5121f55f5c108897d71076488d9bbec5ad4976dce2568074f92f4de4f9e65eaa

General

Target
5121f55f5c108897d71076488d9bbec5ad4976dce2568074f92f4de4f9e65eaa
Size 128KB
Sample260731-gfd9radf39
SHA256 5121f55f5c108897d71076488d9bbec5ad4976dce2568074f92f4de4f9e65eaa
MD5 f46cca3b11d270c25290207a9bc8daa4
SHA1 d5199c41474a2dda7a57ca08649741c936a0be3e
SHA512 00bde30c0f8a6be6a5de944157d216b4f8878523bc56c11462b588be81a88184763b2f52880ab26eae4bd63cfbbd12eb9a7f601530316cdfa834fa5568cb6fbf
SSDEEP 3072:IIIIITy2KifkRkOjmn0AXlILP+b7jQ5wWh+fFZB/iICT5XZElk7Elv:IIIIIG2K+lI7+bwJTdE
TLSH
T14CD37D6275D184E9F6178631409816B971323E7E2B402ACF6B80BF7539722C5BD73A2F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5121f55f5c108897d71076488d9bbec5ad4976dce2568074f92f4de4f9e65eaa

File Explorer

5121f55f5c108897d71076488d9bbec5ad4976dce2568074f92f4de4f9e65eaa

.exe 128KB

5121f55f5c108897d71076488d9bbec5ad4976dce2568074f92f4de4f9e65eaa

IMPHASH cf8048cb3640782eb2c760434aa84385
SHA256 5121f55f5c108897d71076488d9bbec5ad4976dce2568074f92f4de4f9e65eaa
MD5 f46cca3b11d270c25290207a9bc8daa4
SHA1 d5199c41474a2dda7a57ca08649741c936a0be3e
SHA512 00bde30c0f8a6be6a5de944157d216b4f8878523bc56c11462b588be81a88184763b2f52880ab26eae4bd63cfbbd12eb9a7f601530316cdfa834fa5568cb6fbf
SSDEEP 3072:IIIIITy2KifkRkOjmn0AXlILP+b7jQ5wWh+fFZB/iICT5XZElk7Elv:IIIIIG2K+lI7+bwJTdE
TLSH
T14CD37D6275D184E9F6178631409816B971323E7E2B402ACF6B80BF7539722C5BD73A2F
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

19198

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\jenkins\workspace\pc-2345mpcsafe-build@2\Rhino\Safe\Bin\Win32\release\pdb\2345TrashRcmd.pdb

kernel32

CloseHandle GetLastError CreateMutexW GetStartupInfoW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetFileAttributesW lstrlenW GetFullPathNameW DeleteCriticalSection InitializeCriticalSection GetCurrentProcess GetEnvironmentVariableW GetProcAddress GetCurrentThreadId GetModuleHandleW GetModuleFileNameW LoadLibraryW FreeLibrary

msvcp140

?_Xout_of_range@std@@YAXPBD@Z ?_Xlength_error@std@@YAXPBD@Z

vcruntime140

memset memcpy memmove __std_exception_copy __CxxFrameHandler3 wcschr _except_handler4_common _CxxThrowException __std_exception_destroy

api-ms-win-crt-runtime-l1-1-0

_set_app_type _seh_filter_exe _configure_wide_argv terminate _initialize_wide_environment _get_wide_winmain_command_line _initterm _initterm_e _controlfp_s exit _exit _crt_atexit _register_onexit_function _initialize_onexit_table _invalid_parameter_noinfo_noreturn _cexit _c_exit _register_thread_local_exe_atexit_callback

api-ms-win-crt-string-l1-1-0

towupper towlower

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-heap-l1-1-0

_set_new_mode _callnewh malloc free

api-ms-win-crt-math-l1-1-0

__setusermatherr _except1

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

5121f55f5c108897d71076488d9bbec5ad4976dce2568074f92f4de4f9e65eaa

kernel32

msvcp140

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic