88f831a9b26e05431322c309c4db7bfa9e7118a91184056570ce27e2d356d660

General

Target
88f831a9b26e05431322c309c4db7bfa9e7118a91184056570ce27e2d356d660
Size 1.4MB
Sample260805-e5sgkaybjc
SHA256 88f831a9b26e05431322c309c4db7bfa9e7118a91184056570ce27e2d356d660
MD5 3874f2ad3340b1d0b3f398d9c4a5beb0
SHA1 6ed6a75e5c81903369a5048e2780cd9fc2e16b88
SHA512 b36542c1b0c378bf1b9c78342c1ef49d12781e8313f3a34d404288b9d4d49a426b11f5a196f46ad7fa21edef61f915d912ec4014234537e59b2ef3895afa0e63
SSDEEP 24576:pnl3M2DAgQVBfqN5bGM7xL1p1Dwv63uVmD0NqfekG7YV5xwd8lp8c4fQJbeLAqUY:pnlM2DA15qDSMN1p10v63qmQNq5Ga5WB
TLSH
T18265236B72A080B3D03382798873861AF3B6780A07756BDF57B8464A1F633D05D7A767
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
88f831a9b26e05431322c309c4db7bfa9e7118a91184056570ce27e2d356d660

File Explorer

88f831a9b26e05431322c309c4db7bfa9e7118a91184056570ce27e2d356d660

.dll 1.4MB

88f831a9b26e05431322c309c4db7bfa9e7118a91184056570ce27e2d356d660

IMPHASH c921ed2e2aa86470b0ed7be776edad07
SHA256 88f831a9b26e05431322c309c4db7bfa9e7118a91184056570ce27e2d356d660
MD5 3874f2ad3340b1d0b3f398d9c4a5beb0
SHA1 6ed6a75e5c81903369a5048e2780cd9fc2e16b88
SHA512 b36542c1b0c378bf1b9c78342c1ef49d12781e8313f3a34d404288b9d4d49a426b11f5a196f46ad7fa21edef61f915d912ec4014234537e59b2ef3895afa0e63
SSDEEP 24576:pnl3M2DAgQVBfqN5bGM7xL1p1Dwv63uVmD0NqfekG7YV5xwd8lp8c4fQJbeLAqUY:pnlM2DA15qDSMN1p10v63qmQNq5Ga5WB
TLSH
T18265236B72A080B3D03382798873861AF3B6780A07756BDF57B8464A1F633D05D7A767
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

36640

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

F:\8QProject\process_x64_no_process\Release_nocreateprocess\process_noprocess_x64_dll.pdb

kernel32

MapViewOfFile GetComputerNameA DeleteProcThreadAttributeList FindResourceA LoadResource HeapAlloc GetCurrentProcess HeapFree GetModuleHandleW GetProcessHeap OpenProcess WideCharToMultiByte K32GetModuleFileNameExA SizeofResource ReadProcessMemory CreateProcessA GetSystemDirectoryA GetLastError GetProcAddress VirtualAlloc OpenMutexA LocalAlloc IsWow64Process LockResource CreateMutexA ReleaseMutex InitializeProcThreadAttributeList LocalFree CreateThread ResumeThread SetThreadContext CreateFileMappingA Sleep IsDebuggerPresent GetCurrentProcessId GetModuleFileNameA CloseHandle Process32Next Process32First MultiByteToWideChar CreateToolhelp32Snapshot GetThreadContext Wow64SetThreadContext Wow64GetThreadContext VirtualFreeEx EncodePointer DecodePointer IsProcessorFeaturePresent GetSystemTimeAsFileTime GetCommandLineA GetCurrentThreadId RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx IsValidCodePage GetACP GetOEMCP GetCPInfo SetLastError ExitProcess GetModuleHandleExW HeapSize GetStdHandle WriteFile GetModuleFileNameW GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetFileType DeleteCriticalSection QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW LoadLibraryExW HeapReAlloc OutputDebugStringW LoadLibraryW GetConsoleCP GetConsoleMode SetFilePointerEx SetStdHandle FlushFileBuffers WriteConsoleW CreateFileW VirtualAllocEx WriteProcessMemory VirtualProtectEx CreateRemoteThread WaitForSingleObject

user32

wsprintfW

advapi32

AdjustTokenPrivileges LookupPrivilegeValueA LookupAccountSidA GetTokenInformation OpenProcessToken

Sharing

General

Malware Config

Signatures

File Explorer

88f831a9b26e05431322c309c4db7bfa9e7118a91184056570ce27e2d356d660

kernel32

user32

advapi32

generic