147ee67fc583f93aed8415821ebcac05821e230d3bdac3361720acedb55681c1

General

Target
147ee67fc583f93aed8415821ebcac05821e230d3bdac3361720acedb55681c1
Size 376KB
Sample260730-ms3e1aga85
SHA256 147ee67fc583f93aed8415821ebcac05821e230d3bdac3361720acedb55681c1
MD5 049120b232c8be59ca401d36942ba6ff
SHA1 59a7f07db8e3bace3cb17c0edcdcc86eeec7d14f
SHA512 f3a2f70cad99a12a5812e74dc68cab84c1f839431ea035c3b1b338bc595bf9c0f7df87f44bc8c98f1035f34bf1f34d9cdf29eaebae1e89f4061397b718471674
SSDEEP 6144:xHCOGJ6gNizuqTdxhzk1IWpE7ularj3muhkFWHEM3rEux6LU:IOGMgsuqTrhzk1IWpEilQ3mue+EgrEuf
TLSH
T19B84070762EC3DD6E5729638A77347C2E7BAFC022670D60E02E485592E3F653B9293D1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
147ee67fc583f93aed8415821ebcac05821e230d3bdac3361720acedb55681c1

File Explorer

147ee67fc583f93aed8415821ebcac05821e230d3bdac3361720acedb55681c1

.exe 376KB

147ee67fc583f93aed8415821ebcac05821e230d3bdac3361720acedb55681c1

IMPHASH a04d577133d0899e9162c705fe58113b
SHA256 147ee67fc583f93aed8415821ebcac05821e230d3bdac3361720acedb55681c1
MD5 049120b232c8be59ca401d36942ba6ff
SHA1 59a7f07db8e3bace3cb17c0edcdcc86eeec7d14f
SHA512 f3a2f70cad99a12a5812e74dc68cab84c1f839431ea035c3b1b338bc595bf9c0f7df87f44bc8c98f1035f34bf1f34d9cdf29eaebae1e89f4061397b718471674
SSDEEP 6144:xHCOGJ6gNizuqTdxhzk1IWpE7ularj3muhkFWHEM3rEux6LU:IOGMgsuqTrhzk1IWpEilQ3mue+EgrEuf
TLSH
T19B84070762EC3DD6E5729638A77347C2E7BAFC022670D60E02E485592E3F653B9293D1
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

51708

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\_work\1\s\binaries\x64\Release\vsjitdebugger.pdb

kernel32

RaiseException OpenEventW CreateToolhelp32Snapshot Module32FirstW Module32NextW IsWow64Process GetCommandLineW SetErrorMode HeapSetInformation AddVectoredExceptionHandler IsDebuggerPresent SetUnhandledExceptionFilter GetExitCodeProcess DuplicateHandle ReadFile SetFilePointer OpenFileMappingW ConvertDefaultLocale GetThreadUILanguage QueryFullProcessImageNameW SetEnvironmentVariableW GetEnvironmentVariableW MultiByteToWideChar FreeLibrary lstrcmpiW GetPrivateProfileStringW CreateEventExW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader InterlockedPushEntrySList EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetCurrentThread GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage LeaveCriticalSection GetOEMCP GetCPInfo GetCommandLineA WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW OutputDebugStringW SetStdHandle GetStringTypeW SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode WriteConsoleW EnterCriticalSection SetLastError OpenProcess GetTickCount Sleep GetCurrentProcessId FindResourceW LoadResource FindResourceExW CreateThread LockResource SetEvent GetExitCodeThread QueueUserWorkItem GetCurrentProcess SizeofResource LoadLibraryExW LoadLibraryW OpenThread GetThreadContext DebugSetProcessKillOnExit MapViewOfFile CreateFileMappingW GetModuleHandleW CreateProcessW GetProcessHeap ReadProcessMemory DeleteCriticalSection GetProcAddress HeapDestroy DecodePointer HeapAlloc CloseHandle HeapReAlloc GetLastError GetFileInformationByHandle GetSystemWow64DirectoryW CreateEventW HeapSize GetCurrentThreadId InterlockedPopEntrySList FlushInstructionCache VirtualAlloc VirtualFree LoadLibraryExA GetSystemInfo VirtualProtect VirtualQuery FormatMessageW LocalFree FormatMessageA GetThreadLocale GetVersion ProcessIdToSessionId GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetModuleHandleA CheckRemoteDebuggerPresent ReleaseMutex OpenMutexW UnmapViewOfFile ContinueDebugEvent ResumeThread SuspendThread DebugActiveProcessStop GetFileAttributesW CreateFileW WaitForSingleObject InitializeCriticalSectionEx WaitForMultipleObjects GetModuleFileNameW TerminateProcess WaitForDebugEvent HeapFree WriteProcessMemory SearchPathW GetACP GetStartupInfoW

advapi32

GetKernelObjectSecurity PrivilegeCheck AccessCheck SetSecurityDescriptorOwner GetSidSubAuthorityCount AllocateAndInitializeSid IsValidSecurityDescriptor OpenProcessToken FreeSid DuplicateToken AddAccessAllowedAce OpenThreadToken LookupAccountSidW SetSecurityDescriptorGroup GetSidIdentifierAuthority GetTokenInformation DeregisterEventSource RegDeleteKeyW RegEnumKeyExW RegisterEventSourceW ReportEventW GetSecurityDescriptorSacl SetSecurityDescriptorDacl GetSecurityDescriptorDacl RegGetKeySecurity GetAclInformation RegQueryInfoKeyW GetAce EqualSid GetSecurityDescriptorGroup GetSidSubAuthority GetSidLengthRequired RegCreateKeyExW GetSecurityDescriptorControl CopySid InitializeSid GetSecurityDescriptorOwner RegSetKeySecurity IsValidSid AddAce InitializeSecurityDescriptor InitializeAcl GetLengthSid GetSecurityDescriptorLength MakeSelfRelativeSD MakeAbsoluteSD CreateRestrictedToken SetThreadToken DuplicateTokenEx RegQueryValueExW RegCloseKey RegSetValueExW RegOpenKeyExW RegDeleteValueW LookupPrivilegeValueW AdjustTokenPrivileges

Name

.text

Size

211KB

Virtual Size

211KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

76KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

60KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

147ee67fc583f93aed8415821ebcac05821e230d3bdac3361720acedb55681c1

kernel32

advapi32

generic