da20d51b796c769809b57b535692d37eb1c8b09bfa169aec78707675c8896664

Sharing

Copy URL Twitter E-mail

General

Target
da20d51b796c769809b57b535692d37eb1c8b09bfa169aec78707675c8896664
Size 266KB
Sample260810-l875rawfkc
SHA256 da20d51b796c769809b57b535692d37eb1c8b09bfa169aec78707675c8896664
MD5 981ba0f29bc0633b349f91f5d5effa1a
SHA1 3f5474dc32035937887e9847e921ea90d0600c87
SHA512 140ea180b8a484dd32cbf89aacf6a4db489e0a6150156d0fbd32894b813f774f470bb33b7be4923b1d247d75ec422d6c7ad8d89252962a32f8deeee69daed076
SSDEEP 3072:PGj3kDLwsDqUjm0QusJutthQXOVg0aMO471MfJkcJhaM1b+PH2y+tSe8PezFSUAf:PGIDVU0xUYhK6CxEaoXDsRguamUNZX
TLSH
T118440A1BB39368F8C667803882F79B72B532B4150334BF6F4794E7312E61D654E2DAA4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
da20d51b796c769809b57b535692d37eb1c8b09bfa169aec78707675c8896664

File Explorer

da20d51b796c769809b57b535692d37eb1c8b09bfa169aec78707675c8896664

.exe 266KB

da20d51b796c769809b57b535692d37eb1c8b09bfa169aec78707675c8896664

IMPHASH a4ab66bc51e5eca0bafab0caebcff89f
SHA256 da20d51b796c769809b57b535692d37eb1c8b09bfa169aec78707675c8896664
MD5 981ba0f29bc0633b349f91f5d5effa1a
SHA1 3f5474dc32035937887e9847e921ea90d0600c87
SHA512 140ea180b8a484dd32cbf89aacf6a4db489e0a6150156d0fbd32894b813f774f470bb33b7be4923b1d247d75ec422d6c7ad8d89252962a32f8deeee69daed076
SSDEEP 3072:PGj3kDLwsDqUjm0QusJutthQXOVg0aMO471MfJkcJhaM1b+PH2y+tSe8PezFSUAf:PGIDVU0xUYhK6CxEaoXDsRguamUNZX
TLSH
T118440A1BB39368F8C667803882F79B72B532B4150334BF6F4794E7312E61D654E2DAA4
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5120

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

CloseServiceHandle EnumServicesStatusA GetTokenInformation GetUserNameA OpenProcessToken OpenSCManagerA RegCloseKey RegDeleteValueA RegOpenKeyExA RegQueryValueExA RegSetValueExA

kernel32

CheckRemoteDebuggerPresent CloseHandle CreateEventA CreateFileA CreateMutexA CreateRemoteThread CreateSemaphoreA CreateToolhelp32Snapshot DeleteCriticalSection DeleteFileA DuplicateHandle EnterCriticalSection FormatMessageA FreeLibrary GetConsoleWindow GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDiskFreeSpaceExA GetHandleInformation GetLastError GetModuleFileNameA GetModuleHandleA GetProcAddress GetProcessAffinityMask GetSystemDirectoryA GetSystemInfo GetSystemTimeAsFileTime GetTempPathA GetThreadContext GetThreadPriority GetTickCount GetWindowsDirectoryA GlobalMemoryStatusEx InitializeCriticalSection IsDebuggerPresent IsProcessorFeaturePresent LeaveCriticalSection LoadLibraryA LocalFree OpenProcess OutputDebugStringA Process32FirstW Process32NextW QueryFullProcessImageNameA QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadFile ReleaseSemaphore ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetConsoleTitleA SetEvent SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection VirtualAllocEx VirtualFreeEx VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WriteFile WriteProcessMemory

api-ms-win-crt-convert-l1-1-0

mbrtowc mbsrtowcs strtoul wcrtomb

api-ms-win-crt-environment-l1-1-0

__p__environ getenv

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-private-l1-1-0

__C_specific_handler __intrinsic_setjmpex longjmp memchr memcmp memcpy memmove strchr strrchr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _assert _beginthreadex _cexit _configure_narrow_argv _crt_atexit _endthreadex _errno _exit _initialize_narrow_environment _set_app_type _initterm _initterm_e _set_invalid_parameter_handler abort exit signal strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf _read _write fputc fputs fwrite

api-ms-win-crt-string-l1-1-0

_strdup _stricmp _strlwr _wcsicmp memset strcmp strlen strncmp strnlen wcslen wcsnlen

api-ms-win-crt-utility-l1-1-0

rand rand_s srand

user32

GetCursorPos ShowWindow

ws2_32

WSACleanup WSAStartup closesocket connect gethostbyname htons inet_addr send socket

Name

.text

Size

203KB

Virtual Size

203KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

544B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.crypt

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

14KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

da20d51b796c769809b57b535692d37eb1c8b09bfa169aec78707675c8896664

advapi32

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

user32

ws2_32

generic