8f45cbdf1d1b6d696a7c6d63c3e6c76ed2843cd6443407230a9c49ef4412c050

Sharing

Copy URL Twitter E-mail

General

Target
8f45cbdf1d1b6d696a7c6d63c3e6c76ed2843cd6443407230a9c49ef4412c050
Size 785KB
Sample260803-k7p24sfc49
SHA256 8f45cbdf1d1b6d696a7c6d63c3e6c76ed2843cd6443407230a9c49ef4412c050
MD5 c862cb679628d99819b0010ca05c93b7
SHA1 5c596e1db1bbe899eddd392284b696b68d76ce84
SHA512 e05e16e2383a3a634d4c677606ab035e0d9107ad2f420246a08208ee21cafe48a8511a6ca29aafffe226b9d38de0a3279df9e4be200ade1aa3832ba3ce8badee
SSDEEP 12288:HfrCi5a3B2Nz0DGWUvDkdtpEg+YQzjRHOj7npn35lLGofzpYSoWUrEdZbE:HD63B2Nz0A2eYojRyB35lLGSfcEdZ
TLSH
T18605E0567EA504F9C0768139C826AA16F6B5BC56072096FF03E05BAF2F332D44D3BB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8f45cbdf1d1b6d696a7c6d63c3e6c76ed2843cd6443407230a9c49ef4412c050

File Explorer

8f45cbdf1d1b6d696a7c6d63c3e6c76ed2843cd6443407230a9c49ef4412c050

.exe 785KB

8f45cbdf1d1b6d696a7c6d63c3e6c76ed2843cd6443407230a9c49ef4412c050

IMPHASH 54e5db29da13354fb5538b2325863c7e
SHA256 8f45cbdf1d1b6d696a7c6d63c3e6c76ed2843cd6443407230a9c49ef4412c050
MD5 c862cb679628d99819b0010ca05c93b7
SHA1 5c596e1db1bbe899eddd392284b696b68d76ce84
SHA512 e05e16e2383a3a634d4c677606ab035e0d9107ad2f420246a08208ee21cafe48a8511a6ca29aafffe226b9d38de0a3279df9e4be200ade1aa3832ba3ce8badee
SSDEEP 12288:HfrCi5a3B2Nz0DGWUvDkdtpEg+YQzjRHOj7npn35lLGofzpYSoWUrEdZbE:HD63B2Nz0A2eYojRyB35lLGSfcEdZ
TLSH
T18605E0567EA504F9C0768139C826AA16F6B5BC56072096FF03E05BAF2F332D44D3BB21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

49712

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

bcrypt

BCryptOpenAlgorithmProvider BCryptGenerateSymmetricKey BCryptDecrypt BCryptDestroyKey BCryptCloseAlgorithmProvider

mscoree

CLRCreateInstance

shell32

SHGetSpecialFolderLocation SHGetFolderPathW SHGetPathFromIDListW

advapi32

RegQueryValueExA RegOpenKeyExA RegCreateKeyExA RegCloseKey RegSetValueExA

kernel32

GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindFirstFileExW HeapReAlloc GetTimeZoneInformation ReadConsoleW SetFilePointerEx SetStdHandle HeapSize WriteConsoleW GetACP CreateFileW DeleteFileW FindClose FindFirstFileW FindNextFileW GetLastError GetCurrentProcessId TerminateProcess OpenProcess VirtualProtect FreeLibrary GetModuleHandleA GetModuleHandleW GetProcAddress LoadLibraryA LoadLibraryW GetFileSizeEx ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW HeapFree HeapAlloc MultiByteToWideChar WideCharToMultiByte LocalFree GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx RtlUnwind GetCPInfo CloseHandle InitializeCriticalSectionAndSpinCount SetEvent ResetEvent WaitForSingleObjectEx CreateEventW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetCurrentProcess RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile

oleaut32

VariantClear SafeArrayCreateVector SafeArrayUnaccessData SafeArrayAccessData SafeArrayCreate

Name

.text

Size

192KB

Virtual Size

191KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

490KB

Virtual Size

490KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

82KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

8f45cbdf1d1b6d696a7c6d63c3e6c76ed2843cd6443407230a9c49ef4412c050

bcrypt

mscoree

shell32

advapi32

kernel32

oleaut32

generic