8e21b852a350deb1bec211a05518c3193dfd1522a6bb5bbbc2ba33ebb4a57ad5

General

Target
8e21b852a350deb1bec211a05518c3193dfd1522a6bb5bbbc2ba33ebb4a57ad5
Size 355KB
Sample260730-va38kswtct
SHA256 8e21b852a350deb1bec211a05518c3193dfd1522a6bb5bbbc2ba33ebb4a57ad5
MD5 2784d15845c4d59a9eb0bc232f09be5d
SHA1 8f5f1b43112951eb289a7f2a8af110df68ba5f19
SHA512 0d4bc4aff214f9c54211485ba3c3973bdbf32b78deb1c34683c87de5b6d94c9c9efcec2f4ca1d8d53de6199a4d9d7c20fe76420e40c847bc8daa58d87a7a59f0
SSDEEP 6144:9Tf0p8XZMzR1xTQSvbuJjV2KvB+E1dJw9JPSG+6ARD:9T0blTB9KHrwKOy
TLSH
T122746D11FB5558FCD55BC07882568A72AA3278CA0B31AAFF229442383F6B9F55F3C714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8e21b852a350deb1bec211a05518c3193dfd1522a6bb5bbbc2ba33ebb4a57ad5

File Explorer

8e21b852a350deb1bec211a05518c3193dfd1522a6bb5bbbc2ba33ebb4a57ad5

.exe 355KB

8e21b852a350deb1bec211a05518c3193dfd1522a6bb5bbbc2ba33ebb4a57ad5

IMPHASH fea68e0cf350bfb07ac9d7032113a920
SHA256 8e21b852a350deb1bec211a05518c3193dfd1522a6bb5bbbc2ba33ebb4a57ad5
MD5 2784d15845c4d59a9eb0bc232f09be5d
SHA1 8f5f1b43112951eb289a7f2a8af110df68ba5f19
SHA512 0d4bc4aff214f9c54211485ba3c3973bdbf32b78deb1c34683c87de5b6d94c9c9efcec2f4ca1d8d53de6199a4d9d7c20fe76420e40c847bc8daa58d87a7a59f0
SSDEEP 6144:9Tf0p8XZMzR1xTQSvbuJjV2KvB+E1dJw9JPSG+6ARD:9T0blTB9KHrwKOy
TLSH
T122746D11FB5558FCD55BC07882568A72AA3278CA0B31AAFF229442383F6B9F55F3C714
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

184896

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

build_script_build-476c93d60e60039c.pdb

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

kernel32

HeapSize LCMapStringW CompareStringW CloseHandle GetProcessHeap HeapFree HeapReAlloc lstrlenW GetCurrentProcess GetProcAddress WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA GetCurrentProcessId CreateMutexA ReleaseMutex SetFilePointerEx GetLastError SetFileInformationByHandle FlushFileBuffers DuplicateHandle WaitForSingleObject AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread SetLastError GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW GetCommandLineW CreateFileW FindFirstFileExW FindClose GetConsoleMode GetFileType SetEnvironmentVariableW GetFullPathNameW GetCurrentThreadId GetModuleHandleA GetModuleFileNameW GetModuleHandleW FormatMessageW ExitProcess ReadFileEx SleepEx HeapAlloc MultiByteToWideChar WriteConsoleW GetStdHandle GetConsoleOutputCP CreateThread FreeEnvironmentStringsW GetFileAttributesW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW WriteFileEx QueryPerformanceCounter GetExitCodeProcess TerminateProcess RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind FindNextFileW VirtualProtect InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc GetStringTypeW SetStdHandle GetCPInfo GetOEMCP GetACP IsValidCodePage GetCommandLineA GetModuleHandleExW WriteFile LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer RaiseException GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent RtlUnwindEx RtlPcToFileHeader

ntdll

RtlNtStatusToDosError NtOpenFile NtCreateNamedPipeFile NtWriteFile

Name

.text

Size

238KB

Virtual Size

238KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

96KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

8e21b852a350deb1bec211a05518c3193dfd1522a6bb5bbbc2ba33ebb4a57ad5

api-ms-win-core-synch-l1-2-0

kernel32

ntdll

generic