48a92d0c37b8abd0edeb9daca78c2e55a0b14c942cc796459f93e2d22ffc93de

Sharing

Copy URL Twitter E-mail

General

Target
48a92d0c37b8abd0edeb9daca78c2e55a0b14c942cc796459f93e2d22ffc93de
Size 12.9MB
Sample260730-cqabbsad85
SHA256 48a92d0c37b8abd0edeb9daca78c2e55a0b14c942cc796459f93e2d22ffc93de
MD5 689f7273a0a1c0b24632f6c88344c679
SHA1 8b302d305e5c79bc0e0e452eb29c81c09315810c
SHA512 f5da9ef2dc2e6c623b2c0475980c5f340e9de65be8f3aa7e792a184c5e22c5e371348dae1b1fda51758ac3fdcba8a2421d378dbcc37246eaf8ed72ddb2433d9d
SSDEEP 393216:NyynEjTLAoODLdA7CDXGfhZO1Med2I3p6E+:Ntn5pYCCZgD3p6t
TLSH
T157D622ED98D622E4D4D34680728B03DE7190666E41FD9C283ADB2D025F11DAF264EEF7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
48a92d0c37b8abd0edeb9daca78c2e55a0b14c942cc796459f93e2d22ffc93de

File Explorer

48a92d0c37b8abd0edeb9daca78c2e55a0b14c942cc796459f93e2d22ffc93de

.dll 12.9MB

48a92d0c37b8abd0edeb9daca78c2e55a0b14c942cc796459f93e2d22ffc93de

IMPHASH 7d602485bc2b1f24b25147184863ae51
SHA256 48a92d0c37b8abd0edeb9daca78c2e55a0b14c942cc796459f93e2d22ffc93de
MD5 689f7273a0a1c0b24632f6c88344c679
SHA1 8b302d305e5c79bc0e0e452eb29c81c09315810c
SHA512 f5da9ef2dc2e6c623b2c0475980c5f340e9de65be8f3aa7e792a184c5e22c5e371348dae1b1fda51758ac3fdcba8a2421d378dbcc37246eaf8ed72ddb2433d9d
SSDEEP 393216:NyynEjTLAoODLdA7CDXGfhZO1Med2I3p6E+:Ntn5pYCCZgD3p6t
TLSH
T157D622ED98D622E4D4D34680728B03DE7190666E41FD9C283ADB2D025F11DAF264EEF7
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10474584

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

AddIPAddress AllocateAndGetInterfaceInfoFromStack AllocateAndGetIpAddrTableFromStack CancelIPChangeNotify CancelIfTimestampConfigChange CancelMibChangeNotify2 CaptureInterfaceHardwareCrossTimestamp CloseCompartment CloseGetIPPhysicalInterfaceForDestination ConvertCompartmentGuidToId ConvertCompartmentIdToGuid ConvertGuidToStringA ConvertGuidToStringW ConvertInterfaceAliasToLuid ConvertInterfaceGuidToLuid ConvertInterfaceIndexToLuid ConvertInterfaceLuidToAlias ConvertInterfaceLuidToGuid ConvertInterfaceLuidToIndex ConvertInterfaceLuidToNameA ConvertInterfaceLuidToNameW ConvertInterfaceNameToLuidA ConvertInterfaceNameToLuidW ConvertInterfacePhysicalAddressToLuid ConvertIpv4MaskToLength ConvertLengthToIpv4Mask ConvertRemoteInterfaceAliasToLuid ConvertRemoteInterfaceGuidToLuid ConvertRemoteInterfaceIndexToLuid ConvertRemoteInterfaceLuidToAlias ConvertRemoteInterfaceLuidToGuid ConvertRemoteInterfaceLuidToIndex ConvertStringToGuidA ConvertStringToGuidW ConvertStringToInterfacePhysicalAddress CreateAnycastIpAddressEntry CreateCompartment CreateIpForwardEntry CreateIpForwardEntry2 CreateIpNetEntry CreateIpNetEntry2 CreatePersistentTcpPortReservation CreatePersistentUdpPortReservation CreateProxyArpEntry CreateSortedAddressPairs CreateUnicastIpAddressEntry DeleteAnycastIpAddressEntry DeleteCompartment DeleteIPAddress DeleteIpForwardEntry DeleteIpForwardEntry2 DeleteIpNetEntry DeleteIpNetEntry2 DeletePersistentTcpPortReservation DeletePersistentUdpPortReservation DeleteProxyArpEntry DeleteUnicastIpAddressEntry DisableMediaSense EnableRouter FlushIpNetTable FlushIpNetTable2 FlushIpPathTable FreeDnsSettings FreeInterfaceDnsSettings FreeMibTable GetAdapterIndex GetAdapterOrderMap GetAdaptersAddresses GetAdaptersInfo GetAnycastIpAddressEntry GetAnycastIpAddressTable GetBestInterface GetBestInterfaceEx GetBestRoute GetBestRoute2 GetCurrentThreadCompartmentId GetCurrentThreadCompartmentScope GetDefaultCompartmentId GetDnsSettings GetExtendedTcpTable GetExtendedUdpTable GetFriendlyIfIndex GetIcmpStatistics GetIcmpStatisticsEx GetIfEntry GetIfEntry2 GetIfEntry2Ex GetIfStackTable GetIfTable GetIfTable2 GetIfTable2Ex GetInterfaceCompartmentId GetInterfaceCurrentTimestampCapabilities GetInterfaceDnsSettings GetInterfaceHardwareTimestampCapabilities GetInterfaceInfo GetInvertedIfStackTable GetIpAddrTable GetIpErrorString GetIpForwardEntry2 GetIpForwardTable GetIpForwardTable2 GetIpInterfaceEntry GetIpInterfaceTable GetIpNetEntry2 GetIpNetTable GetIpNetTable2 GetIpNetworkConnectionBandwidthEstimates GetIpPathEntry GetIpPathTable GetIpStatistics GetIpStatisticsEx GetJobCompartmentId GetMulticastIpAddressEntry GetMulticastIpAddressTable GetNetworkInformation GetNetworkParams GetNumberOfInterfaces GetOwnerModuleFromPidAndInfo GetOwnerModuleFromTcp6Entry GetOwnerModuleFromTcpEntry GetOwnerModuleFromUdp6Entry GetOwnerModuleFromUdpEntry GetPerAdapterInfo GetPerTcp6ConnectionEStats GetPerTcp6ConnectionStats GetPerTcpConnectionEStats GetPerTcpConnectionStats GetRTTAndHopCount GetSessionCompartmentId GetTcp6Table GetTcp6Table2 GetTcpStatistics GetTcpStatisticsEx GetTcpStatisticsEx2 GetTcpTable GetTcpTable2 GetTeredoPort GetUdp6Table GetUdpStatistics GetUdpStatisticsEx GetUdpStatisticsEx2 GetUdpTable GetUniDirectionalAdapterInfo GetUnicastIpAddressEntry GetUnicastIpAddressTable GetWPAOACSupportLevel Icmp6CreateFile Icmp6ParseReplies Icmp6SendEcho2 IcmpCloseHandle IcmpCreateFile IcmpParseReplies IcmpSendEcho IcmpSendEcho2 IcmpSendEcho2Ex InitializeCompartmentEntry InitializeIpForwardEntry InitializeIpInterfaceEntry InitializeUnicastIpAddressEntry InternalCleanupPersistentStore InternalCreateAnycastIpAddressEntry InternalCreateIpForwardEntry InternalCreateIpForwardEntry2 