e3f265acc71e466e4c22a1fe0bb305afac58beda563d5ca2e872731be0fcc317

Sharing

Copy URL Twitter E-mail

General

Target
e3f265acc71e466e4c22a1fe0bb305afac58beda563d5ca2e872731be0fcc317
Size 230KB
Sample260805-d72btach64
SHA256 e3f265acc71e466e4c22a1fe0bb305afac58beda563d5ca2e872731be0fcc317
MD5 5fd21d7f4470aa8b2fb3f8fc28b67ee1
SHA1 870e855aae3defd248b23a3153b975a8a5e2b1ce
SHA512 cdc73ee2f3591ec283def58d0549552bfdd34a1e8e8b309be45c39c4f933aafcafc6476631cebad0fa7eb4bcb2c83faea6ff02b553328c7b432df9056253cd2b
SSDEEP 3072:djp1mAfdwT2EeH/ikwxxlZwYmiafklCVaWkD8YW1rG6Fgfk4KUNq6r663fiA:j1p0Q6b4g9AgfkLUNqlS6A
TLSH
T1AB340A1B73931CF8C76B807642E69772B631F4560319AE2F0AA4CB363E31E645E69D34
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e3f265acc71e466e4c22a1fe0bb305afac58beda563d5ca2e872731be0fcc317

File Explorer

e3f265acc71e466e4c22a1fe0bb305afac58beda563d5ca2e872731be0fcc317

.exe 230KB

e3f265acc71e466e4c22a1fe0bb305afac58beda563d5ca2e872731be0fcc317

IMPHASH 2ec3bdda8da1c1d000a50a3c0650d73c
SHA256 e3f265acc71e466e4c22a1fe0bb305afac58beda563d5ca2e872731be0fcc317
MD5 5fd21d7f4470aa8b2fb3f8fc28b67ee1
SHA1 870e855aae3defd248b23a3153b975a8a5e2b1ce
SHA512 cdc73ee2f3591ec283def58d0549552bfdd34a1e8e8b309be45c39c4f933aafcafc6476631cebad0fa7eb4bcb2c83faea6ff02b553328c7b432df9056253cd2b
SSDEEP 3072:djp1mAfdwT2EeH/ikwxxlZwYmiafklCVaWkD8YW1rG6Fgfk4KUNq6r663fiA:j1p0Q6b4g9AgfkLUNqlS6A
TLSH
T1AB340A1B73931CF8C76B807642E69772B631F4560319AE2F0AA4CB363E31E645E69D34
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

GetUserNameW RegCloseKey RegCreateKeyExW RegOpenKeyExW RegQueryValueExW RegSetValueExW

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDeriveKey BCryptDestroyHash BCryptDestroyKey BCryptDestroySecret BCryptEncrypt BCryptExportKey BCryptFinalizeKeyPair BCryptFinishHash BCryptGenRandom BCryptGenerateKeyPair BCryptGenerateSymmetricKey BCryptGetProperty BCryptHashData BCryptImportKeyPair BCryptOpenAlgorithmProvider BCryptSecretAgreement BCryptSetProperty

kernel32

CloseHandle CreateFileW CreatePipe CreateProcessW CreateThread CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileW EnterCriticalSection FormatMessageA GetCPInfo GetConsoleWindow GetCurrentDirectoryW GetCurrentProcessId GetFileAttributesW GetFileSize GetLastError GetModuleFileNameW GetModuleHandleA GetProcAddress GetProcessHeap GetThreadId HeapAlloc HeapFree InitializeCriticalSection LeaveCriticalSection LoadLibraryW LocalFree MultiByteToWideChar OpenProcess Process32FirstW Process32NextW RaiseException ReadFile RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetConsoleOutputCP SetCurrentDirectoryW SetHandleInformation SetLastError SetUnhandledExceptionFilter Sleep TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryEnterCriticalSection VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte WriteFile

msvcrt

__C_specific_handler ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _cexit _commode _errno _fileno _fmode _initterm _setmode _time64 _wchdir _wsystem abort atexit calloc exit fflush fprintf fputc fputs free fwrite getenv localeconv malloc memchr memcmp memcpy memmove memset rand realloc setvbuf signal srand strchr strcmp strerror strlen strncmp strstr strtoul vfprintf wcscpy wcslen _read

user32

ShowWindow

ws2_32

WSACleanup WSASocketW WSAStartup closesocket connect htons inet_addr recv send

Name

.text

Size

172KB

Virtual Size

172KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

608B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

e3f265acc71e466e4c22a1fe0bb305afac58beda563d5ca2e872731be0fcc317

advapi32

bcrypt

kernel32

msvcrt

user32

ws2_32

generic