ad681fb8bee897e0443032b1ed35c3f5cd8223c8334f0e6bc71b25b1e089e05f

Sharing

Copy URL Twitter E-mail

General

Target
ad681fb8bee897e0443032b1ed35c3f5cd8223c8334f0e6bc71b25b1e089e05f
Size 243KB
Sample260730-kzcf2syshz
SHA256 ad681fb8bee897e0443032b1ed35c3f5cd8223c8334f0e6bc71b25b1e089e05f
MD5 14692c1fff86f8c30004390e254c47d8
SHA1 0a9a5d5b9329ae9a2ed07858a35136b93d1d1146
SHA512 16abed7cadf937333deb72cc864055bc78de0ce19e146899ca9de90395c786212155ad450f7a59642f52e5f54359146f0945fc19401507753be83a95da6f3f07
SSDEEP 6144:0CyTdSeo9tTw/zPp5AzPmZy3Wmtq89Qjja4:ISwjzAzPm0W789Qjja4
TLSH
T1823429E3B9E54CE9C667913462CAD2723638FCE003129B4BA26097311F27ED06FD95D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ad681fb8bee897e0443032b1ed35c3f5cd8223c8334f0e6bc71b25b1e089e05f

File Explorer

ad681fb8bee897e0443032b1ed35c3f5cd8223c8334f0e6bc71b25b1e089e05f

.exe 243KB

ad681fb8bee897e0443032b1ed35c3f5cd8223c8334f0e6bc71b25b1e089e05f

IMPHASH c83373427cafaa4be577a9fd10a603f9
SHA256 ad681fb8bee897e0443032b1ed35c3f5cd8223c8334f0e6bc71b25b1e089e05f
MD5 14692c1fff86f8c30004390e254c47d8
SHA1 0a9a5d5b9329ae9a2ed07858a35136b93d1d1146
SHA512 16abed7cadf937333deb72cc864055bc78de0ce19e146899ca9de90395c786212155ad450f7a59642f52e5f54359146f0945fc19401507753be83a95da6f3f07
SSDEEP 6144:0CyTdSeo9tTw/zPp5AzPmZy3Wmtq89Qjja4:ISwjzAzPm0W789Qjja4
TLSH
T1823429E3B9E54CE9C667913462CAD2723638FCE003129B4BA26097311F27ED06FD95D9
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4191

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CloseHandle CreateEventA CreatePipe CreateProcessA CreateSemaphoreA DeleteCriticalSection DuplicateHandle EnterCriticalSection FreeLibrary GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetLastError GetModuleHandleA GetProcAddress GetProcessAffinityMask GetStartupInfoA GetSystemTimeAsFileTime GetThreadContext GetThreadPriority GetTickCount InitializeCriticalSection IsDBCSLeadByte LeaveCriticalSection LoadLibraryA MultiByteToWideChar OpenProcess OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReleaseSemaphore ResetEvent ResumeThread SetEvent SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TerminateThread TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WriteFile

api-ms-win-crt-convert-l1-1-0

atoi mbsrtowcs strtol

api-ms-win-crt-environment-l1-1-0

__p__environ

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr pow

api-ms-win-crt-private-l1-1-0

__C_specific_handler __intrinsic_setjmp longjmp memcpy memmove strchr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv __p__acmdln _assert _beginthreadex _cexit _configure_narrow_argv _crt_atexit _endthreadex _errno _exit _initialize_narrow_environment _set_app_type _initterm _initterm_e _set_invalid_parameter_handler abort exit signal

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf _fileno _setmode fclose feof ferror fflush fgetc fopen fread fseek ftell setvbuf ungetc

api-ms-win-crt-string-l1-1-0

_strdup memset strcmp strlen strncmp

user32

MessageBoxA

wininet

InternetCloseHandle InternetOpenUrlW InternetOpenW InternetReadFile

ws2_32

WSAStartup closesocket connect htons inet_addr recv send socket

Name

.text

Size

127KB

Virtual Size

126KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

576B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

608B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

124B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/14

Size

512B

Virtual Size

144B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/29

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/41

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/55

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/67

Size

512B

Virtual Size

352B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/80

Size

512B

Virtual Size

149B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/91

Size

1024B

Virtual Size

828B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/107

Size

1024B

Virtual Size

987B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/123

Size

512B

Virtual Size

173B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ad681fb8bee897e0443032b1ed35c3f5cd8223c8334f0e6bc71b25b1e089e05f

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

user32

wininet

ws2_32

generic