75a0f27bf0672bbba14d480a0fc94ff6d64ec90b6ef955a6db393719e8ee3693

General

Target
75a0f27bf0672bbba14d480a0fc94ff6d64ec90b6ef955a6db393719e8ee3693
Size 1.8MB
Sample260803-j9rhaaee87
SHA256 75a0f27bf0672bbba14d480a0fc94ff6d64ec90b6ef955a6db393719e8ee3693
MD5 8e86eae8ac9f8e71e00de3626407a30c
SHA1 6f382e353be019af9b80bae45cee9a9166967270
SHA512 b5d15ed55c5e1b9a273bcf32b127a7762385ed13456af4ca14900c6eac70165d5827fc12f4c03e0ce3b2916fccb0d3a2addac160e9768898ab61627709879920
SSDEEP 24576:oFvJkTtajMSalU/Y2kvMHxk+IgHB1G+cfiMpSHCD4GvzXFD67/j4DpaXFsfcIzCX:orhYdgy+5MpSHCkuzXFD6KE60c
TLSH
T184958D4BA2B801FCC1ABC175851B5A0BE7B2740517749BDF15D0CAA96F23FE216BE324
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
75a0f27bf0672bbba14d480a0fc94ff6d64ec90b6ef955a6db393719e8ee3693

File Explorer

75a0f27bf0672bbba14d480a0fc94ff6d64ec90b6ef955a6db393719e8ee3693

.dll 1.8MB

75a0f27bf0672bbba14d480a0fc94ff6d64ec90b6ef955a6db393719e8ee3693

IMPHASH 34b5dd3bd6861dc2a6bc4ece608241ca
SHA256 75a0f27bf0672bbba14d480a0fc94ff6d64ec90b6ef955a6db393719e8ee3693
MD5 8e86eae8ac9f8e71e00de3626407a30c
SHA1 6f382e353be019af9b80bae45cee9a9166967270
SHA512 b5d15ed55c5e1b9a273bcf32b127a7762385ed13456af4ca14900c6eac70165d5827fc12f4c03e0ce3b2916fccb0d3a2addac160e9768898ab61627709879920
SSDEEP 24576:oFvJkTtajMSalU/Y2kvMHxk+IgHB1G+cfiMpSHCD4GvzXFD67/j4DpaXFsfcIzCX:orhYdgy+5MpSHCkuzXFD6KE60c
TLSH
T184958D4BA2B801FCC1ABC175851B5A0BE7B2740517749BDF15D0CAA96F23FE216BE324
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

1441536

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\jenkins\workspace\Platform_Windows_build\platform\node_modules\sqlite3\build\Release\node_sqlite3.pdb

kernel32

GetModuleHandleA LoadLibraryExA AreFileApisANSI ReadFile TryEnterCriticalSection HeapCreate HeapFree EnterCriticalSection GetFullPathNameW WriteFile GetDiskFreeSpaceW OutputDebugStringA LockFile LeaveCriticalSection InitializeCriticalSection SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathW CreateMutexW WaitForSingleObject CreateFileW GetFileAttributesW GetCurrentThreadId UnmapViewOfFile HeapValidate HeapSize MultiByteToWideChar Sleep GetTempPathA FormatMessageW GetDiskFreeSpaceA GetLastError GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA LoadLibraryA WaitForSingleObjectEx DeleteFileA DeleteFileW HeapReAlloc CloseHandle RaiseException GetSystemInfo LoadLibraryW HeapAlloc HeapCompact HeapDestroy UnlockFile GetProcAddress LocalFree LockFileEx GetFileSize DeleteCriticalSection GetCurrentProcessId GetProcessHeap SystemTimeToFileTime FreeLibrary WideCharToMultiByte GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount FlushFileBuffers RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx RtlPcToFileHeader InterlockedFlushSList SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetModuleFileNameW CompareStringW LCMapStringW GetTimeZoneInformation FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetStdHandle GetFileType GetStringTypeW SetStdHandle GetConsoleOutputCP GetConsoleMode SetFilePointerEx WriteConsoleW VirtualProtect VirtualQuery

Sharing

General

Malware Config

Signatures

File Explorer

75a0f27bf0672bbba14d480a0fc94ff6d64ec90b6ef955a6db393719e8ee3693

kernel32

generic