e68fa96670352db7b0d57ea0a45393eebf9384e4d92a8288e825635dc6f34cad

Sharing

Copy URL Twitter E-mail

General

Target
e68fa96670352db7b0d57ea0a45393eebf9384e4d92a8288e825635dc6f34cad
Size 3.1MB
Sample260804-3cacaazzgz
SHA256 e68fa96670352db7b0d57ea0a45393eebf9384e4d92a8288e825635dc6f34cad
MD5 c49750d6be3ff3f5e7940535c194c0fb
SHA1 6a3efa2da48e2692decdfd5bce0f5bbacb3153dc
SHA512 3378807659d599f60c4ae256f03f320490603fb9b8def560a022aede936502a4f398d01937ceb0b3c2d9a30117e067605046098d44389a86fce5d4823497b9e0
SSDEEP 49152:Jh4JI2+brARFaOrnPpF0b7cMRtGVRyrUCBvF7GHVW1QS4IU6isok8:DrUEOFu8q5+kH+/
TLSH
T1CDE54B02BA9B94ECC15AC474C3464A73AE2174CB0726B9FF42D496383F6ABE15B3C715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e68fa96670352db7b0d57ea0a45393eebf9384e4d92a8288e825635dc6f34cad

File Explorer

e68fa96670352db7b0d57ea0a45393eebf9384e4d92a8288e825635dc6f34cad

.exe 3.1MB

e68fa96670352db7b0d57ea0a45393eebf9384e4d92a8288e825635dc6f34cad

IMPHASH 6dcee9e2313d5e2c829d00e816995b9c
SHA256 e68fa96670352db7b0d57ea0a45393eebf9384e4d92a8288e825635dc6f34cad
MD5 c49750d6be3ff3f5e7940535c194c0fb
SHA1 6a3efa2da48e2692decdfd5bce0f5bbacb3153dc
SHA512 3378807659d599f60c4ae256f03f320490603fb9b8def560a022aede936502a4f398d01937ceb0b3c2d9a30117e067605046098d44389a86fce5d4823497b9e0
SSDEEP 49152:Jh4JI2+brARFaOrnPpF0b7cMRtGVRyrUCBvF7GHVW1QS4IU6isok8:DrUEOFu8q5+kH+/
TLSH
T1CDE54B02BA9B94ECC15AC474C3464A73AE2174CB0726B9FF42D496383F6ABE15B3C715
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2249756

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

SgrmBrokerSvc.pdb

kernel32

GetComputerNameExW GlobalMemoryStatusEx GetSystemInfo GetTickCount64 GetProcAddress GetModuleHandleW GetSystemTimePreciseAsFileTime GetLastError CloseHandle HeapFree SetLastError LoadLibraryA HeapAlloc SetHandleInformation GetModuleHandleA GetSystemDirectoryW GetWindowsDirectoryW GetModuleFileNameW DuplicateHandle LoadLibraryExW FreeLibrary HeapSize VirtualProtect GetModuleHandleExW GetSystemTimeAsFileTime HeapReAlloc GetProcessHeap InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc GetStringTypeW GetFileType SetStdHandle SetEnvironmentVariableW GetCPInfo GetOEMCP GetACP IsValidCodePage GetCommandLineW GetCommandLineA WriteFile TlsFree TlsSetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer RaiseException RtlPcToFileHeader RtlUnwindEx GetStartupInfoW InitializeSListHead IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter FindNextFileW MoveFileExW CopyFileExW SwitchToThread DeleteFileW GetTempPathW GetExitCodeProcess WaitForMultipleObjects GetFileAttributesW CompareStringW LCMapStringW FlushFileBuffers SetFilePointerEx TlsGetValue GetOverlappedResult FindClose CreateToolhelp32Snapshot Process32FirstW Process32NextW OpenProcess TerminateProcess CreateThread QueryFullProcessImageNameW IsDebuggerPresent CreateMutexW FreeEnvironmentStringsW GetCurrentProcess QueryPerformanceCounter SetThreadExecutionState CreateWaitableTimerExW SetWaitableTimer WaitForSingleObject QueryPerformanceFrequency Sleep AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentThreadId GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry WaitForSingleObjectEx lstrlenW GetCurrentProcessId CreateMutexA ReleaseMutex RtlVirtualUnwind WideCharToMultiByte GetStdHandle GetConsoleMode GetConsoleOutputCP MultiByteToWideChar WriteConsoleW GetEnvironmentVariableW ReadFileEx SleepEx WriteFileEx FormatMessageW GetFullPathNameW CreateFileW SetFileTime SetFileInformationByHandle FindFirstFileExW GetFileInformationByHandle GetFileInformationByHandleEx CreateDirectoryW ExitProcess CreateEventW CancelIo ReadFile GetEnvironmentStringsW CompareStringOrdinal CreateProcessW

secur32

AcceptSecurityContext DeleteSecurityContext ApplyControlToken FreeCredentialsHandle DecryptMessage QueryContextAttributesW FreeContextBuffer InitializeSecurityContextW AcquireCredentialsHandleA EncryptMessage

crypt32

CertFreeCertificateChain CertGetCertificateChain CertDuplicateCertificateChain CertOpenStore CertVerifyCertificateChainPolicy CertAddCertificateContextToStore CertCloseStore CertDuplicateStore CertDuplicateCertificateContext CertEnumCertificatesInStore CertFreeCertificateContext

bcryptprimitives

ProcessPrng

advapi32

SystemFunction036 GetTokenInformation GetUserNameW RegSetValueExW OpenProcessToken RegCloseKey RegDeleteValueW RegQueryValueExW RegEnumValueW RegOpenKeyExW RegCreateKeyExW

ntdll

NtSuspendProcess NtCreateNamedPipeFile RtlNtStatusToDosError NtOpenFile NtResumeProcess NtWriteFile NtReadFile

bcrypt

BCryptGenRandom

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

shell32

ShellExecuteW

user32

GetAsyncKeyState IsWindowVisible SetProcessDPIAware ShowWindow GetWindowTextW keybd_event EnumWindows BlockInput GetForegroundWindow GetWindowThreadProcessId SendMessageW SetCursorPos GetDC GetSystemMetrics GetLastInputInfo mouse_event

ws2_32

closesocket getsockopt setsockopt recv getsockname ioctlsocket connect select WSAStartup WSAGetLastError send WSACleanup WSASocketW WSADuplicateSocketW WSASend freeaddrinfo getaddrinfo getpeername WSARecv

gdi32

DeleteDC DeleteObject GetDeviceCaps CreateCompatibleDC CreateCompatibleBitmap SelectObject BitBlt GetDIBits

Name

.text

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

782KB

Virtual Size

782KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

63KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

e68fa96670352db7b0d57ea0a45393eebf9384e4d92a8288e825635dc6f34cad

kernel32

secur32

crypt32

bcryptprimitives

advapi32

ntdll

bcrypt

api-ms-win-core-synch-l1-2-0

shell32

user32

ws2_32

gdi32

generic