4d04b360a3a13c3d3384f4f7963cc51d4550d6063927c6da41b5d7ec1a0649fd

Sharing

Copy URL Twitter E-mail

General

Target
4d04b360a3a13c3d3384f4f7963cc51d4550d6063927c6da41b5d7ec1a0649fd
Size 1.4MB
Sample260730-tctlgscp7s
SHA256 4d04b360a3a13c3d3384f4f7963cc51d4550d6063927c6da41b5d7ec1a0649fd
MD5 d0d175b9e45e28fb1e4ee143f8a84997
SHA1 f14fbd5f4755e6ef344bdae90bb79abbbd2b6f27
SHA512 aefec63b03614d16c4f2ef562dbba6c03a0e51e394c5bfdd45363a862f110a1bd2ab515957bef1b3033f7e71320a01b96247b8065ad3d9a76ef92db5a5e83c08
SSDEEP 24576:CGb/APNj0dFjR3CtH2NKd/M/s2qMXp9nge:5Ay1R3CtHLd32qAnl
TLSH
T110650717B66464D9C1BBC0B8C2838F25B96270C90B396FF745D1827A2E25EF86E3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4d04b360a3a13c3d3384f4f7963cc51d4550d6063927c6da41b5d7ec1a0649fd

File Explorer

4d04b360a3a13c3d3384f4f7963cc51d4550d6063927c6da41b5d7ec1a0649fd

.exe 1.4MB

4d04b360a3a13c3d3384f4f7963cc51d4550d6063927c6da41b5d7ec1a0649fd

IMPHASH 9644aaf569986dc2d8c99e681436d5b6
SHA256 4d04b360a3a13c3d3384f4f7963cc51d4550d6063927c6da41b5d7ec1a0649fd
MD5 d0d175b9e45e28fb1e4ee143f8a84997
SHA1 f14fbd5f4755e6ef344bdae90bb79abbbd2b6f27
SHA512 aefec63b03614d16c4f2ef562dbba6c03a0e51e394c5bfdd45363a862f110a1bd2ab515957bef1b3033f7e71320a01b96247b8065ad3d9a76ef92db5a5e83c08
SSDEEP 24576:CGb/APNj0dFjR3CtH2NKd/M/s2qMXp9nge:5Ay1R3CtHLd32qAnl
TLSH
T110650717B66464D9C1BBC0B8C2838F25B96270C90B396FF745D1827A2E25EF86E3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

976336

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

build_script_build-86be4ea739a8a4e9.pdb

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

kernel32

PeekNamedPipe CloseHandle CreateEventA WaitForMultipleObjects WaitForSingleObject OpenSemaphoreA ReleaseSemaphore SetEvent GetProcAddress LoadLibraryA GetNativeSystemInfo GetProcessHeap HeapFree HeapReAlloc lstrlenW GetCurrentProcess WideCharToMultiByte WaitForSingleObjectEx GetCurrentProcessId CreateMutexA ReleaseMutex SetFilePointerEx GetLastError SetFileInformationByHandle FlushFileBuffers DuplicateHandle AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread SetLastError GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW GetCommandLineW CopyFileExW CreateDirectoryW GetFileInformationByHandleEx SwitchToThread CompareStringW CreateEventW GetOverlappedResult GetFileInformationByHandle DeleteFileW FindFirstFileExW FindClose CreateHardLinkW GetConsoleMode GetFileType SetEnvironmentVariableW GetFullPathNameW GetCurrentThreadId GetModuleHandleA GetTempPathW GetModuleFileNameW GetModuleHandleW FormatMessageW ExitProcess ReadFileEx SleepEx ReadFile QueryPerformanceFrequency CancelIo HeapAlloc MultiByteToWideChar WriteConsoleW GetStdHandle GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer Sleep CreateThread FreeEnvironmentStringsW GetFileAttributesW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW WriteFileEx QueryPerformanceCounter GetSystemInfo GetExitCodeProcess TerminateProcess RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind FindNextFileW LCMapStringW HeapSize CreateFileW VirtualProtect InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc GetStringTypeW SetStdHandle GetCPInfo GetOEMCP GetACP IsValidCodePage GetCommandLineA GetModuleHandleExW WriteFile LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer RaiseException RtlPcToFileHeader RtlUnwindEx IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent

advapi32

RegCloseKey RegQueryValueExW RegOpenKeyExW RegEnumKeyExW

ole32

CoCreateInstance CoInitializeEx

oleaut32

SysFreeString SysStringLen

ntdll

RtlNtStatusToDosError NtOpenFile NtReadFile NtCreateNamedPipeFile NtWriteFile

Name

.text

Size

1014KB

Virtual Size

1013KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

365KB

Virtual Size

364KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

75KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

4d04b360a3a13c3d3384f4f7963cc51d4550d6063927c6da41b5d7ec1a0649fd

bcryptprimitives

api-ms-win-core-synch-l1-2-0

kernel32

advapi32

ole32

oleaut32

ntdll

generic