e08dfab8be838176602f0abf51e8ffbbb6d141301f2c63b2c9daaf2c18ac4ddb

Sharing

Copy URL Twitter E-mail

General

Target
e08dfab8be838176602f0abf51e8ffbbb6d141301f2c63b2c9daaf2c18ac4ddb
Size 347KB
Sample260804-rnlc5sseqd
SHA256 e08dfab8be838176602f0abf51e8ffbbb6d141301f2c63b2c9daaf2c18ac4ddb
MD5 1e5e450c0d0509cf46cc7772031efc5f
SHA1 ca2f71075027b06aa599cf1c1af5b884e8c5e7e7
SHA512 17c5ee4c34c3b6db91aa1ea06fb5d4e66c96c8ec26fad0164c7640b316773ed510d99092bdb98b391a4e3323ee59065169ffd1bc70630171e93fa9787764cffb
SSDEEP 6144:VqfnHiHxQLN/cD6FOtFJjRWZ889wVFde4SE8mukNfCpyI3feJdXDewsd6z:Vq/8reFwjRWZpwfdpSzmukNqt3fcR
TLSH
T1F8744C25E7DA0559E027E67E8263D237F6337AD9635063DF82B4CA682703D62327DE40
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e08dfab8be838176602f0abf51e8ffbbb6d141301f2c63b2c9daaf2c18ac4ddb

File Explorer

e08dfab8be838176602f0abf51e8ffbbb6d141301f2c63b2c9daaf2c18ac4ddb

.exe 347KB

e08dfab8be838176602f0abf51e8ffbbb6d141301f2c63b2c9daaf2c18ac4ddb

IMPHASH 524e7ef5afce081e46fe7bc1925ac71c
SHA256 e08dfab8be838176602f0abf51e8ffbbb6d141301f2c63b2c9daaf2c18ac4ddb
MD5 1e5e450c0d0509cf46cc7772031efc5f
SHA1 ca2f71075027b06aa599cf1c1af5b884e8c5e7e7
SHA512 17c5ee4c34c3b6db91aa1ea06fb5d4e66c96c8ec26fad0164c7640b316773ed510d99092bdb98b391a4e3323ee59065169ffd1bc70630171e93fa9787764cffb
SSDEEP 6144:VqfnHiHxQLN/cD6FOtFJjRWZ889wVFde4SE8mukNfCpyI3feJdXDewsd6z:Vq/8reFwjRWZpwfdpSzmukNqt3fcR
TLSH
T1F8744C25E7DA0559E027E67E8263D237F6337AD9635063DF82B4CA682703D62327DE40
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5760

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpReceiveResponse WinHttpSendRequest WinHttpAddRequestHeaders WinHttpOpenRequest WinHttpQueryHeaders WinHttpOpen WinHttpQueryDataAvailable WinHttpReadData WinHttpConnect WinHttpCloseHandle WinHttpSetOption

ws2_32

inet_ntop gethostname freeaddrinfo getaddrinfo

advapi32

QueryServiceStatusEx RegDeleteValueA RegDeleteKeyA RegSaveKeyA LookupPrivilegeValueA AdjustTokenPrivileges ConvertSidToStringSidA LogonUserA OpenServiceW CreateServiceW ChangeServiceConfig2W RegDeleteTreeW RegSetValueExW RegOpenKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW StartServiceA LookupAccountSidA QueryServiceConfigA OpenServiceA OpenSCManagerW OpenSCManagerA EnumServicesStatusExW DeleteService CreateServiceA ControlService CreateProcessWithLogonW RegCloseKey RegEnumValueA RegOpenKeyExA RegQueryValueExA GetUserNameA CreateProcessAsUserA AllocateAndInitializeSid CheckTokenMembership FreeSid ImpersonateLoggedOnUser RevertToSelf ImpersonateNamedPipeClient OpenThreadToken RegCreateKeyExA RegSetValueExA RegDeleteTreeA OpenProcessToken GetSidSubAuthority GetSidSubAuthorityCount GetTokenInformation DuplicateTokenEx CloseServiceHandle

dbghelp

MiniDumpWriteDump

netapi32

NetApiBufferFree NetServerEnum

ole32

CoCreateInstance CoSetProxyBlanket CoUninitialize CoInitializeEx CoInitializeSecurity

oleaut32

SysAllocString SysFreeString SafeArrayDestroy SafeArrayAccessData SafeArrayUnaccessData SafeArrayPutElement SafeArrayCreateVector VariantInit VariantClear SafeArrayCreate

shell32

SHGetFolderPathA SHGetFolderPathW ShellExecuteA

user32

GetAsyncKeyState GetKeyState PeekMessageA DispatchMessageA TranslateMessage GetClipboardData ToUnicode CallNextHookEx MessageBoxA GetWindowTextA GetForegroundWindow ReleaseDC GetDC GetSystemMetrics GetKeyboardState MapVirtualKeyA SetWindowsHookExA CloseClipboard UnhookWindowsHookEx OpenClipboard

gdi32

BitBlt CreateCompatibleDC DeleteDC DeleteObject GetDIBits SelectObject GetStockObject CreateCompatibleBitmap

bcrypt

BCryptEncrypt BCryptGenerateSymmetricKey BCryptCloseAlgorithmProvider BCryptDecrypt BCryptDestroyKey BCryptGenRandom BCryptSetProperty BCryptOpenAlgorithmProvider

mscoree

CLRCreateInstance

kernel32

InitializeProcThreadAttributeList DeleteProcThreadAttributeList UpdateProcThreadAttribute SetCurrentDirectoryA GetCurrentDirectoryA GetCurrentProcessId GetComputerNameA LocalFree Process32First Process32Next GetTempPathA GetStdHandle SetStdHandle ReadProcessMemory Thread32Next Thread32First SetThreadContext GetThreadContext SuspendThread OpenThread TerminateProcess CreateNamedPipeA GetCurrentThread CreateEventA DisconnectNamedPipe ConnectNamedPipe WideCharToMultiByte GlobalLock GlobalUnlock GetLocalTime CreateThread VirtualFreeEx WriteProcessMemory VirtualProtectEx VirtualAllocEx VirtualFree VirtualAlloc OpenProcess CreateProcessA CreateRemoteThread QueueUserAPC DuplicateHandle Process32NextW Process32FirstW CreateToolhelp32Snapshot GetModuleHandleA GetTickCount64 GetSystemInfo GlobalMemoryStatusEx GetCurrentProcess CheckRemoteDebuggerPresent IsDebuggerPresent Sleep FlushInstructionCache Module32First Module32Next DeleteFileW CopyFileW VirtualProtect CreateEventW GetTickCount LoadLibraryA GetProcAddress MultiByteToWideChar MoveFileExA CopyFileA GetModuleFileNameA ResumeThread HeapAlloc HeapFree GetProcessHeap ExitProcess GetEnvironmentStrings FreeEnvironmentStringsA GetEnvironmentVariableA SetEnvironmentVariableA CreateDirectoryA CreateFileA DeleteFileA GetFileAttributesA GetFileSize ReadFile WriteFile CloseHandle SetHandleInformation GetLastError CreatePipe HeapReAlloc InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection WaitForSingleObject GetExitCodeProcess

Name

.text

Size

293KB

Virtual Size

292KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

41KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.CRT

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

e08dfab8be838176602f0abf51e8ffbbb6d141301f2c63b2c9daaf2c18ac4ddb

winhttp

ws2_32

advapi32

dbghelp

netapi32

ole32

oleaut32

shell32

user32

gdi32

bcrypt

mscoree

kernel32

generic