96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb

Sharing

Copy URL Twitter E-mail

General

Target
96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb
Size 975KB
Sample260805-ryrynsbf72
SHA256 96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb
MD5 7749a13cbc2164fcc893cb8972fbb463
SHA1 6bd65364152ccd9a23d56e8312a114ce1c1ba785
SHA512 4bce2b491b721354b09cbbfb91c7f9bfbc28ac316e32da8a314f4c658ce701a612af65abb10e63b4e5917045b85db0d4976d96debbd510b7a1e731fc1a5080b3
SSDEEP 24576:EEB1Nre7hfgwOcR3ARvOoXf93KyrYmhGs3:EExe7lgwEbKyrYw3
TLSH
T120257D5A96E001EAC567C179CD675607E776B80A13306BDF0BE24A961F23BE09F3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb

File Explorer

96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb

.exe 975KB

96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb

IMPHASH 87faf32f3b821017576af9bd83f1b489
SHA256 96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb
MD5 7749a13cbc2164fcc893cb8972fbb463
SHA1 6bd65364152ccd9a23d56e8312a114ce1c1ba785
SHA512 4bce2b491b721354b09cbbfb91c7f9bfbc28ac316e32da8a314f4c658ce701a612af65abb10e63b4e5917045b85db0d4976d96debbd510b7a1e731fc1a5080b3
SSDEEP 24576:EEB1Nre7hfgwOcR3ARvOoXf93KyrYmhGs3:EExe7lgwEbKyrYw3
TLSH
T120257D5A96E001EAC567C179CD675607E776B80A13306BDF0BE24A961F23BE09F3E311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

527116

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

htons ioctlsocket connect select socket WSAStartup freeaddrinfo getaddrinfo shutdown send recv inet_pton WSAGetLastError closesocket

bcrypt

BCryptGenRandom

advapi32

OpenProcessToken RegOpenKeyExW RegDeleteValueW RegCloseKey AdjustTokenPrivileges LookupPrivilegeValueW StartServiceW SetServiceStatus RegisterServiceCtrlHandlerW QueryServiceStatusEx QueryServiceStatus OpenServiceW OpenSCManagerW CreateServiceW ControlService CloseServiceHandle ChangeServiceConfig2W ChangeServiceConfigW RegSetValueExW RegQueryValueExW RegEnumKeyExW RegCreateKeyExW StartServiceCtrlDispatcherW

wininet

InternetSetOptionW

ole32

CoCreateGuid CoInitializeEx

crypt32

CertCloseStore CertAddEncodedCertificateToStore CryptStringToBinaryA CertOpenStore

kernel32

EnumSystemLocalesW GetConsoleMode ReadConsoleW SetFilePointerEx GetConsoleOutputCP GetFileSizeEx DeleteFileW HeapReAlloc FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW FlushFileBuffers HeapSize SetEndOfFile WriteConsoleW InitializeCriticalSectionEx GetLastError GetCurrentProcessId FreeConsole CreateDirectoryW CreateFileW GetFileAttributesW GetFileAttributesExW GetFileSize ReadFile WriteFile CloseHandle DeviceIoControl SetEvent WaitForSingleObject CreateMutexW CreateEventW Sleep GetCurrentProcess TerminateProcess GetExitCodeProcess CreateProcessW OpenProcess GetSystemTimeAsFileTime GetTickCount GetSystemDirectoryW GetWindowsDirectoryW CopyFileW MoveFileExW GetComputerNameW SystemTimeToFileTime MultiByteToWideChar WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW FindClose FindNextFileW MoveFileExA WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection DeleteCriticalSection QueryPerformanceCounter WakeAllConditionVariable SleepConditionVariableSRW EncodePointer DecodePointer LCMapStringEx GetModuleHandleW GetProcAddress GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetStdHandle GetModuleFileNameW ExitProcess GetCommandLineA GetCommandLineW HeapFree HeapAlloc GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect

Name

.text

Size

676KB

Virtual Size

676KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

255KB

Virtual Size

255KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

30KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

96bfc41f969b2df575405bfd4107485fd19ffbee36a271add5d07b1971808fdb

ws2_32

bcrypt

advapi32

wininet

ole32

crypt32

kernel32

generic