6ccf2854ad20d601296e22891cba752875ff9f99043fb53dfb0fe1ad12292965

Sharing

Copy URL Twitter E-mail

General

Target
6ccf2854ad20d601296e22891cba752875ff9f99043fb53dfb0fe1ad12292965
Size 576KB
Sample260730-pt342ayaja
SHA256 6ccf2854ad20d601296e22891cba752875ff9f99043fb53dfb0fe1ad12292965
MD5 922ee08b17e601edf7d3818bf3b29709
SHA1 3f55b95c9661dc834edb5cebcff72fa81397304a
SHA512 fc8492d176b5cf0e8bc741dae4d747a375ae784eb0cb83469f5a7018b2aa342798e385358da138042090a79ad4f78a9bb7fc6554cb977dc0d22bc0fa60dd0290
SSDEEP 6144:Xo694blliENjTkqro4A1YfA1rt3g/UanIB9eprZcbcxcQ58f0plS+Hr6WkGFkKVP:XMblwE9kqro/YfKxg/rnO9gDHrZ
TLSH
T1F2C40903E2F720ACF1BBD7309BBBA272B932F8511530ED5E5650DA351D31E50663AB26
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6ccf2854ad20d601296e22891cba752875ff9f99043fb53dfb0fe1ad12292965

File Explorer

6ccf2854ad20d601296e22891cba752875ff9f99043fb53dfb0fe1ad12292965

.dll 576KB

6ccf2854ad20d601296e22891cba752875ff9f99043fb53dfb0fe1ad12292965

IMPHASH 9d948f4fc66fe8172a8ffaabf38ff1b3
SHA256 6ccf2854ad20d601296e22891cba752875ff9f99043fb53dfb0fe1ad12292965
MD5 922ee08b17e601edf7d3818bf3b29709
SHA1 3f55b95c9661dc834edb5cebcff72fa81397304a
SHA512 fc8492d176b5cf0e8bc741dae4d747a375ae784eb0cb83469f5a7018b2aa342798e385358da138042090a79ad4f78a9bb7fc6554cb977dc0d22bc0fa60dd0290
SSDEEP 6144:Xo694blliENjTkqro4A1YfA1rt3g/UanIB9eprZcbcxcQ58f0plS+Hr6WkGFkKVP:XMblwE9kqro/YfKxg/rnO9gDHrZ
TLSH
T1F2C40903E2F720ACF1BBD7309BBBA272B932F8511530ED5E5650DA351D31E50663AB26
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16496

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

CloseHandle CreateEventA CreateMutexA DelayLoadFailureHook DisableThreadLibraryCalls FileTimeToSystemTime GetCurrentThreadId GetLastError GetModuleHandleW GetProcAddress GetSystemTimeAsFileTime GetTickCount HeapAlloc HeapReAlloc IsBadStringPtrA IsBadStringPtrW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseMutex ResolveDelayLoadedAPI SetEvent SignalObjectAndWait Sleep TlsAlloc TlsFree TlsGetValue TlsSetValue WaitForSingleObject WideCharToMultiByte

ntdll

RtlAllocateHeap _vsnprintf

ucrtbase

__acrt_iob_func __isascii __stdio_common_vfprintf __stdio_common_vsprintf _assert _beginthreadex _close _ctime64 _endthread _errno _gmtime64 _localtime64 _read _strdup _stricmp _strnicmp _time64 _wcsdup _write atoi calloc fclose feof ferror fflush fgets fopen fputs fread free fwrite getenv isalnum isgraph isprint isspace malloc memchr memcmp memcpy memmove memset realloc strcat strchr strcmp strcpy strcspn strerror strlen strncat strncmp strncpy strstr strtol strtoul wcscmp

user32

LoadStringA LoadStringW

ws2_32

bind closesocket connect getpeername getsockopt htonl ioctlsocket inet_addr ntohl ntohs recv select send setsockopt shutdown socket gethostbyaddr gethostbyname gethostname WSAGetLastError WSASetLastError WSAStartup WSACleanup __WSAFDIsSet freeaddrinfo getaddrinfo getnameinfo inet_ntop

