b3b1134d66e50e977d5627bb605ad7e18e55aa9782db579b84b8021c2266fdb6

Sharing

Copy URL Twitter E-mail

General

Target
b3b1134d66e50e977d5627bb605ad7e18e55aa9782db579b84b8021c2266fdb6
Size 4.6MB
Sample260813-erkvkazvbx
SHA256 b3b1134d66e50e977d5627bb605ad7e18e55aa9782db579b84b8021c2266fdb6
MD5 5c98cb7c714098d8d6dc31a317a74cf5
SHA1 e1ca159065b549d80ee9a7f77c6bf5e66bd30852
SHA512 dbb6c9725208ecf425074b49fd1d8caba945902d1567c4f7bd8260aff0cdfc8e20ff43014a9acc5293718b309da66e49c93c5b1e13eb8e1ddce5072be7536fd0
SSDEEP 98304:TVIezNN+jQaCCFBDmxnfyzvu+bsoVrdfzPiURmE3Nj1C/52Q+uylIW7+70olfT+U:TVfzN8zDmxnfMWQJzqU1djIouy+j0YJZ
TLSH
T13326C096B3C47AD9C402DD3A5714F232C1B2B9338EB6D0CA5E96C70A4ABAD514F3DB41
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b3b1134d66e50e977d5627bb605ad7e18e55aa9782db579b84b8021c2266fdb6

File Explorer

b3b1134d66e50e977d5627bb605ad7e18e55aa9782db579b84b8021c2266fdb6

.dll 4.6MB

b3b1134d66e50e977d5627bb605ad7e18e55aa9782db579b84b8021c2266fdb6

IMPHASH 8ef3b94ee5a7392100386faabf23e935
SHA256 b3b1134d66e50e977d5627bb605ad7e18e55aa9782db579b84b8021c2266fdb6
MD5 5c98cb7c714098d8d6dc31a317a74cf5
SHA1 e1ca159065b549d80ee9a7f77c6bf5e66bd30852
SHA512 dbb6c9725208ecf425074b49fd1d8caba945902d1567c4f7bd8260aff0cdfc8e20ff43014a9acc5293718b309da66e49c93c5b1e13eb8e1ddce5072be7536fd0
SSDEEP 98304:TVIezNN+jQaCCFBDmxnfyzvu+bsoVrdfzPiURmE3Nj1C/52Q+uylIW7+70olfT+U:TVfzN8zDmxnfMWQJzqU1djIouy+j0YJZ
TLSH
T13326C096B3C47AD9C402DD3A5714F232C1B2B9338EB6D0CA5E96C70A4ABAD514F3DB41
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9916

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

advapi32

RegCreateKeyExW RegOpenKeyExW RegSetValueExW RegCloseKey RegEnumKeyExW RegQueryValueExW OpenProcessToken GetTokenInformation ImpersonateLoggedOnUser RevertToSelf ConvertSidToStringSidW AdjustTokenPrivileges LookupPrivilegeValueW

bcrypt

BCryptCreateHash BCryptDestroyHash BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptHashData BCryptGetProperty BCryptGenRandom BCryptFinishHash

kernel32

K32GetProcessMemoryInfo GetProcessGroupAffinity GetNumaHighestNodeNumber IsProcessInJob VirtualAllocExNuma SetLastError FormatMessageW GetLastError CloseThreadpoolIo GetStdHandle RaiseFailFastException TzSpecificLocalTimeToSystemTime SystemTimeToFileTime FileTimeToSystemTime GetSystemTime GetTickCount64 GetCurrentProcess GetCurrentThread Sleep DeleteCriticalSection LocalFree EnterCriticalSection SleepConditionVariableCS LeaveCriticalSection WakeConditionVariable QueryPerformanceCounter InitializeCriticalSection InitializeConditionVariable WaitForMultipleObjectsEx QueryPerformanceFrequency GetFullPathNameW GetLongPathNameW LocalAlloc GetConsoleOutputCP WideCharToMultiByte GetProcAddress CreateDirectoryW CreateFileW CreateThreadpoolIo StartThreadpoolIo CancelThreadpoolIo DeleteFileW DeviceIoControl ExpandEnvironmentStringsW FindClose FindFirstFileExW FlushFileBuffers FreeLibrary GetFileAttributesExW GetFileInformationByHandleEx GetFileType GetModuleFileNameW GetOverlappedResult GetSystemDirectoryW LoadLibraryExW ReadFile SetFileInformationByHandle SetThreadErrorMode DuplicateHandle GetThreadPriority SetThreadPriority GetDynamicTimeZoneInformation GetTimeZoneInformation WriteFile GetCurrentProcessorNumberEx CloseHandle SetEvent CreateEventExW GetEnvironmentVariableW PeekNamedPipe SetNamedPipeHandleState GetModuleHandleW GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW ExitProcess TerminateProcess GetModuleHandleExW HeapAlloc HeapFree RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter IsProcessorFeaturePresent FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar GetEnvironmentStringsW FreeEnvironmentStringsW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect LCMapStringW GetProcessHeap GetStringTypeW HeapSize HeapReAlloc SetStdHandle GetConsoleMode SetFilePointerEx WriteConsoleW FlushProcessWriteBuffers WaitForSingleObjectEx RtlRestoreContext AddVectoredExceptionHandler CreateEventW SwitchToThread CreateThread SuspendThread ResumeThread GetThreadContext SetThreadContext FlushInstructionCache VirtualAlloc VirtualFree QueryInformationJobObject GetProcessAffinityMask InitializeContext GetEnabledXStateFeatures SetXStateFeaturesMask VirtualQuery ResetEvent DebugBreak WaitForSingleObject SleepEx GlobalMemoryStatusEx GetSystemInfo GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock

