a2bdd1bfafa3a08024c49f2e24b17774ea90b1d68bc53308eb09dbac0eb1a6fc

Sharing

Copy URL Twitter E-mail

General

Target
a2bdd1bfafa3a08024c49f2e24b17774ea90b1d68bc53308eb09dbac0eb1a6fc
Size 25KB
Sample260810-gpdpksed72
SHA256 a2bdd1bfafa3a08024c49f2e24b17774ea90b1d68bc53308eb09dbac0eb1a6fc
MD5 c9e8ebdae5af8e2213049969050f6169
SHA1 b9f9c7867e2ec5c2686ecff28f90b97add44f85c
SHA512 d14e1edfdec696bed4324973b90321913ed87662e4eba2be736879ea8fe1a067c2c4d69beb9f3ac3294a24b0e9b361c020aec3f0f384d4e517aa9c36f2c40bff
SSDEEP 384:7Ffy1pnyEkRnykFUgHlNUhlPChtGvInisharx6YrKJpOEGTTDj6Iz05V:4kdykFUgvUPChEAi39gJpOdTTDlzY
TLSH
T1B5B229112A4B8022C3F816709A6B6117813AB8131765D9FFB28CF4E56BB41D1CCF7A3E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a2bdd1bfafa3a08024c49f2e24b17774ea90b1d68bc53308eb09dbac0eb1a6fc

File Explorer

a2bdd1bfafa3a08024c49f2e24b17774ea90b1d68bc53308eb09dbac0eb1a6fc

.exe 25KB

a2bdd1bfafa3a08024c49f2e24b17774ea90b1d68bc53308eb09dbac0eb1a6fc

IMPHASH 0edf44962340a3894d710ab099b5586c
SHA256 a2bdd1bfafa3a08024c49f2e24b17774ea90b1d68bc53308eb09dbac0eb1a6fc
MD5 c9e8ebdae5af8e2213049969050f6169
SHA1 b9f9c7867e2ec5c2686ecff28f90b97add44f85c
SHA512 d14e1edfdec696bed4324973b90321913ed87662e4eba2be736879ea8fe1a067c2c4d69beb9f3ac3294a24b0e9b361c020aec3f0f384d4e517aa9c36f2c40bff
SSDEEP 384:7Ffy1pnyEkRnykFUgHlNUhlPChtGvInisharx6YrKJpOEGTTDj6Iz05V:4kdykFUgvUPChEAi39gJpOdTTDlzY
TLSH
T1B5B229112A4B8022C3F816709A6B6117813AB8131765D9FFB28CF4E56BB41D1CCF7A3E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9518

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

c:\Users\Administrator\Desktop\RAT(自适应屏幕)\Bin\调用文件\156.247.40.242.pdb

kernel32

FindClose FindFirstFileW GetCurrentProcess WaitForSingleObject GetModuleFileNameW FindNextFileW ExitProcess SetThreadPriority GetCurrentThread SetFileAttributesA Sleep SetFileAttributesW CreateDirectoryW RemoveDirectoryW GetLocalTime GetProcessHeap GetLastError CloseHandle SetPriorityClass GetSystemInfo HeapFree GetSystemTimeAsFileTime GetCurrentProcessId GetCurrentThreadId GetTickCount QueryPerformanceCounter IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter TerminateProcess InterlockedCompareExchange InterlockedExchange

user32

MessageBoxA

advapi32

RegOpenKeyExW RegQueryValueExW RegCloseKey OpenProcessToken GetTokenInformation

shell32

ShellExecuteExW ShellExecuteA ShellExecuteW SHChangeNotify

msvcr90

__setusermatherr _adjust_fdiv __p__commode __p__fmode __set_app_type ?terminate@@YAXXZ ?_type_info_dtor_internal_method@type_info@@QAEXXZ _crt_debugger_hook _except_handler4_common _invoke_watson _controlfp_s _configthreadlocale _initterm_e _initterm __initenv exit _XcptFilter _exit _cexit __getmainargs _amsg_exit _decode_pointer _onexit _lock _encode_pointer __dllonexit _unlock vsprintf_s wcscmp wcscpy _vswprintf _pgmptr sprintf wprintf isalnum memset _CxxThrowException __CxxFrameHandler3 ??3@YAXPAX@Z wcscat

msvcp90

??$?MDU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z ??$?ODU?$char_traits@D@std@@V?$allocator@D@1@@std@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@0@0@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@PBD@Z ?c_str@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEPBDXZ ?size@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIXZ ?find@?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEIDI@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ ??A?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QBEABDI@Z ??Y?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAEAAV01@D@Z ??0?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@ABV01@@Z ??1?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@QAE@XZ

urlmon

URLDownloadToFileA

Sharing

General

Malware Config

Signatures

File Explorer

a2bdd1bfafa3a08024c49f2e24b17774ea90b1d68bc53308eb09dbac0eb1a6fc

kernel32

user32

advapi32

shell32

msvcr90

msvcp90

urlmon

generic