ad1a7abdae4bee03bb5f76a659ef09cc99e6f8dbc2565b1abe02736ae111baeb

Sharing

Copy URL Twitter E-mail

General

Target
ad1a7abdae4bee03bb5f76a659ef09cc99e6f8dbc2565b1abe02736ae111baeb
Size 206KB
Sample260804-ncevfavsb1
SHA256 ad1a7abdae4bee03bb5f76a659ef09cc99e6f8dbc2565b1abe02736ae111baeb
MD5 e3848b36b81da1b80a784192e699ad55
SHA1 e3365a9455795d3d768e72289a174d8a3ca9f22b
SHA512 21123438872131a2454d1e21d2940070f314b9ddc740987fbc78b53449bb7783f7f59f63cb8751206d5d0321041fe5a1a095ccdb4db9861cf2da509d2e854e96
SSDEEP 3072:F6ZNflhbYJ7D24fOvoJSLSVb+JL/fFeQ8BuA6N3U827PcIj8sAA/V:F6ZNflhbYVpJFVb+B/tIBuA6qb7U+2A
TLSH
T16A249E0AF7A8C6ECD0BA417895821513E335340A172097CF37A1936DEF76AE4DE7AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ad1a7abdae4bee03bb5f76a659ef09cc99e6f8dbc2565b1abe02736ae111baeb

File Explorer

ad1a7abdae4bee03bb5f76a659ef09cc99e6f8dbc2565b1abe02736ae111baeb

.exe 206KB

ad1a7abdae4bee03bb5f76a659ef09cc99e6f8dbc2565b1abe02736ae111baeb

IMPHASH d975c2c3c5293a2210024c5a20dba029
SHA256 ad1a7abdae4bee03bb5f76a659ef09cc99e6f8dbc2565b1abe02736ae111baeb
MD5 e3848b36b81da1b80a784192e699ad55
SHA1 e3365a9455795d3d768e72289a174d8a3ca9f22b
SHA512 21123438872131a2454d1e21d2940070f314b9ddc740987fbc78b53449bb7783f7f59f63cb8751206d5d0321041fe5a1a095ccdb4db9861cf2da509d2e854e96
SSDEEP 3072:F6ZNflhbYJ7D24fOvoJSLSVb+JL/fFeQ8BuA6N3U827PcIj8sAA/V:F6ZNflhbYVpJFVb+B/tIBuA6qb7U+2A
TLSH
T16A249E0AF7A8C6ECD0BA417895821513E335340A172097CF37A1936DEF76AE4DE7AB11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

176640

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

ExpandEnvironmentStringsW GetModuleFileNameW OpenProcess MultiByteToWideChar GetTickCount64 LockResource QueryPerformanceFrequency GetConsoleOutputCP LoadResource GetProcAddress FreeLibrary WideCharToMultiByte SleepEx QueryPerformanceCounter RtlLookupFunctionEntry ReadFile GetFileInformationByHandleEx SizeofResource GetCurrentProcessId DeleteCriticalSection GetLocalTime WaitForSingleObjectEx ResumeThread GetCurrentThreadId InitializeCriticalSection LeaveCriticalSection GetCurrentProcess EnterCriticalSection SetPriorityClass GetModuleHandleW GetProcessHeap HeapAlloc CloseHandle GetThreadUILanguage GetLastError CreateFileW SetThreadUILanguage WriteFile GetStdHandle GetCommandLineW SetLastError HeapFree FindResourceExW GetModuleHandleExW ExitProcess Sleep RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent RaiseException EncodePointer RtlUnwindEx InitializeSListHead GetSystemTimeAsFileTime RtlCaptureContext

advapi32

GetTokenInformation AdjustTokenPrivileges GetAce CloseServiceHandle OpenSCManagerW AllocateAndInitializeSid IsWellKnownSid AddAce CreateRestrictedToken FreeSid StartServiceW InitializeAcl OpenServiceW GetLengthSid AddAccessAllowedAce QueryServiceStatusEx LookupPrivilegeValueW SetTokenInformation OpenProcessToken SetThreadToken CreateProcessAsUserW DuplicateTokenEx

ole32

CoInitializeEx

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

wtsapi32

WTSEnumerateSessionsW WTSFreeMemory WTSEnumerateProcessesW WTSQueryUserToken

msvcrt

_callnewh _initterm _initterm_e _set_fmode abort _errno strcpy_s __pctype_func tolower ___mb_cur_max_func wcsnlen wcstol _mbtowc_l ?terminate@@YAXXZ __getmainargs _environ _msize _XcptFilter __set_app_type __argc __argv ?_set_new_mode@@YAHH@Z _commode ___lc_codepage_func ceil log10 realloc _clearfp malloc free strncmp _wcsicmp strrchr memmove __DestructExceptionObject _amsg_exit memset __C_specific_handler _CxxThrowException wcsstr wcsrchr _wcsnicmp memcpy memcmp

Name

.text

Size

82KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

42KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

49KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

ad1a7abdae4bee03bb5f76a659ef09cc99e6f8dbc2565b1abe02736ae111baeb

kernel32

advapi32

ole32

userenv

wtsapi32

msvcrt

generic