ebea51cc7d972211421043bcbadfd2503989f0acf0d99373e9528b27c990c3e8

Sharing

Copy URL Twitter E-mail

General

Target
ebea51cc7d972211421043bcbadfd2503989f0acf0d99373e9528b27c990c3e8
Size 686KB
Sample260805-bcjgeabc82
SHA256 ebea51cc7d972211421043bcbadfd2503989f0acf0d99373e9528b27c990c3e8
MD5 58d8be0d8c21f8c8edb5b5fa94656554
SHA1 c5f1db2631e2629d9c49e1ad4adcfe163262b1be
SHA512 1d5bc1cc7535204afabaf36cacdc6cbfd6355d5654efdbda18c640ff28c5a92ee87468901cf23c89cf72302abc9b6058effb043b55c16ff4ef72efd6d8f138f5
SSDEEP 12288:1Cn5HbrEE7thWF8XTUrm0Zlrcj/uu4fJzov3um58/:U57rEE7t8YUrm0Z9kmu4p66
TLSH
T193E48D5A7BA441F9D167D13ACD528946F7B278061B319BDF03A043AB2F276E04E3B721
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ebea51cc7d972211421043bcbadfd2503989f0acf0d99373e9528b27c990c3e8

File Explorer

ebea51cc7d972211421043bcbadfd2503989f0acf0d99373e9528b27c990c3e8

.exe 686KB

ebea51cc7d972211421043bcbadfd2503989f0acf0d99373e9528b27c990c3e8

IMPHASH d7f229bef9a298bf4e759b3da6243953
SHA256 ebea51cc7d972211421043bcbadfd2503989f0acf0d99373e9528b27c990c3e8
MD5 58d8be0d8c21f8c8edb5b5fa94656554
SHA1 c5f1db2631e2629d9c49e1ad4adcfe163262b1be
SHA512 1d5bc1cc7535204afabaf36cacdc6cbfd6355d5654efdbda18c640ff28c5a92ee87468901cf23c89cf72302abc9b6058effb043b55c16ff4ef72efd6d8f138f5
SSDEEP 12288:1Cn5HbrEE7thWF8XTUrm0Zlrcj/uu4fJzov3um58/:U57rEE7t8YUrm0Z9kmu4p66
TLSH
T193E48D5A7BA441F9D167D13ACD528946F7B278061B319BDF03A043AB2F276E04E3B721
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

155188

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\kygx2019\trunk\bin\ReportBSGuard64.pdb

kernel32

lstrcpyW GetDriveTypeW HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap CreateEventW SetEvent WaitForSingleObject CreateFileMappingW CreatePipe GetStartupInfoW CreateProcessW Sleep lstrcmpA LocalAlloc K32GetProcessImageFileNameW lstrcmpiW QueryDosDeviceW lstrlenW CreateTimerQueue UnregisterWaitEx GetModuleHandleW GetComputerNameW DeleteCriticalSection GetFileSize LocalFree GetProcAddress WideCharToMultiByte LoadLibraryW RaiseException CloseHandle Process32FirstW lstrcatW OutputDebugStringW Process32NextW GetLastError MultiByteToWideChar CreateToolhelp32Snapshot InterlockedPopEntrySList ReleaseSemaphore DuplicateHandle VirtualFree VirtualProtect VirtualAlloc GetVersionExW GetModuleHandleA GetThreadTimes UnregisterWait RegisterWaitForSingleObject SetThreadAffinityMask GetProcessAffinityMask GetNumaHighestNodeNumber DeleteTimerQueueTimer ChangeTimerQueueTimer CreateTimerQueueTimer GetLogicalProcessorInformation GetThreadPriority SetThreadPriority SignalObjectAndWait RtlUnwind DecodePointer FreeLibrary TryEnterCriticalSection WriteConsoleW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindFirstFileExW ReadConsoleW SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers SetStdHandle GetFullPathNameW GetCurrentDirectoryW GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetCurrentThread GetCommandLineW GetCommandLineA ExitProcess FileTimeToSystemTime SystemTimeToTzSpecificLocalTime PeekNamedPipe GetFileType GetFileInformationByHandle GetModuleHandleExW FreeLibraryAndExitThread ReadFile GetLogicalDriveStringsW OpenProcess CreateFileW InitializeCriticalSectionEx GetModuleFileNameW GetPrivateProfileIntW WriteFile GetCurrentProcess QueryDepthSList EncodePointer EnterCriticalSection LeaveCriticalSection SetLastError InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetTickCount CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo IsDebuggerPresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent ResetEvent WaitForSingleObjectEx QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead FormatMessageA GetStdHandle FindFirstFileW FindNextFileW FindClose GetLocalTime GetFileSizeEx GetDiskFreeSpaceExW SetFilePointer SetFileAttributesW DeleteFileW RtlUnwindEx RtlPcToFileHeader InterlockedPushEntrySList InterlockedFlushSList LoadLibraryExW CreateThread ExitThread

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey

shell32

ord165

oleaut32

VariantClear

shlwapi

PathAddBackslashW SHGetValueA PathFileExistsW PathRemoveFileSpecW

iphlpapi

GetAdaptersInfo

ws2_32

inet_addr inet_ntoa

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

winhttp

WinHttpReceiveResponse WinHttpReadData WinHttpSendRequest WinHttpQueryHeaders WinHttpConnect WinHttpSetTimeouts WinHttpCloseHandle WinHttpCrackUrl WinHttpOpen WinHttpQueryDataAvailable WinHttpOpenRequest WinHttpAddRequestHeaders

crypt32

CryptMsgClose CryptMsgOpenToDecode CryptMsgUpdate CryptMsgGetParam CryptQueryObject CertFindCertificateInStore CertOpenStore CertCloseStore CertFreeCertificateContext CertGetNameStringW

Sharing

General

Malware Config

Signatures

File Explorer

ebea51cc7d972211421043bcbadfd2503989f0acf0d99373e9528b27c990c3e8

kernel32

advapi32

shell32

oleaut32

shlwapi

iphlpapi

ws2_32

version

winhttp

crypt32

generic