10d6bac31dfd5fa8cd7daf5b0407be212cf30dda3709746d1c89ee3931d44fe7

General

Target
10d6bac31dfd5fa8cd7daf5b0407be212cf30dda3709746d1c89ee3931d44fe7
Size 215KB
Sample260806-rlsz7sshld
SHA256 10d6bac31dfd5fa8cd7daf5b0407be212cf30dda3709746d1c89ee3931d44fe7
MD5 8fcd725c660a9db6ba368555d640f365
SHA1 b11fbf70bb5ac4e5f7dd41f6080cb1a7f749801f
SHA512 9fd36baa55def8202c87482e68fe4747632388eef9f21f0639036660b7040bab9fe5cfe35031be0d07b894e6ed280331648823a41d89bf05c39222e49c102fdb
SSDEEP 3072:56EJTxSixsuSlMvAtci8g0Ba9TAxE5RfQGOIHUmS8/HZTv+gCHkL:5VJT9x6Ki779TAYJ3HUd8vhCHk
TLSH
T13B249E16739548FCE467C038C2514B56E67278C50B22DFEF03640279AF6BAE29E3DB61
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
10d6bac31dfd5fa8cd7daf5b0407be212cf30dda3709746d1c89ee3931d44fe7

File Explorer

10d6bac31dfd5fa8cd7daf5b0407be212cf30dda3709746d1c89ee3931d44fe7

.exe 215KB

10d6bac31dfd5fa8cd7daf5b0407be212cf30dda3709746d1c89ee3931d44fe7

IMPHASH f618e42940f8c73cee25edc797016e52
SHA256 10d6bac31dfd5fa8cd7daf5b0407be212cf30dda3709746d1c89ee3931d44fe7
MD5 8fcd725c660a9db6ba368555d640f365
SHA1 b11fbf70bb5ac4e5f7dd41f6080cb1a7f749801f
SHA512 9fd36baa55def8202c87482e68fe4747632388eef9f21f0639036660b7040bab9fe5cfe35031be0d07b894e6ed280331648823a41d89bf05c39222e49c102fdb
SSDEEP 3072:56EJTxSixsuSlMvAtci8g0Ba9TAxE5RfQGOIHUmS8/HZTv+gCHkL:5VJT9x6Ki779TAYJ3HUd8vhCHk
TLSH
T13B249E16739548FCE467C038C2514B56E67278C50B22DFEF03640279AF6BAE29E3DB61
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

81040

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

build_script_build-4c1beca9d6b0f3a6.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

kernel32

HeapSize LCMapStringW CompareStringW GetProcessHeap HeapFree HeapReAlloc CloseHandle lstrlenW GetCurrentProcess GetProcAddress WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA GetCurrentProcessId CreateMutexA ReleaseMutex SetFilePointerEx GetLastError FlushFileBuffers WaitForSingleObject AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread SetLastError GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW GetCommandLineW CreateFileW FindFirstFileExW FindClose GetConsoleMode GetFileType GetModuleHandleW SetEnvironmentVariableW GetModuleHandleA GetModuleFileNameW ExitProcess HeapAlloc MultiByteToWideChar WriteConsoleW GetStdHandle GetConsoleOutputCP FreeEnvironmentStringsW QueryPerformanceCounter GetCurrentThreadId TerminateProcess RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind FindNextFileW VirtualProtect InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc GetStringTypeW SetStdHandle GetCPInfo GetOEMCP GetACP IsValidCodePage GetCommandLineA GetModuleHandleExW WriteFile LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer RaiseException RtlPcToFileHeader GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent RtlUnwindEx

ntdll

RtlNtStatusToDosError NtWriteFile

Name

.text

Size

135KB

Virtual Size

135KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

65KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

10d6bac31dfd5fa8cd7daf5b0407be212cf30dda3709746d1c89ee3931d44fe7

api-ms-win-core-synch-l1-2-0

kernel32

ntdll

generic