll

ucrtbase

ws2_32

generic