33d1997f4eca60a41c7c52e99ad9d899931333b665f11e146071fac7a57f788f

Sharing

Copy URL Twitter E-mail

General

Target
33d1997f4eca60a41c7c52e99ad9d899931333b665f11e146071fac7a57f788f
Size 1.1MB
Sample260813-nqasmsgk9s
SHA256 33d1997f4eca60a41c7c52e99ad9d899931333b665f11e146071fac7a57f788f
MD5 08f2510c21cf44523eb4125ae879fbb2
SHA1 055a9cef7ddc89955bf94a37598196762c28a22f
SHA512 8dc02b60f9758a877ac11b86bbf36f22a5acd6f80bef4897701dd492f5671e0e49c99caf43d73c934d4b86bc4f427bffa85003521bcc2b34e7c0d77ac3a721f3
SSDEEP 24576:Nowq72xUbvCTaP1mENlktgQx5CS6vQWTLfWT69sYGO4xMZ7dKfNTJ8Coftc5n54u:NowURU5kIzceAD2u7
TLSH
T1184529157A9FA8BDD159C874930A4A631E2130CB1B3A7DFF40C496393FAAAB51B3C714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
33d1997f4eca60a41c7c52e99ad9d899931333b665f11e146071fac7a57f788f

File Explorer

33d1997f4eca60a41c7c52e99ad9d899931333b665f11e146071fac7a57f788f

.exe 1.1MB

33d1997f4eca60a41c7c52e99ad9d899931333b665f11e146071fac7a57f788f

IMPHASH e5f76d6858b4a5af641885c11afd22cc
SHA256 33d1997f4eca60a41c7c52e99ad9d899931333b665f11e146071fac7a57f788f
MD5 08f2510c21cf44523eb4125ae879fbb2
SHA1 055a9cef7ddc89955bf94a37598196762c28a22f
SHA512 8dc02b60f9758a877ac11b86bbf36f22a5acd6f80bef4897701dd492f5671e0e49c99caf43d73c934d4b86bc4f427bffa85003521bcc2b34e7c0d77ac3a721f3
SSDEEP 24576:Nowq72xUbvCTaP1mENlktgQx5CS6vQWTLfWT69sYGO4xMZ7dKfNTJ8Coftc5n54u:NowURU5kIzceAD2u7
TLSH
T1184529157A9FA8BDD159C874930A4A631E2130CB1B3A7DFF40C496393FAAAB51B3C714
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

839756

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winload.pdb

kernel32

WideCharToMultiByte WaitForSingleObject MultiByteToWideChar GetCurrentThreadId GetEnvironmentVariableW GetModuleHandleW GetCommandLineW GetModuleFileNameW GetFileType GetFileInformationByHandleEx QueryPerformanceFrequency ExitProcess RtlVirtualUnwind ReleaseMutex CreateMutexA WaitForSingleObjectEx GetCurrentProcessId IsDebuggerPresent FormatMessageW CreateFileW WaitForMultipleObjects SetUnhandledExceptionFilter IsProcessorFeaturePresent RaiseException HeapReAlloc GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler RtlLookupFunctionEntry QueryPerformanceCounter RtlCaptureContext CreateThread LoadLibraryA CreateConsoleScreenBuffer lstrlenW HeapFree GetProcessHeap UnhandledExceptionFilter GetCurrentProcess GetProcAddress GetModuleHandleA Sleep GetSystemInfo VirtualProtect SetConsoleCursorInfo WriteConsoleW VirtualQuery GetConsoleOutputCP SetLastError ReadConsoleInputW GetNumberOfConsoleInputEvents FillConsoleOutputAttribute FillConsoleOutputCharacterA SetConsoleCursorPosition SetConsoleTextAttribute GetConsoleScreenBufferInfo GetStdHandle CloseHandle FreeLibrary GetCurrentDirectoryW SetConsoleActiveScreenBuffer GetLastError SetConsoleMode HeapAlloc GetConsoleMode GetSystemTimeAsFileTime InitializeSListHead LoadLibraryExA

ntdll

RtlNtStatusToDosError NtWriteFile

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

bcryptprimitives

ProcessPrng

iphlpapi

GetAdaptersAddresses FreeMibTable GetIfTable2 GetIfEntry2

user32

GetKeyboardLayout ToUnicodeEx GetForegroundWindow GetWindowThreadProcessId

vcruntime140

memcpy __CxxFrameHandler3 memcmp memset memmove _CxxThrowException __C_specific_handler __current_exception __current_exception_context

api-ms-win-crt-string-l1-1-0

wcslen strlen

api-ms-win-crt-math-l1-1-0

round __setusermatherr

api-ms-win-crt-heap-l1-1-0

_set_new_mode realloc free

api-ms-win-crt-runtime-l1-1-0

_initterm_e exit _c_exit _get_initial_narrow_environment _exit _initialize_narrow_environment _configure_narrow_argv _initterm _set_app_type _seh_filter_exe __p___argc __p___argv _cexit _initialize_onexit_table _register_onexit_function _crt_atexit terminate _register_thread_local_exe_atexit_callback

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

33d1997f4eca60a41c7c52e99ad9d899931333b665f11e146071fac7a57f788f

kernel32

ntdll

api-ms-win-core-synch-l1-2-0

bcryptprimitives

iphlpapi

user32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic