0698a91abb76305cef9d0e849a68ac2da406a859d47e54271d2b4020a28e24e4

Sharing

Copy URL Twitter E-mail

General

Target
0698a91abb76305cef9d0e849a68ac2da406a859d47e54271d2b4020a28e24e4
Size 240KB
Sample260804-zhzycazcmf
SHA256 0698a91abb76305cef9d0e849a68ac2da406a859d47e54271d2b4020a28e24e4
MD5 b88d6af75021a08997b5bb558a0c0b09
SHA1 295b8048ee64d8a9ea6caf282bca79e3985758e8
SHA512 ad331d178cccd743bd5e769062a7a5938bf9b58632ad4378d82060c059fdbede6796bc3c803eae368dc9e8f59808038cdad280b127cfeedb22ddad4fcb0852bf
SSDEEP 6144:dEDOrOE/LugaYghQySKg8aRMM/IG6WOCko4:+mATmyitmM/IGfTko
TLSH
T141343A163658A9DCD46BC07881465B62B671B4C90B31FAFF06D042392F3AEF96E3C764
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0698a91abb76305cef9d0e849a68ac2da406a859d47e54271d2b4020a28e24e4

File Explorer

0698a91abb76305cef9d0e849a68ac2da406a859d47e54271d2b4020a28e24e4

.exe 240KB

0698a91abb76305cef9d0e849a68ac2da406a859d47e54271d2b4020a28e24e4

IMPHASH 52f3c0a077e6983e5d8e203f299721b9
SHA256 0698a91abb76305cef9d0e849a68ac2da406a859d47e54271d2b4020a28e24e4
MD5 b88d6af75021a08997b5bb558a0c0b09
SHA1 295b8048ee64d8a9ea6caf282bca79e3985758e8
SHA512 ad331d178cccd743bd5e769062a7a5938bf9b58632ad4378d82060c059fdbede6796bc3c803eae368dc9e8f59808038cdad280b127cfeedb22ddad4fcb0852bf
SSDEEP 6144:dEDOrOE/LugaYghQySKg8aRMM/IG6WOCko4:+mATmyitmM/IGfTko
TLSH
T141343A163658A9DCD46BC07881465B62B671B4C90B31FAFF06D042392F3AEF96E3C764
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

171744

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

build_script_build-2c608628668b0c41.pdb

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

kernel32

SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead CloseHandle GetLastError AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread WaitForSingleObject QueryPerformanceCounter RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetLastError GetCurrentDirectoryW GetEnvironmentVariableW SetFileInformationByHandle GetCurrentProcess GetStdHandle GetCurrentProcessId HeapFree HeapReAlloc lstrlenW ReleaseMutex CreateFileW GetConsoleMode GetModuleHandleW FormatMessageW GetFullPathNameW MultiByteToWideChar WriteConsoleW WideCharToMultiByte GetModuleHandleA GetProcAddress IsProcessorFeaturePresent GetProcessHeap HeapAlloc WaitForSingleObjectEx LoadLibraryA CreateMutexA GetSystemTimeAsFileTime GetCurrentThreadId

ntdll

RtlNtStatusToDosError NtWriteFile

vcruntime140

__current_exception __current_exception_context __C_specific_handler _CxxThrowException memcmp memmove memset __CxxFrameHandler3 memcpy

api-ms-win-crt-runtime-l1-1-0

_initterm_e exit _exit _initterm _get_initial_narrow_environment __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _configure_narrow_argv __p___argc _initialize_onexit_table _initialize_narrow_environment _register_onexit_function _crt_atexit terminate _set_app_type _seh_filter_exe

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

0698a91abb76305cef9d0e849a68ac2da406a859d47e54271d2b4020a28e24e4

api-ms-win-core-synch-l1-2-0

kernel32

ntdll

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic