3b8cafc0f57442322e8b61a29ebe8c2da71e0f21cb4cc465a0efe61de8cbb68c

Sharing

Copy URL Twitter E-mail

General

Target
3b8cafc0f57442322e8b61a29ebe8c2da71e0f21cb4cc465a0efe61de8cbb68c
Size 1.1MB
Sample260802-yr2ymafa85
SHA256 3b8cafc0f57442322e8b61a29ebe8c2da71e0f21cb4cc465a0efe61de8cbb68c
MD5 da46cbaa5f342673ee277ea7c64f6e5b
SHA1 14f2d49a1e4be4e267f541d4258252be520aac09
SHA512 5a544d0fcdc2be8bd6e7a127d9f2a2c808156707095312618795fbb213d067f0992da5c25711d586797d07f1e1999258d518faec23a4f754b7052e5e4866be61
SSDEEP 24576:skopudT4r/DXMtB3QBOaAklg/Yald2xrX9HA:sku64r/DZ4/YaX25
TLSH
T106351203E7A634DAD06BC634D5528556EBA2F86843A5ABDF2754CA485F332C1BF3D302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3b8cafc0f57442322e8b61a29ebe8c2da71e0f21cb4cc465a0efe61de8cbb68c

File Explorer

3b8cafc0f57442322e8b61a29ebe8c2da71e0f21cb4cc465a0efe61de8cbb68c

.exe 1.1MB

3b8cafc0f57442322e8b61a29ebe8c2da71e0f21cb4cc465a0efe61de8cbb68c

IMPHASH 88d2c075d74c44a09b7f785f99227d77
SHA256 3b8cafc0f57442322e8b61a29ebe8c2da71e0f21cb4cc465a0efe61de8cbb68c
MD5 da46cbaa5f342673ee277ea7c64f6e5b
SHA1 14f2d49a1e4be4e267f541d4258252be520aac09
SHA512 5a544d0fcdc2be8bd6e7a127d9f2a2c808156707095312618795fbb213d067f0992da5c25711d586797d07f1e1999258d518faec23a4f754b7052e5e4866be61
SSDEEP 24576:skopudT4r/DXMtB3QBOaAklg/Yald2xrX9HA:sku64r/DZ4/YaX25
TLSH
T106351203E7A634DAD06BC634D5528556EBA2F86843A5ABDF2754CA485F332C1BF3D302
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

73064

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

F:\DEK-main\DEK-main\x64\Release\DEK.pdb

kernel32

SetDllDirectoryW LoadLibraryExW RtlCompareMemory VirtualAlloc LoadLibraryA GetCurrentProcess ResumeThread CreateProcessW GetConsoleScreenBufferInfo SetConsoleTextAttribute VirtualFree GetStdHandle GetModuleFileNameW VirtualUnlock FormatMessageW GetSystemInfo GetProcAddress VirtualAllocEx ReadProcessMemory GetSystemTimeAsFileTime VirtualFreeEx ExpandEnvironmentStringsW LoadLibraryW GetCurrentDirectoryW IsDebuggerPresent DeleteFileW GetCurrentProcessId CloseHandle Sleep TerminateProcess SetLastError HeapDestroy HeapAlloc HeapCreate GetModuleHandleW InitializeSListHead GetCurrentThreadId QueryPerformanceCounter IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext FreeLibrary VirtualLock GetLastError

advapi32

RegSetValueExW RegCreateKeyExA RegDeleteKeyW RegCreateKeyExW RegEnumKeyExW RegSetValueExA RegOpenKeyExW RegCloseKey

ntdll

RtlImageNtHeader NtDuplicateObject NtOpenProcess RtlTimeToSecondsSince1970 NtMapViewOfSection NtWaitForSingleObject RtlDoesFileExists_U RtlCreateSecurityDescriptor NtUnmapViewOfSection RtlCreateAcl RtlGetVersion RtlLengthRequiredSid RtlSetDaclSecurityDescriptor RtlSubAuthoritySid NtCreateSection RtlInitializeSid RtlNtdllName LdrAccessResource RtlSetLastWin32Error NtCreateFile NtAdjustPrivilegesToken RtlFreeHeap NtQueryDirectoryObject RtlFreeSid RtlExpandEnvironmentStrings NtOpenDirectoryObject NtFlushBuffersFile NtQueryInformationToken RtlAllocateAndInitializeSid LdrFindResource_U RtlDosPathNameToNtPathName_U RtlFreeUnicodeString NtQueryInformationProcess NtWriteFile RtlAllocateHeap NtOpenProcessToken RtlEqualSid RtlAdjustPrivilege NtClose NtSetSecurityObject NtQuerySystemInformation NtLoadDriver RtlInitUnicodeString NtUnloadDriver RtlNtStatusToDosError NtDeviceIoControlFile RtlAddAccessAllowedAce

setupapi

SetupDiCreateDeviceInfoList SetupDiGetINFClassW SetupDiCallClassInstaller SetupDiSetDeviceRegistryPropertyW SetupDiCreateDeviceInfoW SetupDiDestroyDeviceInfoList SetupDiRemoveDevice InstallHinfSectionW

newdev

UpdateDriverForPlugAndPlayDevicesW

bcrypt

BCryptGenerateSymmetricKey BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptEncrypt BCryptDestroyKey

fltlib

FilterSendMessage FilterConnectCommunicationPort

msdelta

DeltaFree ApplyDeltaB

msvcp140

?_Xlength_error@std@@YAXPEBD@Z

vcruntime140

__C_specific_handler memcpy __std_exception_destroy __std_exception_copy __std_terminate _CxxThrowException __current_exception __current_exception_context memset memcmp

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-stdio-l1-1-0

_set_fmode __acrt_iob_func __stdio_common_vfprintf __stdio_common_vfprintf_s __stdio_common_vswprintf __p__commode

api-ms-win-crt-string-l1-1-0

_stricmp

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _configure_narrow_argv _initialize_narrow_environment terminate _initterm _initterm_e exit _exit __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _set_app_type _invoke_watson _register_onexit_function _get_initial_narrow_environment _initialize_onexit_table _seh_filter_exe

api-ms-win-crt-convert-l1-1-0

strtoul strtoull

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode malloc free

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

3b8cafc0f57442322e8b61a29ebe8c2da71e0f21cb4cc465a0efe61de8cbb68c

kernel32

advapi32

ntdll

setupapi

newdev

bcrypt

fltlib

msdelta

msvcp140

vcruntime140

vcruntime140_1

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic