4dcf62080973083cff5e3312ab8a08a6360157a98ef26041e8c4f239b593ee9c

Sharing

Copy URL Twitter E-mail

General

Target
4dcf62080973083cff5e3312ab8a08a6360157a98ef26041e8c4f239b593ee9c
Size 1.3MB
Sample260730-t6882awsa1
SHA256 4dcf62080973083cff5e3312ab8a08a6360157a98ef26041e8c4f239b593ee9c
MD5 56f8fad8aa30143db3f036ddab683b90
SHA1 d33ab06ca75d247a4add9d232544c3b81dd57f7a
SHA512 107be68c0cb929e7e866920c477222db1d47b17558f6cdc021c2f8985bb79d39528beac6e06ce2722c22793247a8fdc9ec500e92854f2802d5f133fa88b82b42
SSDEEP 24576:YqrpLyv/NTSV7wpIH9FQRPk10gK5ka9KlO:Xr/V7wpIdKFkrKkauO
TLSH
T1E7550716A664A5EDC1BBC078C2838F26B93170C90B356FF745D4867A2E25EF86E3C714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4dcf62080973083cff5e3312ab8a08a6360157a98ef26041e8c4f239b593ee9c

File Explorer

4dcf62080973083cff5e3312ab8a08a6360157a98ef26041e8c4f239b593ee9c

.exe 1.3MB

4dcf62080973083cff5e3312ab8a08a6360157a98ef26041e8c4f239b593ee9c

IMPHASH 9644aaf569986dc2d8c99e681436d5b6
SHA256 4dcf62080973083cff5e3312ab8a08a6360157a98ef26041e8c4f239b593ee9c
MD5 56f8fad8aa30143db3f036ddab683b90
SHA1 d33ab06ca75d247a4add9d232544c3b81dd57f7a
SHA512 107be68c0cb929e7e866920c477222db1d47b17558f6cdc021c2f8985bb79d39528beac6e06ce2722c22793247a8fdc9ec500e92854f2802d5f133fa88b82b42
SSDEEP 24576:YqrpLyv/NTSV7wpIH9FQRPk10gK5ka9KlO:Xr/V7wpIdKFkrKkauO
TLSH
T1E7550716A664A5EDC1BBC078C2838F26B93170C90B356FF745D4867A2E25EF86E3C714
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

921720

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

build_script_build-2957aa3b73e10bd6.pdb

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

kernel32

PeekNamedPipe CloseHandle CreateEventA WaitForMultipleObjects WaitForSingleObject OpenSemaphoreA ReleaseSemaphore SetEvent GetProcAddress LoadLibraryA GetNativeSystemInfo GetProcessHeap HeapFree HeapReAlloc lstrlenW GetCurrentProcess WideCharToMultiByte WaitForSingleObjectEx GetCurrentProcessId CreateMutexA ReleaseMutex SetFilePointerEx GetLastError SetFileInformationByHandle FlushFileBuffers DuplicateHandle AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread SetLastError GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW GetCommandLineW CopyFileExW CreateDirectoryW GetFileInformationByHandleEx SwitchToThread CompareStringW CreateEventW GetOverlappedResult GetFileInformationByHandle DeleteFileW FindFirstFileExW FindClose CreateHardLinkW GetConsoleMode GetFileType SetEnvironmentVariableW GetFullPathNameW GetCurrentThreadId GetModuleHandleA GetTempPathW GetModuleFileNameW GetModuleHandleW FormatMessageW ExitProcess ReadFileEx SleepEx ReadFile QueryPerformanceFrequency CancelIo HeapAlloc MultiByteToWideChar WriteConsoleW GetStdHandle GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer Sleep CreateThread FreeEnvironmentStringsW GetFileAttributesW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW WriteFileEx QueryPerformanceCounter GetSystemInfo GetExitCodeProcess TerminateProcess RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind FindNextFileW LCMapStringW HeapSize CreateFileW VirtualProtect InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc GetStringTypeW SetStdHandle GetCPInfo GetOEMCP GetACP IsValidCodePage GetCommandLineA GetModuleHandleExW WriteFile LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer RaiseException RtlPcToFileHeader RtlUnwindEx IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent

advapi32

RegCloseKey RegQueryValueExW RegOpenKeyExW RegEnumKeyExW

ole32

CoCreateInstance CoInitializeEx

oleaut32

SysFreeString SysStringLen

ntdll

RtlNtStatusToDosError NtOpenFile NtReadFile NtCreateNamedPipeFile NtWriteFile

Name

.text

Size

960KB

Virtual Size

960KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

314KB

Virtual Size

313KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

72KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

4dcf62080973083cff5e3312ab8a08a6360157a98ef26041e8c4f239b593ee9c

bcryptprimitives

api-ms-win-core-synch-l1-2-0

kernel32

advapi32

ole32

oleaut32

ntdll

generic