3ebb7af6f01bce662f223e02cc80c10896943f19933f898caef8d2ee6f38dc51

Sharing

Copy URL Twitter E-mail

General

Target
3ebb7af6f01bce662f223e02cc80c10896943f19933f898caef8d2ee6f38dc51
Size 147KB
Sample260813-mw68csfp6x
SHA256 3ebb7af6f01bce662f223e02cc80c10896943f19933f898caef8d2ee6f38dc51
MD5 3561ebb4f5522a7cf7afc3f8cd764371
SHA1 051ca457066a8a90aed75b2457b24b879bcd16d4
SHA512 e18962cb228e6704cc01102940268ebc1f78a9a08fb91ded781e74c9d357816e0d81389aa8bbe59e24dcd28c3dd49ce2891b97ab5b706104ccabd7bab951c493
SSDEEP 3072:oxOifqHSk9zQpfD4ESehZaFbm5edIxa1sW/J8l:oCHtzQ94EVhe+xal6
TLSH
T159E35B137685A5FDD04AC03483968A76B672B0DA1F325AEF0365423C3F69EF26F39254
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3ebb7af6f01bce662f223e02cc80c10896943f19933f898caef8d2ee6f38dc51

File Explorer

3ebb7af6f01bce662f223e02cc80c10896943f19933f898caef8d2ee6f38dc51

.exe 147KB

3ebb7af6f01bce662f223e02cc80c10896943f19933f898caef8d2ee6f38dc51

IMPHASH 969fa474fbec53b83d3fc6b2c298cc57
SHA256 3ebb7af6f01bce662f223e02cc80c10896943f19933f898caef8d2ee6f38dc51
MD5 3561ebb4f5522a7cf7afc3f8cd764371
SHA1 051ca457066a8a90aed75b2457b24b879bcd16d4
SHA512 e18962cb228e6704cc01102940268ebc1f78a9a08fb91ded781e74c9d357816e0d81389aa8bbe59e24dcd28c3dd49ce2891b97ab5b706104ccabd7bab951c493
SSDEEP 3072:oxOifqHSk9zQpfD4ESehZaFbm5edIxa1sW/J8l:oCHtzQ94EVhe+xal6
TLSH
T159E35B137685A5FDD04AC03483968A76B672B0DA1F325AEF0365423C3F69EF26F39254
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

103168

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

move_win_vd.pdb

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

user32

GetForegroundWindow

ole32

CoCreateInstance CoIncrementMTAUsage

kernel32

AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread SetLastError GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW ReleaseMutex CreateMutexA GetCurrentProcessId LoadLibraryA WaitForSingleObjectEx WideCharToMultiByte IsDebuggerPresent GetConsoleMode GetModuleHandleW GetCurrentProcess lstrlenW HeapReAlloc GetLastError HeapFree HeapAlloc GetProcessHeap IsProcessorFeaturePresent GetModuleHandleA GetModuleFileNameW ExitProcess CloseHandle WaitForSingleObject MultiByteToWideChar WriteConsoleW GetStdHandle GetConsoleOutputCP QueryPerformanceCounter GetCurrentThreadId RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetProcAddress UnhandledExceptionFilter SetUnhandledExceptionFilter GetSystemTimeAsFileTime InitializeSListHead

oleaut32

GetErrorInfo

ntdll

RtlNtStatusToDosError NtWriteFile

vcruntime140

__CxxFrameHandler3 __current_exception_context __current_exception memmove memcpy memset memcmp _CxxThrowException __C_specific_handler

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

api-ms-win-crt-runtime-l1-1-0

terminate _set_app_type _crt_atexit _seh_filter_exe _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initialize_onexit_table _initterm_e exit _exit __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _register_onexit_function _initterm

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

3ebb7af6f01bce662f223e02cc80c10896943f19933f898caef8d2ee6f38dc51

api-ms-win-core-synch-l1-2-0

user32

ole32

kernel32

oleaut32

ntdll

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic