a1952ee4d84f7e76edd219c57932c870ca943ba6b78134d794b1c8f00da3cfec

Sharing

Copy URL Twitter E-mail

General

Target
a1952ee4d84f7e76edd219c57932c870ca943ba6b78134d794b1c8f00da3cfec
Size 855KB
Sample260810-sbdcfagh74
SHA256 a1952ee4d84f7e76edd219c57932c870ca943ba6b78134d794b1c8f00da3cfec
MD5 0a7e14427316ad98a01766118364ae2d
SHA1 16151184f8c6103609c0d8cd3b4cca9f9f54aeb2
SHA512 3415e3d04803f094244d13c7b910af56d3417d47c782f69650a00b186cb000260d981532a6de1504a7c8a9ea1c44cfc1176ff75c4e7f5914cb06fd8fcb60da73
SSDEEP 12288:ZhzftoNu6iS/Uc/E1NNFV5AnA3eI5JQcCuLBR7M/yOhL/WeDeSspi:lo2S/UcAFV5AA3esQBuLBRw/7hL/xQ
TLSH
T1A2154F2672B0064DE023F17A4729EFA3C7FBF55C2330B661D590F5A6EE4AC2075E6924
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a1952ee4d84f7e76edd219c57932c870ca943ba6b78134d794b1c8f00da3cfec

File Explorer

a1952ee4d84f7e76edd219c57932c870ca943ba6b78134d794b1c8f00da3cfec

.exe 855KB

a1952ee4d84f7e76edd219c57932c870ca943ba6b78134d794b1c8f00da3cfec

IMPHASH 14aac72a7b3940978bccfc605ff411b6
SHA256 a1952ee4d84f7e76edd219c57932c870ca943ba6b78134d794b1c8f00da3cfec
MD5 0a7e14427316ad98a01766118364ae2d
SHA1 16151184f8c6103609c0d8cd3b4cca9f9f54aeb2
SHA512 3415e3d04803f094244d13c7b910af56d3417d47c782f69650a00b186cb000260d981532a6de1504a7c8a9ea1c44cfc1176ff75c4e7f5914cb06fd8fcb60da73
SSDEEP 12288:ZhzftoNu6iS/Uc/E1NNFV5AnA3eI5JQcCuLBR7M/yOhL/WeDeSspi:lo2S/UcAFV5AA3esQBuLBRw/7hL/xQ
TLSH
T1A2154F2672B0064DE023F17A4729EFA3C7FBF55C2330B661D590F5A6EE4AC2075E6924
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

803312

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

草稿2.pdb

kernel32

GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetEnvironmentVariableW GetStdHandle GetCurrentProcessId GetCurrentDirectoryW SetLastError GetProcessHeap RtlVirtualUnwind HeapReAlloc lstrlenW ReleaseMutex RtlLookupFunctionEntry GetModuleHandleW RtlCaptureContext GetModuleHandleA HeapAlloc GetConsoleMode QueryPerformanceCounter WaitForSingleObject GetConsoleOutputCP MultiByteToWideChar WriteConsoleW WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA CreateMutexA GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler CloseHandle UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess SetThreadErrorMode FreeLibrary GetProcAddress LoadLibraryExW HeapFree GetLastError IsProcessorFeaturePresent

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

ntdll

RtlNtStatusToDosError NtWriteFile

vcruntime140

__CxxFrameHandler3 memcpy memset memmove memcmp __current_exception_context __current_exception __C_specific_handler _CxxThrowException

api-ms-win-crt-runtime-l1-1-0

exit _exit __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _seh_filter_exe _get_initial_narrow_environment _configure_narrow_argv _initialize_onexit_table _register_onexit_function _crt_atexit terminate _set_app_type _initterm _initterm_e _initialize_narrow_environment

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

a1952ee4d84f7e76edd219c57932c870ca943ba6b78134d794b1c8f00da3cfec

kernel32

api-ms-win-core-synch-l1-2-0

ntdll

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic