5001385046b09c123e584d4bd74262543a44b93261d9978eeec2017b3932fee4

Sharing

Copy URL Twitter E-mail

General

Target
5001385046b09c123e584d4bd74262543a44b93261d9978eeec2017b3932fee4
Size 6.9MB
Sample260730-t5eysssclc
SHA256 5001385046b09c123e584d4bd74262543a44b93261d9978eeec2017b3932fee4
MD5 5fe8f79fbe21aca25e3d95603c5a55c4
SHA1 a586a2d193b5a76591526593ec8c7d5dea739f11
SHA512 77fdd4564ed363e0bd9ef7adccb418df0c05715123ed3fee0f3ec8104070f18fb90adc53c45bebfc67c97149d05cf61b3c535d101dc3f00d972b0f1b94b2a89f
SSDEEP 49152:7aw5wXLyYskhZMS/gxRSzwFZeUEg6unj1gB14nHN6ecd4E7PiNprlz/uRiP0T27V:7kLyiZeZ1DtpwiOHTEGbtAs+AsE
TLSH
T1C076D7166779A0DDC1BBC079C2835F21B92270D94B392BE346C1867A2F25EF86D3D364
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5001385046b09c123e584d4bd74262543a44b93261d9978eeec2017b3932fee4

File Explorer

5001385046b09c123e584d4bd74262543a44b93261d9978eeec2017b3932fee4

.exe 6.9MB

5001385046b09c123e584d4bd74262543a44b93261d9978eeec2017b3932fee4

IMPHASH fa6f7bf32fa125c92a8c6fda3daa615f
SHA256 5001385046b09c123e584d4bd74262543a44b93261d9978eeec2017b3932fee4
MD5 5fe8f79fbe21aca25e3d95603c5a55c4
SHA1 a586a2d193b5a76591526593ec8c7d5dea739f11
SHA512 77fdd4564ed363e0bd9ef7adccb418df0c05715123ed3fee0f3ec8104070f18fb90adc53c45bebfc67c97149d05cf61b3c535d101dc3f00d972b0f1b94b2a89f
SSDEEP 49152:7aw5wXLyYskhZMS/gxRSzwFZeUEg6unj1gB14nHN6ecd4E7PiNprlz/uRiP0T27V:7kLyiZeZ1DtpwiOHTEGbtAs+AsE
TLSH
T1C076D7166779A0DDC1BBC079C2835F21B92270D94B392BE346C1867A2F25EF86D3D364
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4925872

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

build_script_build-802d1159c7f6cf52.pdb

kernel32

PostQueuedCompletionStatus GetQueuedCompletionStatusEx CreateIoCompletionPort SetHandleInformation WriteFile SetFileCompletionNotificationModes IsProcessorFeaturePresent GetStartupInfoW TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary FlsAlloc FlsGetValue FlsSetValue FlsFree CloseHandle LCMapStringW CompareStringW VirtualProtect InitializeCriticalSectionEx GetStringTypeW SetStdHandle GetCPInfo GetOEMCP GetACP IsValidCodePage GetCommandLineA GetModuleHandleExW LoadLibraryExW InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapSize RaiseException RtlPcToFileHeader RtlUnwindEx IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime SetUnhandledExceptionFilter UnhandledExceptionFilter FindNextFileW RtlLookupFunctionEntry RtlCaptureContext TerminateProcess QueryPerformanceCounter GetSystemTimePreciseAsFileTime EncodePointer GetFileType RtlVirtualUnwind GetProcessHeap HeapFree HeapReAlloc lstrlenW GetCurrentProcess GetProcAddress WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA GetCurrentProcessId CreateMutexA ReleaseMutex SetFilePointerEx GetLastError SetFileInformationByHandle FlushFileBuffers WaitForSingleObject AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread SetLastError GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW GetCommandLineW CopyFileExW CreateDirectoryW GetFileInformationByHandleEx SwitchToThread CreateFileW GetFileInformationByHandle DeleteFileW GetFinalPathNameByHandleW FindFirstFileExW FindClose GetConsoleMode SetEnvironmentVariableW GetFullPathNameW GetCurrentThreadId GetModuleHandleA GetModuleFileNameW GetModuleHandleW FormatMessageW ExitProcess QueryPerformanceFrequency HeapAlloc MultiByteToWideChar WriteConsoleW GetStdHandle GetConsoleOutputCP CreateThread FreeEnvironmentStringsW

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

ws2_32

shutdown connect WSASocketW closesocket send recv bind WSAIoctl WSASend ioctlsocket getsockname getpeername setsockopt getsockopt WSAGetLastError WSAStartup WSACleanup getaddrinfo freeaddrinfo

ntdll

NtCancelIoFileEx NtWriteFile RtlNtStatusToDosError NtCreateFile NtDeviceIoControlFile

bcryptprimitives

ProcessPrng

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

Name

.text

Size

4.8MB

Virtual Size

4.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

12KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

385KB

Virtual Size

385KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

26KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

5001385046b09c123e584d4bd74262543a44b93261d9978eeec2017b3932fee4

kernel32

api-ms-win-core-synch-l1-2-0

ws2_32

ntdll

bcryptprimitives

bcrypt

advapi32

generic