8f7485739d35ba30bcefc949cee1a6d309c08f580b241b24d8c385d3b0ac5041

General

Target
8f7485739d35ba30bcefc949cee1a6d309c08f580b241b24d8c385d3b0ac5041
Size 2.8MB
Sample260731-ee5zzacc38
SHA256 8f7485739d35ba30bcefc949cee1a6d309c08f580b241b24d8c385d3b0ac5041
MD5 13227ebe5a1a405884398af5d09cc569
SHA1 8af465276a01470177ff20c469228c9288494f15
SHA512 5ed95c3445610d1946c59c84ebd94e1c51a47b2c0d25705d1dadbc27ced863e59795d626e3dde0c29369b4581a00fffad59e554adec00a6f89f12ab719259d06
SSDEEP 49152:oBHpfKw6AePWdy283dJbG5xPEGKvERqGLVW2pOzNSCJiTRetz+us8hR479YVLS:oLfx6AeWqdJbePvC4FpQYCJi90P4mVL
TLSH
T159D5124D32544CB2D9BE0973211BF6DBA06C9F3DB73084C76B807BE89A21EC16D75662
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8f7485739d35ba30bcefc949cee1a6d309c08f580b241b24d8c385d3b0ac5041

File Explorer

8f7485739d35ba30bcefc949cee1a6d309c08f580b241b24d8c385d3b0ac5041

.dll 2.8MB

8f7485739d35ba30bcefc949cee1a6d309c08f580b241b24d8c385d3b0ac5041

IMPHASH 796018ce26e9fc9bfc25d6323a374d8f
SHA256 8f7485739d35ba30bcefc949cee1a6d309c08f580b241b24d8c385d3b0ac5041
MD5 13227ebe5a1a405884398af5d09cc569
SHA1 8af465276a01470177ff20c469228c9288494f15
SHA512 5ed95c3445610d1946c59c84ebd94e1c51a47b2c0d25705d1dadbc27ced863e59795d626e3dde0c29369b4581a00fffad59e554adec00a6f89f12ab719259d06
SSDEEP 49152:oBHpfKw6AePWdy283dJbG5xPEGKvERqGLVW2pOzNSCJiTRetz+us8hR479YVLS:oLfx6AeWqdJbePvC4FpQYCJi90P4mVL
TLSH
T159D5124D32544CB2D9BE0973211BF6DBA06C9F3DB73084C76B807BE89A21EC16D75662
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

210615

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

C:\tmp\ffmpeg_gn_out\build\win\x86\libagora_ai_noise_suppression_extension.dll.pdb

agora_rtc_sdk

ord8 ord9 ord6

kernel32

GetModuleFileNameW WriteConsoleW CreateFileW GetVersion IsProcessorFeaturePresent CloseHandle EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetModuleHandleW GetProcAddress UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwind RaiseException InterlockedFlushSList GetLastError SetLastError EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW HeapReAlloc HeapFree HeapAlloc LCMapStringW GetStdHandle GetFileType DecodePointer FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap FlushFileBuffers WriteFile GetConsoleCP GetConsoleMode SetStdHandle GetStringTypeW HeapSize SetFilePointerEx

Sharing

General

Malware Config

Signatures

File Explorer

8f7485739d35ba30bcefc949cee1a6d309c08f580b241b24d8c385d3b0ac5041

agora_rtc_sdk

kernel32

generic