40050b3c91d66128a89db38d1db86e25f737fff69bfc5920b48535a64fa5d4d5

Sharing

Copy URL Twitter E-mail

General

Target
40050b3c91d66128a89db38d1db86e25f737fff69bfc5920b48535a64fa5d4d5
Size 1.3MB
Sample260730-t811fasdkc
SHA256 40050b3c91d66128a89db38d1db86e25f737fff69bfc5920b48535a64fa5d4d5
MD5 7174fcc9307119a8002d92f67a68076c
SHA1 a4dd3af66d2d261fb95021b4e0844c92e325d96c
SHA512 093f263b5b5cd3af74d29d8738a418b7a29eeb99113f0e1988b01301d3ed9508d205f094ae606fac3dbfd8cee15f09bff0559b5f15b0bdf0ad1fff8332d2f9a3
SSDEEP 24576:tUGuaQ5FE2xtUNIedn60g8CtnKAlCE+UCJf:e/aQzE2x0600nN+UCJf
TLSH
T1B365F726B664A5D9C1BBC078C2838F25793130C90B356FF746D5867A2E25EF86E3C724
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
40050b3c91d66128a89db38d1db86e25f737fff69bfc5920b48535a64fa5d4d5

File Explorer

40050b3c91d66128a89db38d1db86e25f737fff69bfc5920b48535a64fa5d4d5

.exe 1.3MB

40050b3c91d66128a89db38d1db86e25f737fff69bfc5920b48535a64fa5d4d5

IMPHASH 9644aaf569986dc2d8c99e681436d5b6
SHA256 40050b3c91d66128a89db38d1db86e25f737fff69bfc5920b48535a64fa5d4d5
MD5 7174fcc9307119a8002d92f67a68076c
SHA1 a4dd3af66d2d261fb95021b4e0844c92e325d96c
SHA512 093f263b5b5cd3af74d29d8738a418b7a29eeb99113f0e1988b01301d3ed9508d205f094ae606fac3dbfd8cee15f09bff0559b5f15b0bdf0ad1fff8332d2f9a3
SSDEEP 24576:tUGuaQ5FE2xtUNIedn60g8CtnKAlCE+UCJf:e/aQzE2x0600nN+UCJf
TLSH
T1B365F726B664A5D9C1BBC078C2838F25793130C90B356FF746D5867A2E25EF86E3C724
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

933632

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

build_script_build-5c6a4b226d8b034e.pdb

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

kernel32

PeekNamedPipe CloseHandle CreateEventA WaitForMultipleObjects WaitForSingleObject OpenSemaphoreA ReleaseSemaphore SetEvent GetProcAddress LoadLibraryA GetNativeSystemInfo GetProcessHeap HeapFree HeapReAlloc lstrlenW GetCurrentProcess WideCharToMultiByte WaitForSingleObjectEx GetCurrentProcessId CreateMutexA ReleaseMutex SetFilePointerEx GetLastError SetFileInformationByHandle FlushFileBuffers DuplicateHandle AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread SetLastError GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW GetCommandLineW CopyFileExW CreateDirectoryW GetFileInformationByHandleEx SwitchToThread CompareStringW CreateEventW GetOverlappedResult GetFileInformationByHandle DeleteFileW FindFirstFileExW FindClose CreateHardLinkW GetConsoleMode GetFileType SetEnvironmentVariableW GetFullPathNameW GetCurrentThreadId GetModuleHandleA GetTempPathW GetModuleFileNameW GetModuleHandleW FormatMessageW ExitProcess ReadFileEx SleepEx ReadFile QueryPerformanceFrequency CancelIo HeapAlloc MultiByteToWideChar WriteConsoleW GetStdHandle GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer Sleep CreateThread FreeEnvironmentStringsW GetFileAttributesW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW WriteFileEx QueryPerformanceCounter GetSystemInfo GetExitCodeProcess TerminateProcess RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind FindNextFileW LCMapStringW HeapSize CreateFileW VirtualProtect InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc GetStringTypeW SetStdHandle GetCPInfo GetOEMCP GetACP IsValidCodePage GetCommandLineA GetModuleHandleExW WriteFile LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer RaiseException RtlPcToFileHeader RtlUnwindEx IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent

advapi32

RegCloseKey RegQueryValueExW RegOpenKeyExW RegEnumKeyExW

ole32

CoCreateInstance CoInitializeEx

oleaut32

SysFreeString SysStringLen

ntdll

RtlNtStatusToDosError NtOpenFile NtReadFile NtCreateNamedPipeFile NtWriteFile

Name

.text

Size

972KB

Virtual Size

971KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

321KB

Virtual Size

320KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

73KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

40050b3c91d66128a89db38d1db86e25f737fff69bfc5920b48535a64fa5d4d5

bcryptprimitives

api-ms-win-core-synch-l1-2-0

kernel32

advapi32

ole32

oleaut32

ntdll

generic