2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290

Sharing

Copy URL Twitter E-mail

General

Target
2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290
Size 2.2MB
Sample260810-req72awsav
SHA256 2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290
MD5 12bc60e6d5110c7cece3ef2ee3caf475
SHA1 bfd109af9266ea76b7385ab6bdba75bb96573c15
SHA512 58bd0316a168dfc727f3bf4a20b32d13571e1f862e46e0634c3d5b70b64c5e022755177bc5b4acfd2ac432bf32e1b9064626a7a2952a30381b60155e63135456
SSDEEP 49152:eXekTDkl5sY22/5j2ysPEG0LWC8cpUcqv7RGyRM/ERZiJ:kLsl5B8CGUz9pUTRTR66i
TLSH
T148B59E11AAC297B2E2B717B045B9FF30937DFF1157B25B9B2390C64D1CA16D04A2B362
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290

File Explorer

2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290

.exe 2.2MB

2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290

IMPHASH 939b6d0e52c0b57732f26c704bd21905
SHA256 2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290
MD5 12bc60e6d5110c7cece3ef2ee3caf475
SHA1 bfd109af9266ea76b7385ab6bdba75bb96573c15
SHA512 58bd0316a168dfc727f3bf4a20b32d13571e1f862e46e0634c3d5b70b64c5e022755177bc5b4acfd2ac432bf32e1b9064626a7a2952a30381b60155e63135456
SSDEEP 49152:eXekTDkl5sY22/5j2ysPEG0LWC8cpUcqv7RGyRM/ERZiJ:kLsl5B8CGUz9pUTRTR66i
TLSH
T148B59E11AAC297B2E2B717B045B9FF30937DFF1157B25B9B2390C64D1CA16D04A2B362
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1219488

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\yypig\source\repos\ConsoleApp1\bin\Release\net10.0\win-x86\native\ConsoleApp1.pdb

advapi32

AdjustTokenPrivileges DeregisterEventSource LookupPrivilegeValueW OpenProcessToken RegCloseKey RegEnumKeyExW RegOpenKeyExW RegQueryInfoKeyW RegQueryValueExW RegSetValueExW RegisterEventSourceW ReportEventW

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDestroyHash BCryptFinishHash BCryptGenRandom BCryptGetProperty BCryptHashData BCryptOpenAlgorithmProvider

crypt32

CryptProtectMemory CryptUnprotectMemory

kernel32

FlsFree SetUnhandledExceptionFilter InitializeSListHead EncodePointer RtlUnwind InitializeCriticalSectionEx CancelThreadpoolIo CloseHandle CloseThreadpoolIo CloseThreadpoolWait CloseThreadpoolWork CreateDirectoryW CreateEventExW CreateFileW CreatePipe CreateProcessW CreateThread CreateThreadpoolIo CreateThreadpoolTimer CreateThreadpoolWait CreateThreadpoolWork DeleteCriticalSection DeleteFileW DeviceIoControl DuplicateHandle EnterCriticalSection ExpandEnvironmentStringsW FileTimeToSystemTime FindClose FindFirstFileExW FlushFileBuffers FormatMessageW FreeLibrary GetCPInfo GetCPInfoExW GetConsoleCP GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentProcessorNumberEx GetCurrentThread GetDynamicTimeZoneInformation GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesExW GetFileInformationByHandleEx GetFileType GetFullPathNameW GetLastError GetLongPathNameW GetModuleFileNameW GetOverlappedResult GetProcAddress GetProcessId GetStdHandle GetSystemDirectoryW GetSystemTime GetThreadPriority GetTickCount64 GetTimeZoneInformation InitializeConditionVariable InitializeCriticalSection IsWow64Process K32EnumProcessModulesEx K32EnumProcesses K32GetModuleBaseNameW K32GetModuleFileNameExW K32GetModuleInformation LeaveCriticalSection LoadLibraryExW LoadLibraryW LocalAlloc LocalFree MultiByteToWideChar OpenProcess QueryFullProcessImageNameW QueryPerformanceCounter QueryPerformanceFrequency QueryUnbiasedInterruptTime RaiseFailFastException ResumeThread SetEvent SetFileInformationByHandle SetFilePointerEx SetLastError SetThreadErrorMode SetThreadPriority SetThreadpoolTimer SetThreadpoolWait Sleep SleepConditionVariableCS StartThreadpoolIo SubmitThreadpoolWork SystemTimeToFileTime TzSpecificLocalTimeToSystemTime VirtualAlloc VirtualFree WaitForMultipleObjectsEx WaitForSingleObject WaitForThreadpoolWaitCallbacks WakeConditionVariable WideCharToMultiByte WriteFile AddVectoredExceptionHandler GetModuleHandleW RtlCaptureContext RaiseException FlsAlloc FlsGetValue FlsSetValue ResetEvent WaitForSingleObjectEx CreateEventW SwitchToThread GetCurrentThreadId SuspendThread FlushProcessWriteBuffers GetThreadContext SetThreadContext GetSystemTimeAsFileTime CreateMemoryResourceNotification QueryInformationJobObject GetModuleHandleExW GetProcessAffinityMask CopyContext InitializeContext GetEnabledXStateFeatures SetXStateFeaturesMask VirtualQuery DebugBreak SleepEx GlobalMemoryStatusEx GetSystemInfo GetLogicalProcessorInformation GetLargePageMinimum VirtualUnlock GetWriteWatch ResetWriteWatch VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber K32GetProcessMemoryInfo IsDebuggerPresent IsProcessorFeaturePresent

ole32

CoGetApartmentType CoWaitForMultipleHandles PropVariantClear CoUninitialize CoTaskMemFree CoTaskMemAlloc CoInitializeEx CoGetObjectContext

oleaut32

SysFreeString SysAllocStringLen

api-ms-win-crt-heap-l1-1-0

_callnewh _set_new_mode malloc free calloc

api-ms-win-crt-math-l1-1-0

modf ceil _libm_sse2_log_precise __setusermatherr

api-ms-win-crt-string-l1-1-0

strcpy_s _stricmp

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode __stdio_common_vsnprintf_s

api-ms-win-crt-runtime-l1-1-0

_configure_wide_argv _register_thread_local_exe_atexit_callback _c_exit _cexit abort __p___wargv terminate _controlfp_s _crt_atexit _register_onexit_function _initialize_onexit_table _seh_filter_exe _set_app_type __p___argc _initialize_wide_environment _get_initial_wide_environment _initterm _initterm_e exit _exit

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2b2fcbcae38f3e4f81fb854045c0b9e319d698f55c1e97b3f205b14d30e12290

advapi32

bcrypt

crypt32

kernel32

ole32

oleaut32

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic