6d6cf3cd86f5de3fb1124b1da8244acde16e245728060deb9b3574da52a97a3e

General

Target
6d6cf3cd86f5de3fb1124b1da8244acde16e245728060deb9b3574da52a97a3e
Size 148KB
Sample260805-let12agh99
SHA256 6d6cf3cd86f5de3fb1124b1da8244acde16e245728060deb9b3574da52a97a3e
MD5 31129f479feeb9b9424f03e6cc79b4a4
SHA1 3fdb42ced06dfb29dd65f8e3cdb15d205a5ba1a6
SHA512 2cfbe66bf3bc6fb8daaca89304cc1b51113dc22cd1cceb334fc09ac610b41ae59f9f127e848d0a69fc254865165534c69a67aae79e2f781529970840c801b564
SSDEEP 3072:x8bu6kL/gbVpyz4t8km1JbTy97FvBXTUUizcE:+S6kL/g6z6rwbm97BFE
TLSH
T1E8E35B5BB3A500FBE1728239CA635646E7B2781517609BDF03A443762F237D19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6d6cf3cd86f5de3fb1124b1da8244acde16e245728060deb9b3574da52a97a3e

File Explorer

6d6cf3cd86f5de3fb1124b1da8244acde16e245728060deb9b3574da52a97a3e

.dll 148KB

6d6cf3cd86f5de3fb1124b1da8244acde16e245728060deb9b3574da52a97a3e

IMPHASH 73e603a359b7c4fda67d10d6ac7e04a5
SHA256 6d6cf3cd86f5de3fb1124b1da8244acde16e245728060deb9b3574da52a97a3e
MD5 31129f479feeb9b9424f03e6cc79b4a4
SHA1 3fdb42ced06dfb29dd65f8e3cdb15d205a5ba1a6
SHA512 2cfbe66bf3bc6fb8daaca89304cc1b51113dc22cd1cceb334fc09ac610b41ae59f9f127e848d0a69fc254865165534c69a67aae79e2f781529970840c801b564
SSDEEP 3072:x8bu6kL/gbVpyz4t8km1JbTy97FvBXTUUizcE:+S6kL/g6z6rwbm97BFE
TLSH
T1E8E35B5BB3A500FBE1728239CA635646E7B2781517609BDF03A443762F237D19E3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

20220

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

winhttp

WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpSetOption WinHttpOpenRequest WinHttpSendRequest WinHttpReceiveResponse WinHttpCrackUrl

bcrypt

BCryptGetProperty BCryptSetProperty BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptDecrypt BCryptDestroyKey BCryptOpenAlgorithmProvider

kernel32

LoadLibraryExW WriteConsoleW CreateFileW CloseHandle GetConsoleMode GetConsoleOutputCP WriteFile FlushFileBuffers HeapSize SetStdHandle GetStringTypeW SetFilePointerEx GetProcessHeap Sleep VirtualFree DisableThreadLibraryCalls lstrcpynA MultiByteToWideChar VirtualAlloc GetModuleHandleA GetProcAddress LoadLibraryA RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx InterlockedFlushSList GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary EncodePointer RaiseException RtlPcToFileHeader ExitProcess GetModuleHandleExW GetModuleFileNameW HeapFree HeapAlloc GetStdHandle GetFileType HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect LCMapStringW

Name

.text

Size

92KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

44KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

6d6cf3cd86f5de3fb1124b1da8244acde16e245728060deb9b3574da52a97a3e

winhttp

bcrypt

kernel32

generic