9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6

Sharing

Copy URL Twitter E-mail

General

Target
9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6
Size 7.1MB
Sample260813-thfltatdke
SHA256 9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6
MD5 546e138421c2ff977955212dc1bd4991
SHA1 4debbe587b2d494dce3ff328c60d640ecebbe7ca
SHA512 0998bec660749f96a6dec288cf709281659c25d69164e177d0784f94178acfa3cd7445e9c222980ec7ec971f06d8786828ea3c39defeb8807ef9e9c9f364edce
SSDEEP 98304:dVEAkjzOmH4Pko6ypeoxZ0DtZ15xbNwOjcETFP2bT1QA4Ts8ChZ1elf+:dVEAkjPikLyp1iweiQA46hZ1Uf+
TLSH
T1C276AE02B6C2C0F2D0A71630E42997399D7BB9246720CEDB93D499785DB27D05E36B3E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6

File Explorer

9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6

.exe 7.1MB

9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6

IMPHASH ae436afd61c2d26d9a2514f937a51ac4
SHA256 9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6
MD5 546e138421c2ff977955212dc1bd4991
SHA1 4debbe587b2d494dce3ff328c60d640ecebbe7ca
SHA512 0998bec660749f96a6dec288cf709281659c25d69164e177d0784f94178acfa3cd7445e9c222980ec7ec971f06d8786828ea3c39defeb8807ef9e9c9f364edce
SSDEEP 98304:dVEAkjzOmH4Pko6ypeoxZ0DtZ15xbNwOjcETFP2bT1QA4Ts8ChZ1elf+:dVEAkjPikLyp1iweiQA46hZ1Uf+
TLSH
T1C276AE02B6C2C0F2D0A71630E42997399D7BB9246720CEDB93D499785DB27D05E36B3E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2941442

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\ab\Projects\aralez\target\i686-pc-windows-msvc\release\deps\aralez.pdb

advapi32

SystemFunction036

kernel32

GlobalMemoryStatusEx GetDiskFreeSpaceExW CreateJobObjectW SetInformationJobObject TerminateJobObject OpenProcess AssignProcessToJobObject CreateToolhelp32Snapshot Process32First Process32Next TryAcquireSRWLockExclusive HeapSize BeginUpdateResourceA UpdateResourceA EndUpdateResourceA GetModuleHandleA FindResourceA EnumResourceNamesA LoadResource LockResource SizeofResource Process32FirstW GetConsoleOutputCP Module32FirstW Module32NextW Thread32First VirtualQueryEx ReadProcessMemory Thread32Next GetStringTypeW GetProcessTimes Process32NextW SetFileTime GetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection WakeConditionVariable WaitForSingleObject SleepConditionVariableSRW ReleaseSRWLockShared AcquireSRWLockShared GetStdHandle GetConsoleScreenBufferInfo GetConsoleMode SetConsoleMode SetConsoleCursorPosition FillConsoleOutputCharacterA FillConsoleOutputAttribute GetFileInformationByHandleEx SetConsoleTextAttribute ReleaseSRWLockExclusive SetStdHandle GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW DecodePointer GetProcessHeap HeapFree LCMapStringW AcquireSRWLockExclusive LoadLibraryExA FormatMessageW GetComputerNameExW HeapAlloc GetProcAddress FreeLibrary CompareStringW GetTimeZoneInformationForYear FreeEnvironmentStringsW DeleteProcThreadAttributeList CompareStringOrdinal AddVectoredExceptionHandler SetThreadStackGuarantee TlsSetValue CreateWaitableTimerExW SetWaitableTimer Sleep GetSystemInfo GetCurrentProcess GetCurrentThread RtlCaptureContext ReleaseMutex SetLastError GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW SetEnvironmentVariableW OutputDebugStringW GetCommandLineW FlushFileBuffers SetFileInformationByHandle DuplicateHandle SetFilePointerEx ReadFileEx SleepEx GetCommandLineA WriteFile GetFileSizeEx GetModuleHandleExW LoadLibraryExW InitializeCriticalSectionAndSpinCount EncodePointer RaiseException GetCurrentProcessId RtlUnwind GetStartupInfoW WriteFileEx GetExitCodeProcess TerminateProcess GetProcessId WakeAllConditionVariable QueryPerformanceCounter QueryPerformanceFrequency IsDebuggerPresent HeapReAlloc WaitForSingleObjectEx LoadLibraryA CreateMutexA FindNextFileW FindClose CreateFileW GetFileInformationByHandle InitializeSListHead GetCurrentThreadId CreateDirectoryW FindFirstFileW DeleteFileW MoveFileExW RemoveDirectoryW CopyFileExW SetUnhandledExceptionFilter UnhandledExceptionFilter GetFileType IsProcessorFeaturePresent TlsGetValue CloseHandle GetModuleHandleW GetModuleFileNameW ExitProcess GetFullPathNameW CreateNamedPipeW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW InitializeProcThreadAttributeList UpdateProcThreadAttribute MultiByteToWideChar WriteConsoleW WideCharToMultiByte CreateThread InitOnceBeginInitialize TlsAlloc InitOnceComplete TlsFree GetSystemTimeAsFileTime SwitchToThread

iphlpapi

GetTcpTable

ws2_32

ntohs

psapi

GetProcessImageFileNameW GetProcessMemoryInfo

bcrypt

BCryptGenRandom

oleaut32

SysFreeString SysStringLen

ntdll

NtReadFile NtWriteFile RtlNtStatusToDosError

Sharing

General

Malware Config

Signatures

File Explorer

9bd77af65c9eea9ec1d517f573cac3e9eabbcb39c3e2c116a985f8a02f3969b6

advapi32

kernel32

iphlpapi

ws2_32

psapi

bcrypt

oleaut32

ntdll

generic