e9c0618f309ae25af80534840cd9eb3c7fb6552d0a995562e98a2dc9b311b9b5

Sharing

Copy URL Twitter E-mail

General

Target
e9c0618f309ae25af80534840cd9eb3c7fb6552d0a995562e98a2dc9b311b9b5
Size 443KB
Sample260729-flyd5sw1cs
SHA256 e9c0618f309ae25af80534840cd9eb3c7fb6552d0a995562e98a2dc9b311b9b5
MD5 1c7bb84fe28c455ece918808c825a8fe
SHA1 8ed93ecfae7bb233fe1a82249cfe3d2a222d523e
SHA512 42e6d6b3c43528c2cfd88a05715eff8170b0a7b68cbad1cba2680da131e20e7c9980f6f71c808c73d0370fa937f7a70003833ad9419d59fe11fd2bacb3dd0d5e
SSDEEP 12288:9aKd3/KOLAhv5m06zbot8uVRKFssQ3Ngo2:9aG3/6v5mJzbUiYN52
TLSH
T1D0A40145F2926ECAED738B3CD9654502353FBC909770CB3B16D8011E3EA76848F6AD62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e9c0618f309ae25af80534840cd9eb3c7fb6552d0a995562e98a2dc9b311b9b5

File Explorer

e9c0618f309ae25af80534840cd9eb3c7fb6552d0a995562e98a2dc9b311b9b5

.exe 443KB

e9c0618f309ae25af80534840cd9eb3c7fb6552d0a995562e98a2dc9b311b9b5

IMPHASH d79b94f709e1b3e273789ddfcaee106d
SHA256 e9c0618f309ae25af80534840cd9eb3c7fb6552d0a995562e98a2dc9b311b9b5
MD5 1c7bb84fe28c455ece918808c825a8fe
SHA1 8ed93ecfae7bb233fe1a82249cfe3d2a222d523e
SHA512 42e6d6b3c43528c2cfd88a05715eff8170b0a7b68cbad1cba2680da131e20e7c9980f6f71c808c73d0370fa937f7a70003833ad9419d59fe11fd2bacb3dd0d5e
SSDEEP 12288:9aKd3/KOLAhv5m06zbot8uVRKFssQ3Ngo2:9aG3/6v5mJzbUiYN52
TLSH
T1D0A40145F2926ECAED738B3CD9654502353FBC909770CB3B16D8011E3EA76848F6AD62
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

327680

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\测试工程\ConsoleApplication1\x64\Release\ConsoleApplication1.pdb

kernel32

Thread32First WaitForSingleObject OpenProcess CreateToolhelp32Snapshot Sleep GetLastError Process32NextW Process32FirstW CloseHandle QueueUserAPC VirtualProtectEx Thread32Next CreateRemoteThread VirtualFreeEx OpenThread SetEndOfFile WriteConsoleW HeapSize CreateFileW GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetCurrentProcess VirtualAllocEx WriteProcessMemory MultiByteToWideChar GetStringTypeW WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW GetFileSizeEx SetFilePointerEx GetFileType HeapAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapFree CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadFile ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW RtlUnwind

Name

Size

196KB

Virtual Size

195KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

82KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.pr0

Size

143KB

Virtual Size

143KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

e9c0618f309ae25af80534840cd9eb3c7fb6552d0a995562e98a2dc9b311b9b5

kernel32

generic