54c3b2c9bcbd61936e789e82268116dfd844fd1aca0ef90f1ac01bd9d891415c

General

Target
54c3b2c9bcbd61936e789e82268116dfd844fd1aca0ef90f1ac01bd9d891415c
Size 376KB
Sample260730-ll3azsfb75
SHA256 54c3b2c9bcbd61936e789e82268116dfd844fd1aca0ef90f1ac01bd9d891415c
MD5 21804efbcf7aa94a4ae0d4e972bcfce5
SHA1 6e753bcdff9ec2e9bbe41a7857bd7084c583c9be
SHA512 f212784c2727311690af6651fe93d3e15cda8edc8a6e4ef56b26f9114288b88d6daade1782a32e708e4ace6b9878518e6597f074e086841225312f1435d6052f
SSDEEP 6144:xHCOGJ6FizuqTdxhzk1IWpE7ularj3muhkFWHEM3rESx6LU:IOGMUuqTrhzk1IWpEilQ3mue+EgrESx1
TLSH
T11F84070762EC3DD6E5729638A77347C2E7BAFC022670D60E02E485592E3F653B9293D1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
54c3b2c9bcbd61936e789e82268116dfd844fd1aca0ef90f1ac01bd9d891415c

File Explorer

54c3b2c9bcbd61936e789e82268116dfd844fd1aca0ef90f1ac01bd9d891415c

.exe 376KB

54c3b2c9bcbd61936e789e82268116dfd844fd1aca0ef90f1ac01bd9d891415c

IMPHASH a04d577133d0899e9162c705fe58113b
SHA256 54c3b2c9bcbd61936e789e82268116dfd844fd1aca0ef90f1ac01bd9d891415c
MD5 21804efbcf7aa94a4ae0d4e972bcfce5
SHA1 6e753bcdff9ec2e9bbe41a7857bd7084c583c9be
SHA512 f212784c2727311690af6651fe93d3e15cda8edc8a6e4ef56b26f9114288b88d6daade1782a32e708e4ace6b9878518e6597f074e086841225312f1435d6052f
SSDEEP 6144:xHCOGJ6FizuqTdxhzk1IWpE7ularj3muhkFWHEM3rESx6LU:IOGMUuqTrhzk1IWpEilQ3mue+EgrESx1
TLSH
T11F84070762EC3DD6E5729638A77347C2E7BAFC022670D60E02E485592E3F653B9293D1
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

51708

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\_work\1\s\binaries\x64\Release\vsjitdebugger.pdb

kernel32

RaiseException OpenEventW CreateToolhelp32Snapshot Module32FirstW Module32NextW IsWow64Process GetCommandLineW SetErrorMode HeapSetInformation AddVectoredExceptionHandler IsDebuggerPresent SetUnhandledExceptionFilter GetExitCodeProcess DuplicateHandle ReadFile SetFilePointer OpenFileMappingW ConvertDefaultLocale GetThreadUILanguage QueryFullProcessImageNameW SetEnvironmentVariableW GetEnvironmentVariableW MultiByteToWideChar FreeLibrary lstrcmpiW GetPrivateProfileStringW CreateEventExW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader InterlockedPushEntrySList EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetCurrentThread GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage LeaveCriticalSection GetOEMCP GetCPInfo GetCommandLineA WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW OutputDebugStringW SetStdHandle GetStringTypeW SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode WriteConsoleW EnterCriticalSection SetLastError OpenProcess GetTickCount Sleep GetCurrentProcessId FindResourceW LoadResource FindResourceExW CreateThread LockResource SetEvent GetExitCodeThread QueueUserWorkItem GetCurrentProcess SizeofResource LoadLibraryExW LoadLibraryW OpenThread GetThreadContext DebugSetProcessKillOnExit MapViewOfFile CreateFileMappingW GetModuleHandleW CreateProcessW GetProcessHeap ReadProcessMemory DeleteCriticalSection GetProcAddress HeapDestroy DecodePointer HeapAlloc CloseHandle HeapReAlloc GetLastError GetFileInformationByHandle GetSystemWow64DirectoryW CreateEventW HeapSize GetCurrentThreadId InterlockedPopEntrySList FlushInstructionCache VirtualAlloc VirtualFree LoadLibraryExA GetSystemInfo VirtualProtect VirtualQuery FormatMessageW LocalFree FormatMessageA GetThreadLocale GetVersion ProcessIdToSessionId GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetModuleHandleA CheckRemoteDebuggerPresent ReleaseMutex OpenMutexW UnmapViewOfFile ContinueDebugEvent ResumeThread SuspendThread DebugActiveProcessStop GetFileAttributesW CreateFileW WaitForSingleObject InitializeCriticalSectionEx WaitForMultipleObjects GetModuleFileNameW TerminateProcess WaitForDebugEvent HeapFree WriteProcessMemory SearchPathW GetACP GetStartupInfoW

advapi32

GetKernelObjectSecurity PrivilegeCheck AccessCheck SetSecurityDescriptorOwner GetSidSubAuthorityCount AllocateAndInitializeSid IsValidSecurityDescriptor OpenProcessToken FreeSid DuplicateToken AddAccessAllowedAce OpenThreadToken LookupAccountSidW SetSecurityDescriptorGroup GetSidIdentifierAuthority GetTokenInformation DeregisterEventSource RegDeleteKeyW RegEnumKeyExW RegisterEventSourceW ReportEventW GetSecurityDescriptorSacl SetSecurityDescriptorDacl GetSecurityDescriptorDacl RegGetKeySecurity GetAclInformation RegQueryInfoKeyW GetAce EqualSid GetSecurityDescriptorGroup GetSidSubAuthority GetSidLengthRequired RegCreateKeyExW GetSecurityDescriptorControl CopySid InitializeSid GetSecurityDescriptorOwner RegSetKeySecurity IsValidSid AddAce InitializeSecurityDescriptor InitializeAcl GetLengthSid GetSecurityDescriptorLength MakeSelfRelativeSD MakeAbsoluteSD CreateRestrictedToken SetThreadToken DuplicateTokenEx RegQueryValueExW RegCloseKey RegSetValueExW RegOpenKeyExW RegDeleteValueW LookupPrivilegeValueW AdjustTokenPrivileges

Name

.text

Size

211KB

Virtual Size

211KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

76KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

60KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

54c3b2c9bcbd61936e789e82268116dfd844fd1aca0ef90f1ac01bd9d891415c

kernel32

advapi32

generic