70ebd9ea9645197a2be6476c8aaf34c36ae672f61374dd25560691a50c005018

Sharing

Copy URL Twitter E-mail

General

Target
70ebd9ea9645197a2be6476c8aaf34c36ae672f61374dd25560691a50c005018
Size 22KB
Sample260808-p3112axcnc
SHA256 70ebd9ea9645197a2be6476c8aaf34c36ae672f61374dd25560691a50c005018
MD5 798b13a5be9b30a3502580c1f49501a1
SHA1 d1f20de0851ed3569e53f072802154650063fecf
SHA512 63f84148f00cdece6f2f1112c94503a0a4711b69439b7cf05be27db0d85d5bf90cdd1124b341936d93ad3580d20c3c07b17667bdcfcd238507aeb463f05db605
SSDEEP 384:85o2Qbtj/kfngq+HKhQ01Q04wlLJ4jz7:o+tjsLzhQaQ046sz
TLSH
T174A229561E9505EEF807C57EC2218E2A9831FA30A761A0FF4693933B9C52FD4CA3C2D4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
70ebd9ea9645197a2be6476c8aaf34c36ae672f61374dd25560691a50c005018

File Explorer

70ebd9ea9645197a2be6476c8aaf34c36ae672f61374dd25560691a50c005018

.exe 22KB

70ebd9ea9645197a2be6476c8aaf34c36ae672f61374dd25560691a50c005018

IMPHASH 03df034912a8ee4653f9ac3406121d9d
SHA256 70ebd9ea9645197a2be6476c8aaf34c36ae672f61374dd25560691a50c005018
MD5 798b13a5be9b30a3502580c1f49501a1
SHA1 d1f20de0851ed3569e53f072802154650063fecf
SHA512 63f84148f00cdece6f2f1112c94503a0a4711b69439b7cf05be27db0d85d5bf90cdd1124b341936d93ad3580d20c3c07b17667bdcfcd238507aeb463f05db605
SSDEEP 384:85o2Qbtj/kfngq+HKhQ01Q04wlLJ4jz7:o+tjsLzhQaQ046sz
TLSH
T174A229561E9505EEF807C57EC2218E2A9831FA30A761A0FF4693933B9C52FD4CA3C2D4
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

WSACleanup WSAStartup closesocket connect gethostbyname htons inet_addr recv send socket

kernel32

CloseHandle CopyFileW CreateDirectoryW CreateFileW CreateMutexW DeleteCriticalSection EnterCriticalSection FreeConsole GetConsoleWindow GetCurrentProcess GetCurrentProcessorNumber GetEnvironmentVariableW GetFileAttributesW GetLastError GetLogicalProcessorInformation GetModuleFileNameW GetProcAddress GetProcessWorkingSetSize GetStartupInfoA GetSystemDefaultLangID GetSystemFileCacheSize GetSystemRegistryQuota GetTempPathW GetTickCount GetTickCount64 GetUserDefaultLCID GetVersionExA InitializeCriticalSection IsDBCSLeadByte K32GetPerformanceInfo LeaveCriticalSection LoadLibraryA SetUnhandledExceptionFilter Sleep TlsGetValue VirtualAlloc VirtualFree VirtualProtect VirtualQuery WriteFile __C_specific_handler lstrcatW lstrlenW

user32

GetKeyboardLayout ShowWindow wsprintfA wsprintfW

shell32

ShellExecuteExW

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf fflush setvbuf

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv __p__acmdln _cexit _configure_narrow_argv _crt_atexit _exit _initialize_narrow_environment _initterm _initterm_e _set_app_type _set_invalid_parameter_handler abort exit signal

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc

api-ms-win-crt-private-l1-1-0

memcpy

api-ms-win-crt-string-l1-1-0

memset strlen strncmp

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-environment-l1-1-0

__p__environ

Name

.text

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

344B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

512B

Virtual Size

288B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

100B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

70ebd9ea9645197a2be6476c8aaf34c36ae672f61374dd25560691a50c005018

ws2_32

kernel32

user32

shell32

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

generic