InternalCreateIpNetEntry InternalCreateIpNetEntry2 InternalCreateUnicastIpAddressEntry InternalDeleteAnycastIpAddressEntry InternalDeleteIpForwardEntry InternalDeleteIpForwardEntry2 InternalDeleteIpNetEntry InternalDeleteIpNetEntry2 InternalDeleteUnicastIpAddressEntry InternalFindInterfaceByAddress InternalGetAnycastIpAddressEntry InternalGetAnycastIpAddressTable InternalGetBoundTcp6EndpointTable InternalGetBoundTcpEndpointTable InternalGetForwardIpTable2 InternalGetIPPhysicalInterfaceForDestination InternalGetIfEntry2 InternalGetIfTable InternalGetIfTable2 InternalGetIpAddrTable InternalGetIpForwardEntry2 InternalGetIpForwardTable InternalGetIpInterfaceEntry InternalGetIpInterfaceTable InternalGetIpNetEntry2 InternalGetIpNetTable InternalGetIpNetTable2 InternalGetMulticastIpAddressEntry InternalGetMulticastIpAddressTable InternalGetRtcSlotInformation InternalGetTcp6Table2 InternalGetTcp6TableWithOwnerModule InternalGetTcp6TableWithOwnerPid InternalGetTcpTable InternalGetTcpTable2 InternalGetTcpTableEx InternalGetTcpTableWithOwnerModule InternalGetTcpTableWithOwnerPid InternalGetTunnelPhysicalAdapter InternalGetUdp6TableWithOwnerModule InternalGetUdp6TableWithOwnerPid InternalGetUdpTable InternalGetUdpTableEx InternalGetUdpTableWithOwnerModule InternalGetUdpTableWithOwnerPid InternalGetUnicastIpAddressEntry InternalGetUnicastIpAddressTable InternalIcmpCreateFileEx InternalSetIfEntry InternalSetIpForwardEntry InternalSetIpForwardEntry2 InternalSetIpInterfaceEntry InternalSetIpNetEntry InternalSetIpNetEntry2 InternalSetIpStats InternalSetTcpEntry InternalSetTeredoPort InternalSetUnicastIpAddressEntry IpReleaseAddress IpRenewAddress LookupPersistentTcpPortReservation LookupPersistentUdpPortReservation NTPTimeToNTFileTime NTTimeToNTPTime NhGetGuidFromInterfaceName NhGetInterfaceDescriptionFromGuid NhGetInterfaceNameFromDeviceGuid NhGetInterfaceNameFromGuid NhpAllocateAndGetInterfaceInfoFromStack NotifyAddrChange NotifyCompartmentChange NotifyIfTimestampConfigChange NotifyIpInterfaceChange NotifyRouteChange NotifyRouteChange2 NotifyStableUnicastIpAddressTable NotifyTeredoPortChange NotifyUnicastIpAddressChange OpenCompartment ParseNetworkString PfAddFiltersToInterface PfAddGlobalFilterToInterface PfBindInterfaceToIPAddress PfBindInterfaceToIndex PfCreateInterface PfDeleteInterface PfDeleteLog PfGetInterfaceStatistics PfMakeLog PfRebindFilters PfRemoveFilterHandles PfRemoveFiltersFromInterface PfRemoveGlobalFilterFromInterface PfSetLogBuffer PfTestPacket PfUnBindInterface ResolveIpNetEntry2 ResolveNeighbor RestoreMediaSense SendARP SetAdapterIpAddress SetCurrentThreadCompartmentId SetCurrentThreadCompartmentScope SetDnsSettings SetIfEntry SetInterfaceDnsSettings SetIpForwardEntry SetIpForwardEntry2 SetIpInterfaceEntry SetIpNetEntry SetIpNetEntry2 SetIpStatistics SetIpStatisticsEx SetIpTTL SetJobCompartmentId SetNetworkInformation SetPerTcp6ConnectionEStats SetPerTcp6ConnectionStats SetPerTcpConnectionEStats SetPerTcpConnectionStats SetSessionCompartmentId SetTcpEntry SetUnicastIpAddressEntry UnenableRouter do_echo_rep do_echo_req if_indextoname if_nametoindex register_icmp

Name

.text

Size

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

492B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

2o2dy0

Size

Virtual Size

7.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

2o2dy1

Size

512B

Virtual Size

176B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

2o2dy2

Size

12.9MB

Virtual Size

12.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

268B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

48a92d0c37b8abd0edeb9daca78c2e55a0b14c942cc796459f93e2d22ffc93de

kernel32

user32

vcruntime140

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

generic