5b863a1d444669c01cbdc7830813bcbbda38917683a10243d8ae72d0afc3262d

Sharing

Copy URL Twitter E-mail

General

Target
5b863a1d444669c01cbdc7830813bcbbda38917683a10243d8ae72d0afc3262d
Size 255KB
Sample260808-vdc6kaal8v
SHA256 5b863a1d444669c01cbdc7830813bcbbda38917683a10243d8ae72d0afc3262d
MD5 8198d39d919d8df645a3ed15586050db
SHA1 aceba08df4f5fc4a1bc7f7491bb68eca3e10434e
SHA512 c0f6fb6b8f66f3fb125e2d1b67fbe8d8cf04261cd9d24127d4fcdacf400e0c990c148f263e117237bc602ac635c6ca2485dc9b480256419b9d64ac53ec676451
SSDEEP 6144:6DmUoPnph7pKrSfgIymzMoxSYMqDQTDsqoazCy:6Dm1pvfWmzFxDQXsqoa
TLSH
T18344C02BB6519DF9DC06C0BD865196B2B93278C50B32D9FF03E545381E2BAE61F3CA50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5b863a1d444669c01cbdc7830813bcbbda38917683a10243d8ae72d0afc3262d

File Explorer

5b863a1d444669c01cbdc7830813bcbbda38917683a10243d8ae72d0afc3262d

.exe 255KB

5b863a1d444669c01cbdc7830813bcbbda38917683a10243d8ae72d0afc3262d

IMPHASH eec05d9f9e83a26b32e55f263b6a12e3
SHA256 5b863a1d444669c01cbdc7830813bcbbda38917683a10243d8ae72d0afc3262d
MD5 8198d39d919d8df645a3ed15586050db
SHA1 aceba08df4f5fc4a1bc7f7491bb68eca3e10434e
SHA512 c0f6fb6b8f66f3fb125e2d1b67fbe8d8cf04261cd9d24127d4fcdacf400e0c990c148f263e117237bc602ac635c6ca2485dc9b480256419b9d64ac53ec676451
SSDEEP 6144:6DmUoPnph7pKrSfgIymzMoxSYMqDQTDsqoazCy:6Dm1pvfWmzFxDQXsqoa
TLSH
T18344C02BB6519DF9DC06C0BD865196B2B93278C50B32D9FF03E545381E2BAE61F3CA50
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

81056

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

kernel32

SetEvent SetThreadpoolWait CreateThreadpoolWait CreateEventW HeapFree UnhandledExceptionFilter GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler WaitForThreadpoolWaitCallbacks SetUnhandledExceptionFilter GetEnvironmentVariableW RtlVirtualUnwind WideCharToMultiByte ReleaseMutex CreateMutexA GetCurrentProcessId GetCurrentProcess LoadLibraryA WaitForSingleObjectEx RtlLookupFunctionEntry RtlCaptureContext GetCurrentDirectoryW GetProcessHeap HeapAlloc lstrlenW SetLastError CloseHandle GetProcAddress GetModuleHandleA WriteConsoleW MultiByteToWideChar WaitForSingleObject IsProcessorFeaturePresent GetConsoleMode CloseThreadpoolWait GetLastError GetStdHandle VirtualAlloc HeapReAlloc VirtualProtect QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetModuleHandleW

ntdll

NtWriteFile RtlNtStatusToDosError

vcruntime140

memcmp memset memcpy memmove __current_exception_context __current_exception __C_specific_handler __CxxFrameHandler3

api-ms-win-crt-runtime-l1-1-0

_crt_atexit terminate _register_onexit_function _initialize_onexit_table _set_app_type _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv __p___argc _configure_narrow_argv _exit exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _seh_filter_exe

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

5b863a1d444669c01cbdc7830813bcbbda38917683a10243d8ae72d0afc3262d

api-ms-win-core-synch-l1-2-0

kernel32

ntdll

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic