3decbb716be2ce30e1ba94d04ffa513b8b94724e3f111880f0b43ac3eb91ca67

Sharing

Copy URL Twitter E-mail

General

Target
3decbb716be2ce30e1ba94d04ffa513b8b94724e3f111880f0b43ac3eb91ca67
Size 751KB
Sample260807-aeafvada35
SHA256 3decbb716be2ce30e1ba94d04ffa513b8b94724e3f111880f0b43ac3eb91ca67
MD5 4075ed8b6e89ccbbe059518156d702ff
SHA1 3373fc86371564fd8aa753803c6059d5de69eb3f
SHA512 6aaaa3164e694a26d595695f44928d57be1399f129ea106c04e6aa036347a31ba08baeb48ed5a08febc173d9c11c21e4e658d8c4380f219367459e7c4b6311e2
SSDEEP 12288:8BlZ4a9ojdai8+MJCvgPGDaubiVRKMzQNG2dYYp7VQIV:8BP28+MJGgPTubiVRKMzubN7
TLSH
T1F8F41721BA5A59ACC15AC43583568A72BA7230CB1B35A9FF00D941383FADEF51F3D358
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3decbb716be2ce30e1ba94d04ffa513b8b94724e3f111880f0b43ac3eb91ca67

File Explorer

3decbb716be2ce30e1ba94d04ffa513b8b94724e3f111880f0b43ac3eb91ca67

.exe 751KB

3decbb716be2ce30e1ba94d04ffa513b8b94724e3f111880f0b43ac3eb91ca67

IMPHASH 11ea00c1083687e3351e91bddc8b7eb3
SHA256 3decbb716be2ce30e1ba94d04ffa513b8b94724e3f111880f0b43ac3eb91ca67
MD5 4075ed8b6e89ccbbe059518156d702ff
SHA1 3373fc86371564fd8aa753803c6059d5de69eb3f
SHA512 6aaaa3164e694a26d595695f44928d57be1399f129ea106c04e6aa036347a31ba08baeb48ed5a08febc173d9c11c21e4e658d8c4380f219367459e7c4b6311e2
SSDEEP 12288:8BlZ4a9ojdai8+MJCvgPGDaubiVRKMzQNG2dYYp7VQIV:8BP28+MJGgPTubiVRKMzubN7
TLSH
T1F8F41721BA5A59ACC15AC43583568A72BA7230CB1B35A9FF00D941383FADEF51F3D358
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

529152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

akagi-12371ac805355217.pdb

ntdll

NtCreateNamedPipeFile NtOpenFile NtWriteFile NtReadFile RtlNtStatusToDosError

kernel32

WaitForMultipleObjects ExitProcess GetFileType GetModuleFileNameW LocalFree WaitForSingleObject WriteConsoleW MultiByteToWideChar LoadLibraryA GetProcAddress GetModuleHandleW InitializeSListHead lstrlenW GetFinalPathNameByHandleW ReleaseMutex CreateMutexA WaitForSingleObjectEx WideCharToMultiByte SwitchToThread GetSystemInfo FindClose GetCurrentProcess GetEnvironmentVariableW GetCurrentDirectoryW GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler SetFilePointerEx GetExitCodeProcess CreateProcessW GetWindowsDirectoryW DuplicateHandle IsProcessorFeaturePresent GetSystemDirectoryW CloseHandle GetCurrentThreadId GetEnvironmentStringsW GetFileInformationByHandleEx CancelIo GetSystemTimePreciseAsFileTime RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetProcessHeap HeapFree HeapAlloc FormatMessageW IsDebuggerPresent GetLastError GetSystemTimeAsFileTime CreateProcessA GetModuleHandleA FindFirstFileExW GetConsoleOutputCP DeleteFileW CreateFileW GetFileInformationByHandle GetConsoleScreenBufferInfo SetConsoleTextAttribute GetConsoleMode UnhandledExceptionFilter GetFileAttributesW GetCommandLineW GetStdHandle CompareStringOrdinal FreeEnvironmentStringsW GetOverlappedResult ReadFile WriteFileEx SleepEx SetLastError GetFullPathNameW ReadFileEx GetCurrentProcessId SetFileInformationByHandle SetFileTime HeapReAlloc QueryPerformanceFrequency QueryPerformanceCounter CreateEventW CreateThread SetUnhandledExceptionFilter

shell32

CommandLineToArgvW

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

bcryptprimitives

ProcessPrng

userenv

GetUserProfileDirectoryW

vcruntime140

memmove _CxxThrowException __current_exception_context __current_exception __CxxFrameHandler3 memset memcpy memcmp __C_specific_handler

api-ms-win-crt-convert-l1-1-0

_wtoi64

api-ms-win-crt-math-l1-1-0

floor fmod __setusermatherr

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _initterm terminate _register_onexit_function _c_exit _cexit __p___argv __p___argc _exit exit _initterm_e _register_thread_local_exe_atexit_callback _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _crt_atexit _set_app_type _seh_filter_exe

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

3decbb716be2ce30e1ba94d04ffa513b8b94724e3f111880f0b43ac3eb91ca67

ntdll

kernel32

shell32

api-ms-win-core-synch-l1-2-0

bcryptprimitives

userenv

vcruntime140

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic