b5792b446a82d27d51b53a6f9cc1f31ca175872df2282eee7ec658759ac964b6

Sharing

Copy URL Twitter E-mail

General

Target
b5792b446a82d27d51b53a6f9cc1f31ca175872df2282eee7ec658759ac964b6
Size 1.2MB
Sample260730-s9vdls1fja
SHA256 b5792b446a82d27d51b53a6f9cc1f31ca175872df2282eee7ec658759ac964b6
MD5 b1272f2fa138e111f6bc2e0ce07f786c
SHA1 dc804a1fe08ae6e70a3983997cbba85297cdb924
SHA512 2c27e0bb31604dc36d6704986615197639f8eae85a8684c30e68d5ee26cd21a245d6ac178b97cb28bd7da2993b6914e968d860c89dfc20e212c29ad02c4cfa26
SSDEEP 12288:yWNHewXnfRulNSr085PuH9pEH80CfR+Anz83cI34tNBlFCQuiYlwY+0:yW8wXnJulNSr08duAHbCfRnb+H4av
TLSH
T12D45F926B768A1E9C1BBC0B882934F61B92170C90B356FF745C1467A2F26DF86E7D314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b5792b446a82d27d51b53a6f9cc1f31ca175872df2282eee7ec658759ac964b6

File Explorer

b5792b446a82d27d51b53a6f9cc1f31ca175872df2282eee7ec658759ac964b6

.exe 1.2MB

b5792b446a82d27d51b53a6f9cc1f31ca175872df2282eee7ec658759ac964b6

IMPHASH d2e64024fce00ab49d2a9c1cd067f336
SHA256 b5792b446a82d27d51b53a6f9cc1f31ca175872df2282eee7ec658759ac964b6
MD5 b1272f2fa138e111f6bc2e0ce07f786c
SHA1 dc804a1fe08ae6e70a3983997cbba85297cdb924
SHA512 2c27e0bb31604dc36d6704986615197639f8eae85a8684c30e68d5ee26cd21a245d6ac178b97cb28bd7da2993b6914e968d860c89dfc20e212c29ad02c4cfa26
SSDEEP 12288:yWNHewXnfRulNSr085PuH9pEH80CfR+Anz83cI34tNBlFCQuiYlwY+0:yW8wXnJulNSr08duAHbCfRnb+H4av
TLSH
T12D45F926B768A1E9C1BBC0B882934F61B92170C90B356FF745C1467A2F26DF86E7D314
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

794504

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

build_script_build-b67c018ca355a0c9.pdb

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

kernel32

PeekNamedPipe CloseHandle WaitForMultipleObjects WaitForSingleObject GetProcAddress LoadLibraryA GetNativeSystemInfo GetProcessHeap HeapFree HeapReAlloc lstrlenW GetCurrentProcess WideCharToMultiByte WaitForSingleObjectEx GetCurrentProcessId CreateMutexA ReleaseMutex SetFilePointerEx GetLastError SetFileInformationByHandle FlushFileBuffers DuplicateHandle AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread SetLastError GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW GetCommandLineW CreateDirectoryW GetFileInformationByHandleEx CompareStringW CreateEventW GetOverlappedResult GetFileInformationByHandle DeleteFileW FindFirstFileExW FindClose GetConsoleMode GetFileType SetEnvironmentVariableW GetFullPathNameW GetCurrentThreadId GetModuleHandleA GetTempPathW GetModuleFileNameW GetModuleHandleW FormatMessageW ExitProcess ReadFileEx SleepEx ReadFile CancelIo HeapAlloc MultiByteToWideChar WriteConsoleW GetStdHandle GetConsoleOutputCP CreateThread FreeEnvironmentStringsW GetFileAttributesW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW WriteFileEx QueryPerformanceCounter GetExitCodeProcess TerminateProcess RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind FindNextFileW LCMapStringW HeapSize CreateFileW VirtualProtect InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc GetStringTypeW SetStdHandle GetCPInfo GetOEMCP GetACP IsValidCodePage GetCommandLineA GetModuleHandleExW WriteFile LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer RaiseException RtlPcToFileHeader RtlUnwindEx IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent

advapi32

RegCloseKey RegQueryValueExW RegOpenKeyExW RegEnumKeyExW

ole32

CoCreateInstance CoInitializeEx

oleaut32

SysFreeString SysStringLen

ntdll

RtlNtStatusToDosError NtOpenFile NtReadFile NtCreateNamedPipeFile NtWriteFile

Name

.text

Size

835KB

Virtual Size

835KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

306KB

Virtual Size

305KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

59KB

Virtual Size

59KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

b5792b446a82d27d51b53a6f9cc1f31ca175872df2282eee7ec658759ac964b6

bcryptprimitives

api-ms-win-core-synch-l1-2-0

kernel32

advapi32

ole32

oleaut32

ntdll

generic