802eb99add6a3be7a5449842ffb9b7f5277a3fac97cbcc8640e4e8385840ed77

Sharing

Copy URL Twitter E-mail

General

Target
802eb99add6a3be7a5449842ffb9b7f5277a3fac97cbcc8640e4e8385840ed77
Size 1.5MB
Sample260730-vbe75sce29
SHA256 802eb99add6a3be7a5449842ffb9b7f5277a3fac97cbcc8640e4e8385840ed77
MD5 616c51486f8d72862625c75569f9437a
SHA1 06429e887c09104c61c1879a72b899123d644a4e
SHA512 9bb2d2d10af6d2f8cc80dd512128e06a9d6a6aa543b2b513d7f7815b1feffefd9f6bbaa3f09acfeaee5be7726352ac5c02534ffbb5447d26171ec5ab07de31c8
SSDEEP 24576:MfrEQRftNJG/2fyBjHSgFvR1011RK7axZajtiYRJ1:SrfG/2fyB9J101NxU
TLSH
T1EF75D717A664A5D9C1BBC078C2834F26B92270D90F396FF74581827A2E25EFD6E3C354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
802eb99add6a3be7a5449842ffb9b7f5277a3fac97cbcc8640e4e8385840ed77

File Explorer

802eb99add6a3be7a5449842ffb9b7f5277a3fac97cbcc8640e4e8385840ed77

.exe 1.5MB

802eb99add6a3be7a5449842ffb9b7f5277a3fac97cbcc8640e4e8385840ed77

IMPHASH 9644aaf569986dc2d8c99e681436d5b6
SHA256 802eb99add6a3be7a5449842ffb9b7f5277a3fac97cbcc8640e4e8385840ed77
MD5 616c51486f8d72862625c75569f9437a
SHA1 06429e887c09104c61c1879a72b899123d644a4e
SHA512 9bb2d2d10af6d2f8cc80dd512128e06a9d6a6aa543b2b513d7f7815b1feffefd9f6bbaa3f09acfeaee5be7726352ac5c02534ffbb5447d26171ec5ab07de31c8
SSDEEP 24576:MfrEQRftNJG/2fyBjHSgFvR1011RK7axZajtiYRJ1:SrfG/2fyB9J101NxU
TLSH
T1EF75D717A664A5D9C1BBC078C2834F26B92270D90F396FF74581827A2E25EFD6E3C354
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1069952

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

build_script_build-e4b48450a1935732.pdb

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

kernel32

PeekNamedPipe CloseHandle CreateEventA WaitForMultipleObjects WaitForSingleObject OpenSemaphoreA ReleaseSemaphore SetEvent GetProcAddress LoadLibraryA GetNativeSystemInfo GetProcessHeap HeapFree HeapReAlloc lstrlenW GetCurrentProcess WideCharToMultiByte WaitForSingleObjectEx GetCurrentProcessId CreateMutexA ReleaseMutex SetFilePointerEx GetLastError SetFileInformationByHandle FlushFileBuffers DuplicateHandle AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread SetLastError GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW GetCommandLineW CopyFileExW CreateDirectoryW GetFileInformationByHandleEx SwitchToThread CompareStringW CreateEventW GetOverlappedResult GetFileInformationByHandle DeleteFileW FindFirstFileExW FindClose CreateHardLinkW GetConsoleMode GetFileType SetEnvironmentVariableW GetFullPathNameW GetCurrentThreadId GetModuleHandleA GetTempPathW GetModuleFileNameW GetModuleHandleW FormatMessageW ExitProcess ReadFileEx SleepEx ReadFile QueryPerformanceFrequency CancelIo HeapAlloc MultiByteToWideChar WriteConsoleW GetStdHandle GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer Sleep CreateThread FreeEnvironmentStringsW GetFileAttributesW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW WriteFileEx QueryPerformanceCounter GetSystemInfo GetExitCodeProcess TerminateProcess RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind FindNextFileW LCMapStringW HeapSize CreateFileW VirtualProtect InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc GetStringTypeW SetStdHandle GetCPInfo GetOEMCP GetACP IsValidCodePage GetCommandLineA GetModuleHandleExW WriteFile LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer RaiseException RtlPcToFileHeader RtlUnwindEx IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent

advapi32

RegCloseKey RegQueryValueExW RegOpenKeyExW RegEnumKeyExW

ole32

CoCreateInstance CoInitializeEx

oleaut32

SysFreeString SysStringLen

ntdll

RtlNtStatusToDosError NtOpenFile NtReadFile NtCreateNamedPipeFile NtWriteFile

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

353KB

Virtual Size

352KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

85KB

Virtual Size

85KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

802eb99add6a3be7a5449842ffb9b7f5277a3fac97cbcc8640e4e8385840ed77

bcryptprimitives

api-ms-win-core-synch-l1-2-0

kernel32

advapi32

ole32

oleaut32

ntdll

generic