ea82188b94ab9b3dd83fbccb2a6e12acc5aadf8a4a3d893c029a86c8018b3f90

General

Target
ea82188b94ab9b3dd83fbccb2a6e12acc5aadf8a4a3d893c029a86c8018b3f90
Size 268KB
Sample260805-e3ykssvyes
SHA256 ea82188b94ab9b3dd83fbccb2a6e12acc5aadf8a4a3d893c029a86c8018b3f90
MD5 81632533da8b5f08f4e481f091dd7c35
SHA1 b615b9f7e3df231bfee5a00ff1b9258287bc9b01
SHA512 40dcbc62b02b6cc702a852db3a8b8a14b039e479a490b10dbf9eb6b8deb440f6527edf4b35b78acabc4eb8fb779f9dacd0317d0a95b768a098374fd582629d3c
SSDEEP 6144:Twe9gXXMmbhFItM8s0gHUgXwV5LZYaamoJWv:x9gHDjIt40g0nLaaa
TLSH
T18844BE9673F101F9E1B38674C9960606FB72B82507609BEF03A047B6AF276D15D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ea82188b94ab9b3dd83fbccb2a6e12acc5aadf8a4a3d893c029a86c8018b3f90

File Explorer

ea82188b94ab9b3dd83fbccb2a6e12acc5aadf8a4a3d893c029a86c8018b3f90

.exe 268KB

ea82188b94ab9b3dd83fbccb2a6e12acc5aadf8a4a3d893c029a86c8018b3f90

IMPHASH 160a24d601818ddbeca7cd4126843ded
SHA256 ea82188b94ab9b3dd83fbccb2a6e12acc5aadf8a4a3d893c029a86c8018b3f90
MD5 81632533da8b5f08f4e481f091dd7c35
SHA1 b615b9f7e3df231bfee5a00ff1b9258287bc9b01
SHA512 40dcbc62b02b6cc702a852db3a8b8a14b039e479a490b10dbf9eb6b8deb440f6527edf4b35b78acabc4eb8fb779f9dacd0317d0a95b768a098374fd582629d3c
SSDEEP 6144:Twe9gXXMmbhFItM8s0gHUgXwV5LZYaamoJWv:x9gHDjIt40g0nLaaa
TLSH
T18844BE9673F101F9E1B38674C9960606FB72B82507609BEF03A047B6AF276D15D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

14528

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

RATel.pdb

ws2_32

inet_ntop freeaddrinfo getaddrinfo WSACleanup WSAStartup gethostname

advapi32

GetUserNameW

kernel32

CloseHandle HeapSize SetFilePointerEx CreateFileW FreeLibrary GetCommandLineW HeapAlloc HeapFree GetProcessHeap Sleep GetLocalTime GetTickCount64 VirtualAlloc VirtualProtect GetModuleHandleA GetProcAddress LoadResource LockResource SizeofResource FindResourceW LoadLibraryA WideCharToMultiByte RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW GetFileSizeEx RtlUnwindEx GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetStdHandle GetFileType GetModuleFileNameW GetModuleHandleExW WriteConsoleW WriteFile ExitProcess GetCommandLineA FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx CompareStringW LCMapStringW HeapReAlloc OutputDebugStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW FlushFileBuffers GetConsoleOutputCP GetConsoleMode

Name

.text

Size

111KB

Virtual Size

111KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

47KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

97KB

Virtual Size

97KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ea82188b94ab9b3dd83fbccb2a6e12acc5aadf8a4a3d893c029a86c8018b3f90

ws2_32

advapi32

kernel32

generic