8708331ee202cb881a067fde3adfdd75c9d560faa58ca882bcecadf9f4a2be90

General

Target
8708331ee202cb881a067fde3adfdd75c9d560faa58ca882bcecadf9f4a2be90
Size 244KB
Sample260806-rmx1jsdk2x
SHA256 8708331ee202cb881a067fde3adfdd75c9d560faa58ca882bcecadf9f4a2be90
MD5 c124da5a3890f478b087929ed6378141
SHA1 15e01ab7d8af4b311ce3cf7e0e49ca41030f4a1a
SHA512 9529280962d3f1f6114ecfabe0286ee221128b4c7892f699a43684cb865d0c8accb0ed4b5c897d44a6d21950b697a1f0cc4d59eddc5543410481cde3794a4787
SSDEEP 3072:cQfv5gd7yQ7X6L2PQ5vOSNyZ8+xL7d8wQH8TZbGaw2GlumSk+wVx8RRDo4:dxg8QGtOgI8+YFWhcwRRDo4
TLSH
T1FE347E1273915CFCEC67C03DC2564A56AA7278950B21DAEF039443396F6BAF29E3C760
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8708331ee202cb881a067fde3adfdd75c9d560faa58ca882bcecadf9f4a2be90

File Explorer

8708331ee202cb881a067fde3adfdd75c9d560faa58ca882bcecadf9f4a2be90

.exe 244KB

8708331ee202cb881a067fde3adfdd75c9d560faa58ca882bcecadf9f4a2be90

IMPHASH bbb3e6570f2da25c8761ad86618997df
SHA256 8708331ee202cb881a067fde3adfdd75c9d560faa58ca882bcecadf9f4a2be90
MD5 c124da5a3890f478b087929ed6378141
SHA1 15e01ab7d8af4b311ce3cf7e0e49ca41030f4a1a
SHA512 9529280962d3f1f6114ecfabe0286ee221128b4c7892f699a43684cb865d0c8accb0ed4b5c897d44a6d21950b697a1f0cc4d59eddc5543410481cde3794a4787
SSDEEP 3072:cQfv5gd7yQ7X6L2PQ5vOSNyZ8+xL7d8wQH8TZbGaw2GlumSk+wVx8RRDo4:dxg8QGtOgI8+YFWhcwRRDo4
TLSH
T1FE347E1273915CFCEC67C03DC2564A56AA7278950B21DAEF039443396F6BAF29E3C760
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

101504

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

build_script_build-5b81abcd85ba299d.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

kernel32

HeapSize LCMapStringW CompareStringW GetProcessHeap HeapFree HeapReAlloc CloseHandle lstrlenW GetCurrentProcess GetProcAddress WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA GetCurrentProcessId CreateMutexA ReleaseMutex SetFilePointerEx GetLastError FlushFileBuffers WaitForSingleObject AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread SetLastError GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW GetCommandLineW CreateFileW FindFirstFileExW FindClose GetConsoleMode GetFileType GetModuleHandleW FormatMessageW SetEnvironmentVariableW GetModuleHandleA GetModuleFileNameW ExitProcess HeapAlloc MultiByteToWideChar WriteConsoleW GetStdHandle GetConsoleOutputCP FreeEnvironmentStringsW QueryPerformanceCounter GetCurrentThreadId TerminateProcess RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind FindNextFileW VirtualProtect InitializeCriticalSectionEx FlsFree FlsSetValue FlsGetValue FlsAlloc GetStringTypeW SetStdHandle GetCPInfo GetOEMCP GetACP IsValidCodePage GetCommandLineA GetModuleHandleExW WriteFile LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection EnterCriticalSection EncodePointer RaiseException RtlPcToFileHeader GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent RtlUnwindEx

ntdll

RtlNtStatusToDosError NtWriteFile

Name

.text

Size

156KB

Virtual Size

155KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

72KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

8708331ee202cb881a067fde3adfdd75c9d560faa58ca882bcecadf9f4a2be90

api-ms-win-core-synch-l1-2-0

kernel32

ntdll

generic