d3cb0698486fe332f97d06512eb7724120b228a8706c27cc00cc8fd2b9bc868e

Sharing

Copy URL Twitter E-mail

General

Target
d3cb0698486fe332f97d06512eb7724120b228a8706c27cc00cc8fd2b9bc868e
Size 3.1MB
Sample260805-kdq3bashqb
SHA256 d3cb0698486fe332f97d06512eb7724120b228a8706c27cc00cc8fd2b9bc868e
MD5 66fbc067fbe51c242ebb558faa53539f
SHA1 c40ac591739a2b985cab5b49760ff4d9caa45a73
SHA512 2774bba47161c2cc819860ac9662b04dc2edda24355aef1569e19d228311c5f7c5a55f82576c9d45c52c14d98de4ab6cfdd362a6ec2b7bde298a8854aee069d0
SSDEEP 49152:mSmr/RYWGGBT22oNbkzO5ZRUtqNA3Qn1rUkHOFZ5XL2mQ4IU6ipo:EGGVzooOWI89KH+
TLSH
T1A4E55C02BA9B94ECC15AC474C34A4A736E2174CB0726B9FF46D496383E6ABF15B3C714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d3cb0698486fe332f97d06512eb7724120b228a8706c27cc00cc8fd2b9bc868e

File Explorer

d3cb0698486fe332f97d06512eb7724120b228a8706c27cc00cc8fd2b9bc868e

.exe 3.1MB

d3cb0698486fe332f97d06512eb7724120b228a8706c27cc00cc8fd2b9bc868e

IMPHASH 6dcee9e2313d5e2c829d00e816995b9c
SHA256 d3cb0698486fe332f97d06512eb7724120b228a8706c27cc00cc8fd2b9bc868e
MD5 66fbc067fbe51c242ebb558faa53539f
SHA1 c40ac591739a2b985cab5b49760ff4d9caa45a73
SHA512 2774bba47161c2cc819860ac9662b04dc2edda24355aef1569e19d228311c5f7c5a55f82576c9d45c52c14d98de4ab6cfdd362a6ec2b7bde298a8854aee069d0
SSDEEP 49152:mSmr/RYWGGBT22oNbkzO5ZRUtqNA3Qn1rUkHOFZ5XL2mQ4IU6ipo:EGGVzooOWI89KH+
TLSH
T1A4E55C02BA9B94ECC15AC474C34A4A736E2174CB0726B9FF46D496383E6ABF15B3C714
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2252072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

InputMethodSvc.pdb

kernel32

GetComputerNameExW GlobalMemoryStatusEx GetSystemInfo GetTickCount64 GetProcAddress GetModuleHandleW GetSystemTimePreciseAsFileTime GetLastError CloseHandle HeapFree SetLastError LoadLibraryA HeapAlloc SetHandleInformation GetModuleHandleA GetSystemDirectoryW GetWindowsDirectoryW GetModuleFileNameW DuplicateHandle LoadLibraryExW FreeLibrary HeapSize VirtualProtect GetModuleHandleExW GetSystemTimeAsFileTime HeapReAlloc GetProcessHeap InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc GetStringTypeW GetFileType SetStdHandle SetEnvironmentVariableW GetCPInfo GetOEMCP GetACP IsValidCodePage GetCommandLineW GetCommandLineA WriteFile TlsFree TlsSetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer RaiseException RtlPcToFileHeader RtlUnwindEx GetStartupInfoW InitializeSListHead IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter FindNextFileW MoveFileExW CopyFileExW SwitchToThread DeleteFileW GetTempPathW GetExitCodeProcess WaitForMultipleObjects GetFileAttributesW CompareStringW LCMapStringW FlushFileBuffers SetFilePointerEx TlsGetValue GetOverlappedResult FindClose CreateToolhelp32Snapshot Process32FirstW Process32NextW OpenProcess TerminateProcess CreateThread QueryFullProcessImageNameW IsDebuggerPresent CreateMutexW FreeEnvironmentStringsW GetCurrentProcess QueryPerformanceCounter SetThreadExecutionState CreateWaitableTimerExW SetWaitableTimer WaitForSingleObject QueryPerformanceFrequency Sleep AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentThreadId GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry WaitForSingleObjectEx lstrlenW GetCurrentProcessId CreateMutexA ReleaseMutex RtlVirtualUnwind WideCharToMultiByte GetStdHandle GetConsoleMode GetConsoleOutputCP MultiByteToWideChar WriteConsoleW GetEnvironmentVariableW ReadFileEx SleepEx WriteFileEx FormatMessageW GetFullPathNameW CreateFileW SetFileTime SetFileInformationByHandle FindFirstFileExW GetFileInformationByHandle GetFileInformationByHandleEx CreateDirectoryW ExitProcess CreateEventW CancelIo ReadFile GetEnvironmentStringsW CompareStringOrdinal CreateProcessW

secur32

AcceptSecurityContext DeleteSecurityContext ApplyControlToken FreeCredentialsHandle DecryptMessage QueryContextAttributesW FreeContextBuffer InitializeSecurityContextW AcquireCredentialsHandleA EncryptMessage

crypt32

CertFreeCertificateChain CertGetCertificateChain CertDuplicateCertificateChain CertOpenStore CertVerifyCertificateChainPolicy CertAddCertificateContextToStore CertCloseStore CertDuplicateStore CertDuplicateCertificateContext CertEnumCertificatesInStore CertFreeCertificateContext

bcryptprimitives

ProcessPrng

advapi32

SystemFunction036 GetTokenInformation GetUserNameW RegSetValueExW OpenProcessToken RegCloseKey RegDeleteValueW RegQueryValueExW RegEnumValueW RegOpenKeyExW RegCreateKeyExW

ntdll

NtSuspendProcess NtCreateNamedPipeFile RtlNtStatusToDosError NtOpenFile NtResumeProcess NtWriteFile NtReadFile

bcrypt

BCryptGenRandom

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

shell32

ShellExecuteW

user32

GetAsyncKeyState IsWindowVisible SetProcessDPIAware ShowWindow GetWindowTextW keybd_event EnumWindows BlockInput GetForegroundWindow GetWindowThreadProcessId SendMessageW SetCursorPos GetDC GetSystemMetrics GetLastInputInfo mouse_event

ws2_32

closesocket getsockopt setsockopt recv getsockname ioctlsocket connect select WSAStartup WSAGetLastError send WSACleanup WSASocketW WSADuplicateSocketW WSASend freeaddrinfo getaddrinfo getpeername WSARecv

gdi32

DeleteDC DeleteObject GetDeviceCaps CreateCompatibleDC CreateCompatibleBitmap SelectObject BitBlt GetDIBits

Name

.text

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

782KB

Virtual Size

782KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

63KB

Virtual Size

63KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

d3cb0698486fe332f97d06512eb7724120b228a8706c27cc00cc8fd2b9bc868e

kernel32

secur32

crypt32

bcryptprimitives

advapi32

ntdll

bcrypt

api-ms-win-core-synch-l1-2-0

shell32

user32

ws2_32

gdi32

generic