09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d

Sharing

Copy URL Twitter E-mail

General

Target
09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d
Size 976KB
Sample260808-p17e2a1wct
SHA256 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d
MD5 2a4379dcd55579aedde17b71f701d5b1
SHA1 8ec6c30593aa051aca2a665b03e0b2a3669592c7
SHA512 ec27c7e206f8490fb6a232216555e29c8d3e2ee1ce900483001701f73c9fec8ff15a6a399aedcaaac41d006de34a38f2ac693455537a61048e81dd5be590c6eb
SSDEEP 24576:7SmffR+8cR+MRocXnjpRdKxGGaWZpaPFjj:lffR+5ZRdK1ZpaN
TLSH
T1C0257C5AA7E001EAC567C179CD665603EB76B4191330BBDB0BE286561F23BE09F3E311
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d

File Explorer

09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d

.exe 976KB

09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d

IMPHASH 0bc57e303a29f84ef05515222c45a3f2
SHA256 09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d
MD5 2a4379dcd55579aedde17b71f701d5b1
SHA1 8ec6c30593aa051aca2a665b03e0b2a3669592c7
SHA512 ec27c7e206f8490fb6a232216555e29c8d3e2ee1ce900483001701f73c9fec8ff15a6a399aedcaaac41d006de34a38f2ac693455537a61048e81dd5be590c6eb
SSDEEP 24576:7SmffR+8cR+MRocXnjpRdKxGGaWZpaPFjj:lffR+5ZRdK1ZpaN
TLSH
T1C0257C5AA7E001EAC567C179CD665603EB76B4191330BBDB0BE286561F23BE09F3E311
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

525292

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

getsockopt ioctlsocket connect htons select socket shutdown send recv freeaddrinfo getaddrinfo __WSAFDIsSet inet_pton WSAGetLastError WSAStartup closesocket

bcrypt

BCryptGenRandom

advapi32

StartServiceCtrlDispatcherW RegOpenKeyExW RegDeleteValueW RegCloseKey RegCreateKeyExW RegEnumKeyExW RegQueryValueExW StartServiceW SetServiceStatus RegisterServiceCtrlHandlerW QueryServiceStatus OpenServiceW OpenSCManagerW CreateServiceW CloseServiceHandle ChangeServiceConfig2W RegSetValueExW

wininet

InternetSetOptionW

ole32

CoCreateGuid CoInitializeEx

crypt32

CertFindCertificateInStore CertOpenStore CertAddEncodedCertificateToStore CryptHashCertificate CryptStringToBinaryA CertFreeCertificateContext CertCloseStore

kernel32

GetUserDefaultLCID EnumSystemLocalesW GetConsoleMode ReadConsoleW SetFilePointerEx GetConsoleOutputCP GetFileSizeEx HeapReAlloc FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW SetEnvironmentVariableW SetStdHandle GetProcessHeap FlushFileBuffers HeapSize SetEndOfFile WriteConsoleW GetLastError GetCurrentProcessId FreeConsole CompareFileTime CreateDirectoryW CreateFileW DeleteFileW GetFileAttributesW GetFileAttributesExW GetFileSize ReadFile WriteFile CloseHandle DeviceIoControl SetEvent ReleaseMutex WaitForSingleObject CreateMutexW CreateEventW Sleep GetCurrentProcess TerminateProcess GetExitCodeProcess CreateProcessW OpenProcess GetSystemTimeAsFileTime GetLocalTime GetTickCount GetSystemDirectoryW CopyFileW GetComputerNameW SystemTimeToFileTime MultiByteToWideChar WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW FindClose FindNextFileW MoveFileExA WaitForSingleObjectEx GetCurrentThreadId GetExitCodeThread ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection QueryPerformanceCounter WakeAllConditionVariable SleepConditionVariableSRW EncodePointer DecodePointer LCMapStringEx GetModuleHandleW GetProcAddress GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetStdHandle GetModuleFileNameW ExitProcess GetCommandLineA GetCommandLineW HeapFree HeapAlloc GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect

Name

.text

Size

675KB

Virtual Size

674KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

257KB

Virtual Size

257KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

30KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

09cf942139a13cf60fa0cc98ed8ed362724c00a691814910993d67f51659185d

ws2_32

bcrypt

advapi32

wininet

ole32

crypt32

kernel32

generic