LdapGetLastError LdapMapErrorToWin32 LdapUTF8ToUnicode LdapUnicodeToUTF8 ber_alloc_t ber_bvdup ber_bvecfree ber_bvfree ber_first_element ber_flatten ber_free ber_init ber_next_element ber_peek_tag ber_printf ber_scanf ber_skip_tag cldap_open cldap_openA cldap_openW ldap_abandon ldap_add ldap_addA ldap_addW ldap_add_ext ldap_add_extA ldap_add_extW ldap_add_ext_s ldap_add_ext_sA ldap_add_ext_sW ldap_add_s ldap_add_sA ldap_add_sW ldap_bind ldap_bindA ldap_bindW ldap_bind_s ldap_bind_sA ldap_bind_sW ldap_check_filterA ldap_check_filterW ldap_cleanup ldap_close_extended_op ldap_compare ldap_compareA ldap_compareW ldap_compare_ext ldap_compare_extA ldap_compare_extW ldap_compare_ext_s ldap_compare_ext_sA ldap_compare_ext_sW ldap_compare_s ldap_compare_sA ldap_compare_sW ldap_conn_from_msg ldap_connect ldap_control_free ldap_control_freeA ldap_control_freeW ldap_controls_free ldap_controls_freeA ldap_controls_freeW ldap_count_entries ldap_count_references ldap_count_values ldap_count_valuesA ldap_count_valuesW ldap_count_values_len ldap_create_page_control ldap_create_page_controlA ldap_create_page_controlW ldap_create_sort_control ldap_create_sort_controlA ldap_create_sort_controlW ldap_create_vlv_controlA ldap_create_vlv_controlW ldap_delete ldap_deleteA ldap_deleteW ldap_delete_ext ldap_delete_extA ldap_delete_extW ldap_delete_ext_s ldap_delete_ext_sA ldap_delete_ext_sW ldap_delete_s ldap_delete_sA ldap_delete_sW ldap_dn2ufn ldap_dn2ufnA ldap_dn2ufnW ldap_encode_sort_controlA ldap_encode_sort_controlW ldap_err2string ldap_err2stringA ldap_err2stringW ldap_escape_filter_element ldap_escape_filter_elementA ldap_escape_filter_elementW ldap_explode_dn ldap_explode_dnA ldap_explode_dnW ldap_extended_operation ldap_extended_operationA ldap_extended_operationW ldap_extended_operation_sA ldap_extended_operation_sW ldap_first_attribute ldap_first_attributeA ldap_first_attributeW ldap_first_entry ldap_first_reference ldap_free_controls ldap_free_controlsA ldap_free_controlsW ldap_get_dn ldap_get_dnA ldap_get_dnW ldap_get_next_page ldap_get_next_page_s ldap_get_option ldap_get_optionA ldap_get_optionW ldap_get_paged_count ldap_get_values ldap_get_valuesA ldap_get_valuesW ldap_get_values_len ldap_get_values_lenA ldap_get_values_lenW ldap_init ldap_initA ldap_initW ldap_memfree ldap_memfreeA ldap_memfreeW ldap_modify ldap_modifyA ldap_modifyW ldap_modify_ext ldap_modify_extA ldap_modify_extW ldap_modify_ext_s ldap_modify_ext_sA ldap_modify_ext_sW ldap_modify_s ldap_modify_sA ldap_modify_sW ldap_modrdn ldap_modrdn2 ldap_modrdn2A ldap_modrdn2W ldap_modrdn2_s ldap_modrdn2_sA ldap_modrdn2_sW ldap_modrdnA ldap_modrdnW ldap_modrdn_s ldap_modrdn_sA ldap_modrdn_sW ldap_msgfree ldap_next_attribute ldap_next_attributeA ldap_next_attributeW ldap_next_entry ldap_next_reference ldap_open ldap_openA ldap_openW ldap_parse_extended_resultA ldap_parse_extended_resultW ldap_parse_page_control ldap_parse_page_controlA ldap_parse_page_controlW ldap_parse_reference ldap_parse_referenceA ldap_parse_referenceW ldap_parse_result ldap_parse_resultA ldap_parse_resultW ldap_parse_sort_control ldap_parse_sort_controlA ldap_parse_sort_controlW ldap_parse_vlv_controlA ldap_parse_vlv_controlW ldap_perror ldap_rename_ext ldap_rename_extA ldap_rename_extW ldap_rename_ext_s ldap_rename_ext_sA ldap_rename_ext_sW ldap_result ldap_result2error ldap_sasl_bindA ldap_sasl_bindW ldap_sasl_bind_sA ldap_sasl_bind_sW ldap_search ldap_searchA ldap_searchW ldap_search_abandon_page ldap_search_ext ldap_search_extA ldap_search_extW ldap_search_ext_s ldap_search_ext_sA ldap_search_ext_sW ldap_search_init_page ldap_search_init_pageA ldap_search_init_pageW ldap_search_s ldap_search_sA ldap_search_sW ldap_search_st ldap_search_stA ldap_search_stW ldap_set_dbg_flags ldap_set_dbg_routine ldap_set_option ldap_set_optionA ldap_set_optionW ldap_simple_bind ldap_simple_bindA ldap_simple_bindW ldap_simple_bind_s ldap_simple_bind_sA ldap_simple_bind_sW ldap_sslinit ldap_sslinitA ldap_sslinitW ldap_start_tls_sA ldap_start_tls_sW ldap_startup ldap_stop_tls_s ldap_ufn2dn ldap_ufn2dnA ldap_ufn2dnW ldap_unbind ldap_unbind_s ldap_value_free ldap_value_freeA ldap_value_freeW ldap_value_free_len

Name

.text

Size

352KB

Virtual Size

350KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

32KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

4KB

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

16KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

16KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

8KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

100KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

452B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/14

Size

4KB

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/29

Size

4KB

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/41

Size

4KB

Virtual Size

20B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/55

Size

4KB

Virtual Size

92B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/67

Size

4KB

Virtual Size

72B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/80

Size

4KB

Virtual Size

231B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/91

Size

4KB

Virtual Size

219B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

6ccf2854ad20d601296e22891cba752875ff9f99043fb53dfb0fe1ad12292965

kernel32

ntdll

ucrtbase

user32

ws2_32

generic