ole32

CoUninitialize CoGetApartmentType CoTaskMemFree CoWaitForMultipleHandles CoInitializeEx

secur32

DeleteSecurityContext InitializeSecurityContextW AcquireCredentialsHandleW QueryContextAttributesW FreeContextBuffer QuerySecurityContextToken FreeCredentialsHandle GetUserNameExW AcceptSecurityContext

vcruntime140

__C_specific_handler_noexcept __CxxFrameHandler3 __std_terminate _purecall __std_type_info_destroy_list __C_specific_handler __std_exception_copy __std_exception_destroy memcpy _CxxThrowException memmove memset

vcruntime140_1

__CxxFrameHandler4

14SJhZ8IKae6qY3JafSy4bUPn 1Gs7JUDuGr8 2ILrNJRslyVDv78vxw 2bm0J1KKEPNab46WCGeuLJpTKT7J 2x5lI29bwDaR9LnoYMwcprNblmph8k 4WSu3Ba5TVrZ0ZFYf 4aSA1m1HanV4BHRHpcIYh6Dotk 71fdJ4EavXCQ1TpWlJ 8QuqbfBdbJdsfx7e1Cy A69OH5KSkH6mBj8yi AnalyzeSnapshot C3E7A3XNa CEF78tnZl7L CrtnNInehHJ4YLfM2ZBSpD92iyrs DQrIdCzVnvlgkBCnAOD4v DllGetClassObject FY5v8LV62tCAZZeOaWCbNQk GetUnixDomainSocketSizes GetVilValueFieldOffset Gn7CDq45Ke639JqkJcpISDCOUhkK H3WwcMS9Y3ZtBpx1oRcth4Zugqakg IHWj7IbRoBxV4zsljcT9dcfOM IVQvs8QXtJbL5G0aj4y7 Initialize InitializePAL InitializeSession InitializeUnhandledExceptionFilter JEAacayQYkrUqlczhjkitTWmiT628 JKSIuIlYvzYv LFDxEkzYUNp LT96sS8jCR5e2 LuTjssXw8Xgcv2nIAnn ODbIsLm6MzHqQhTbKYM3 Ow7zLePmE2vljM0jhE6ehoLe3cmwZV PRbs7PjcNYN Pu0q96zSieQCkuhv1QpcBjnigU Q4S8Ov0etFHHvXC7LkeyxAL0Ffk7LB QJjPxjuqy4jrRKPus QuDuAXOajqvOB R1oMIz1NuXMHoWY3s3Y71PoM0 RunDiagnosticAnalysis RunMainLoop SMMf1iX9JXHobMDiyQ Shutdown ShutdownSession Ugi0CqdleKIIV UzQSKO1SqJc3NyeR5Qn1CckpHz87 V2IgFlE1OJew28TuzD1twW5jj5EXf9 VdY1xZvDjWLU8gazlqKw0JSlCylv5O WrapICorDebugHandleValue XrvhZoQ6oV9tMPXIWeWK3Q458N98DV ZLJKF0LfbQrYv84M6XSDvb ZiprTbt576EfLBIGDLMFps7Qy4kQYJ bGhshWgRBI bPlKmPLruuYm5OMVKeXAp baaxgG4mVs c1k6waFn dCgTRqfsr5dxFwm2qT5lQb40p fzfVbbBa7jfUKx44SMJIA4Xl434snos g8D3TJ1qP8c41et gZ7Vjzaki4tJpJ68MhHywe hlBZxYmzktlgDXpj iWFVd8oz4N0ShNSQcutq3lPJPs1QkoI iYcngTTE2kkSvsv9l jKN12AWUWGR2VDd0xnVCWW5hvt62bcd jNpuBnnuWc2Yuj9b4yMNOcr kX2OF48tXaIm3cSj6J6346 mmMbdESDsbe0UNtSudRu05aOBEMp nHFcRDpWoUoBvhVY0Mjrzn p0vK4A9NRxhjHYzy2Igs58hTOTD pOLigDD9V6x6ux6posOCjX pzRgjmhT3 qPjuqaTKZp r7eMZrkAFJm7GdUdkD1CRIBrBSrnuPa rqKHwfckwWst7etZXCHcmmq0 saIecJ0ksnZxLaylmDrZtCq u0UeqKkFfRB1whXmajgVn uEDHHBH7sF3HP8aoEKeHXKJEhhnEhZVO vknJb50VOviOsBA9nOP3IUpslRmfi vl4wue6pw1rsmjFxW xaFyNxc xc9Wa6KlsdNNA xz4p4Pi yMHG3lvl56jnbU9IM8 zfV5VTErJI6In3IjeeLVwVsPnY

Name

.text

Size

432KB

Virtual Size

431KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.managed

Size

723KB

Virtual Size

722KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

hydrated

Size

Virtual Size

347KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

661KB

Virtual Size

661KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

70KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

b3b1134d66e50e977d5627bb605ad7e18e55aa9782db579b84b8021c2266fdb6

advapi32

bcrypt

kernel32

ole32

secur32

vcruntime140

vcruntime140_1

generic