9ba30e9d05d2abc5337cdd63aa86d214168aeeeb6c54bbdd0a7413ede672cecc

Sharing

Copy URL Twitter E-mail

General

Target
9ba30e9d05d2abc5337cdd63aa86d214168aeeeb6c54bbdd0a7413ede672cecc
Size 374KB
Sample260809-lknffacp8x
SHA256 9ba30e9d05d2abc5337cdd63aa86d214168aeeeb6c54bbdd0a7413ede672cecc
MD5 332a9545ed01f90030b4b51f51d389aa
SHA1 e374f28c49cfd8ff4eb3da080f87e379b364ec9e
SHA512 930342a7483dfd5c220f4c8b7210c7ef792a87057c272117232a3856f604226533487196b63010478c7f1468a72e7c032f437e8d81430cc42cf69e9582f26e6a
SSDEEP 6144:0GmmYyTquDSGzwNeBUCR3yoxtsAknTWQeY+mh3X4z+4zF4z:7xfwNeJymirTWQeA3ozJz+z
TLSH
T187849D55F6A410F9E1778538CD634906DB727C9A4760ABCB23A07E962F336E04E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9ba30e9d05d2abc5337cdd63aa86d214168aeeeb6c54bbdd0a7413ede672cecc

File Explorer

9ba30e9d05d2abc5337cdd63aa86d214168aeeeb6c54bbdd0a7413ede672cecc

.exe 374KB

9ba30e9d05d2abc5337cdd63aa86d214168aeeeb6c54bbdd0a7413ede672cecc

IMPHASH cd5bc2ef1c7e076b4460e33047e3c1ad
SHA256 9ba30e9d05d2abc5337cdd63aa86d214168aeeeb6c54bbdd0a7413ede672cecc
MD5 332a9545ed01f90030b4b51f51d389aa
SHA1 e374f28c49cfd8ff4eb3da080f87e379b364ec9e
SHA512 930342a7483dfd5c220f4c8b7210c7ef792a87057c272117232a3856f604226533487196b63010478c7f1468a72e7c032f437e8d81430cc42cf69e9582f26e6a
SSDEEP 6144:0GmmYyTquDSGzwNeBUCR3yoxtsAknTWQeY+mh3X4z+4zF4z:7xfwNeJymirTWQeA3ozJz+z
TLSH
T187849D55F6A410F9E1778538CD634906DB727C9A4760ABCB23A07E962F336E04E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

72384

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

VirtualAlloc Sleep GetTickCount64 LoadLibraryA SetEndOfFile WriteConsoleW HeapSize CreateFileW GetComputerNameA IsDebuggerPresent GetDiskFreeSpaceExA CreateProcessA GetModuleHandleW GlobalMemoryStatusEx GetProcAddress GetThreadContext GetSystemInfo CloseHandle GetSystemDirectoryA GetCurrentThread GetLogicalProcessorInformation CreateFileA DuplicateHandle GetSystemDirectoryW GetFileAttributesW GetVolumeInformationA GetEnvironmentVariableA GetDriveTypeA DeviceIoControl GetProcessHeap SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA FindNextFileW FindFirstFileExW FindClose GetOEMCP GetCurrentProcess GetLogicalDrives GetModuleFileNameA GetSystemFirmwareTable GetACP IsValidCodePage ReadConsoleW ReadFile EnumSystemLocalesW GetUserDefaultLCID GetLastError MultiByteToWideChar IsValidLocale GetLocaleInfoW LCMapStringW GetCurrentThreadId GetLogicalProcessorInformationEx QueryPerformanceCounter EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree FreeLibrary GetModuleHandleExW IsProcessorFeaturePresent GetStdHandle WriteFile GetModuleFileNameW ExitProcess TerminateProcess RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter HeapFree HeapAlloc HeapReAlloc GetFileType GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode VirtualProtect LoadLibraryExW RtlUnwind

user32

wsprintfA wsprintfW

advapi32

CryptCreateHash CryptGetHashParam CryptImportKey CryptSetKeyParam CryptDestroyHash CryptHashData CryptDecrypt RegCloseKey RegQueryValueExA GetUserNameA RegEnumKeyExW RegOpenKeyExA RegOpenKeyExW RegQueryValueExW RegEnumKeyExA CryptDestroyKey CryptAcquireContextW CryptGenRandom CryptReleaseContext

ole32

CoCreateGuid

winhttp

WinHttpConnect WinHttpSetTimeouts WinHttpSendRequest WinHttpCloseHandle WinHttpSetOption WinHttpOpenRequest WinHttpReadData WinHttpWriteData WinHttpReceiveResponse WinHttpOpen WinHttpQueryHeaders

crypt32

CryptStringToBinaryA CryptBinaryToStringA

iphlpapi

GetAdaptersInfo

ws2_32

WSAStartup gethostname WSACleanup

cJSON_AddArrayToObject cJSON_AddBoolToObject cJSON_AddFalseToObject cJSON_AddItemReferenceToArray cJSON_AddItemReferenceToObject cJSON_AddItemToArray cJSON_AddItemToObject cJSON_AddItemToObjectCS cJSON_AddNullToObject cJSON_AddNumberToObject cJSON_AddObjectToObject cJSON_AddRawToObject cJSON_AddStringToObject cJSON_AddTrueToObject cJSON_Compare cJSON_CreateArray cJSON_CreateArrayReference cJSON_CreateBool cJSON_CreateDoubleArray cJSON_CreateFalse cJSON_CreateFloatArray cJSON_CreateIntArray cJSON_CreateNull cJSON_CreateNumber cJSON_CreateObject cJSON_CreateObjectReference cJSON_CreateRaw cJSON_CreateString cJSON_CreateStringArray cJSON_CreateStringReference cJSON_CreateTrue cJSON_Delete cJSON_DeleteItemFromArray cJSON_DeleteItemFromObject cJSON_DeleteItemFromObjectCaseSensitive cJSON_DetachItemFromArray cJSON_DetachItemFromObject cJSON_DetachItemFromObjectCaseSensitive cJSON_DetachItemViaPointer cJSON_Duplicate cJSON_GetArrayItem cJSON_GetArraySize cJSON_GetErrorPtr cJSON_GetNumberValue cJSON_GetObjectItem cJSON_GetObjectItemCaseSensitive cJSON_GetStringValue cJSON_HasObjectItem cJSON_InitHooks cJSON_InsertItemInArray cJSON_IsArray cJSON_IsBool cJSON_IsFalse cJSON_IsInvalid cJSON_IsNull cJSON_IsNumber cJSON_IsObject cJSON_IsRaw cJSON_IsString cJSON_IsTrue cJSON_Minify cJSON_Parse cJSON_ParseWithLength cJSON_ParseWithLengthOpts cJSON_ParseWithOpts cJSON_Print cJSON_PrintBuffered cJSON_PrintPreallocated cJSON_PrintUnformatted cJSON_ReplaceItemInArray cJSON_ReplaceItemInObject cJSON_ReplaceItemInObjectCaseSensitive cJSON_ReplaceItemViaPointer cJSON_SetNumberHelper cJSON_SetValuestring cJSON_Version cJSON_free cJSON_malloc

Name

.text

Size

235KB

Virtual Size

234KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

86KB

Virtual Size

86KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

30KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

9ba30e9d05d2abc5337cdd63aa86d214168aeeeb6c54bbdd0a7413ede672cecc

kernel32

user32

advapi32

ole32

winhttp

crypt32

iphlpapi

ws2_32

generic