385c2cbd5fc3cfeec25256cffe02a72d6d4b3c0986756fef65dd9c9522251db5

Sharing

Copy URL Twitter E-mail

General

Target
385c2cbd5fc3cfeec25256cffe02a72d6d4b3c0986756fef65dd9c9522251db5
Size 8.1MB
Sample260814-erenjsvbja
SHA256 385c2cbd5fc3cfeec25256cffe02a72d6d4b3c0986756fef65dd9c9522251db5
MD5 0caf7d82c382f631f5858814d3f6dbe1
SHA1 7b4ffda0e40a6fc45a8194ac63a69b7cfe8d7095
SHA512 ff219e076db5c979bdac2b7831d99f9b16751a70566139bb7b0361a17b35963d2786664c078afefca105a800f194ac3ed760b92bde017ea1abbf84eeb5a072b9
SSDEEP 98304:vNZ0V6Lc6LpAN9B/AmwZSrOkqIfLnSpA4bgs1QeACMM5cU8s4c:x7OADk3fLnSpA4bg0QevMicUn4c
TLSH
T147867D01F79654ECD0AAC474C6564A22AB7178CB1B30BAEF02D482792F67BB05F3D719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
385c2cbd5fc3cfeec25256cffe02a72d6d4b3c0986756fef65dd9c9522251db5

File Explorer

385c2cbd5fc3cfeec25256cffe02a72d6d4b3c0986756fef65dd9c9522251db5

.exe 8.1MB

385c2cbd5fc3cfeec25256cffe02a72d6d4b3c0986756fef65dd9c9522251db5

IMPHASH 5d06695e18cafdc3fc9a76e2acee67e1
SHA256 385c2cbd5fc3cfeec25256cffe02a72d6d4b3c0986756fef65dd9c9522251db5
MD5 0caf7d82c382f631f5858814d3f6dbe1
SHA1 7b4ffda0e40a6fc45a8194ac63a69b7cfe8d7095
SHA512 ff219e076db5c979bdac2b7831d99f9b16751a70566139bb7b0361a17b35963d2786664c078afefca105a800f194ac3ed760b92bde017ea1abbf84eeb5a072b9
SSDEEP 98304:vNZ0V6Lc6LpAN9B/AmwZSrOkqIfLnSpA4bgs1QeACMM5cU8s4c:x7OADk3fLnSpA4bg0QevMicUn4c
TLSH
T147867D01F79654ECD0AAC474C6564A22AB7178CB1B30BAEF02D482792F67BB05F3D719
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3317084

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\ab\Projects\aralez\target\release\deps\aralez.pdb

advapi32

SystemFunction036

kernel32

ReleaseSRWLockExclusive GlobalMemoryStatusEx GetDiskFreeSpaceExW TryAcquireSRWLockExclusive AcquireSRWLockExclusive AssignProcessToJobObject GetFileSizeEx CreateToolhelp32Snapshot Process32First Process32Next Process32FirstW HeapSize Module32FirstW Module32NextW Thread32First VirtualQueryEx ReadProcessMemory Thread32Next GetConsoleOutputCP GetProcessTimes Process32NextW BeginUpdateResourceA UpdateResourceA EndUpdateResourceA GetModuleHandleA FindResourceA EnumResourceNamesA LoadResource LockResource SizeofResource SetFileTime GetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection WakeConditionVariable WaitForSingleObject SleepConditionVariableSRW ReleaseSRWLockShared AcquireSRWLockShared GetStdHandle GetConsoleScreenBufferInfo GetConsoleMode SetConsoleMode SetConsoleCursorPosition FillConsoleOutputCharacterA FillConsoleOutputAttribute GetFileInformationByHandleEx SetConsoleTextAttribute TerminateJobObject GetStringTypeW SetStdHandle GetCPInfo GetOEMCP GetACP IsValidCodePage FindFirstFileExW LoadLibraryExA GetProcAddress FreeLibrary LCMapStringW CompareStringW GetProcessHeap HeapFree HeapAlloc FlsFree SetInformationJobObject FormatMessageW GetComputerNameExW GetTimeZoneInformationForYear FlsSetValue FlsGetValue FreeEnvironmentStringsW DeleteProcThreadAttributeList CompareStringOrdinal AddVectoredExceptionHandler SetThreadStackGuarantee SwitchToThread CreateWaitableTimerExW CreateJobObjectW Sleep QueryPerformanceCounter GetSystemInfo RtlCaptureContext RtlVirtualUnwind RtlLookupFunctionEntry SetLastError GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW SetEnvironmentVariableW GetCurrentProcess FlsAlloc GetCommandLineW FlushFileBuffers SetFileInformationByHandle DuplicateHandle SetFilePointerEx OutputDebugStringW GetCommandLineA WriteFile GetModuleHandleExW LoadLibraryExW TlsFree TlsSetValue TlsGetValue GetCurrentProcessId TlsAlloc InitializeCriticalSectionAndSpinCount WriteFileEx SleepEx GetExitCodeProcess TerminateProcess GetProcessId WakeAllConditionVariable QueryPerformanceFrequency EncodePointer HeapReAlloc ReleaseMutex FindNextFileW FindClose CreateFileW GetFileInformationByHandle CreateDirectoryW FindFirstFileW DeleteFileW MoveFileExW RemoveDirectoryW CopyFileExW RaiseException RtlPcToFileHeader GetFileType RtlUnwindEx GetStartupInfoW IsDebuggerPresent GetModuleHandleW GetModuleFileNameW ExitProcess GetFullPathNameW CreateNamedPipeW ReadFileEx GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW InitializeProcThreadAttributeList UpdateProcThreadAttribute MultiByteToWideChar WriteConsoleW WideCharToMultiByte CreateThread GetCurrentThread GetSystemTimeAsFileTime InitializeSListHead GetCurrentThreadId IsProcessorFeaturePresent SetUnhandledExceptionFilter WaitForSingleObjectEx LoadLibraryA CreateMutexA UnhandledExceptionFilter OpenProcess CloseHandle SetWaitableTimer

iphlpapi

GetTcpTable

ws2_32

ntohs

psapi

GetProcessImageFileNameW GetProcessMemoryInfo

bcrypt

BCryptGenRandom

oleaut32

SysFreeString SysStringLen

ntdll

NtReadFile RtlNtStatusToDosError NtWriteFile

Sharing

General

Malware Config

Signatures

File Explorer

385c2cbd5fc3cfeec25256cffe02a72d6d4b3c0986756fef65dd9c9522251db5

advapi32

kernel32

iphlpapi

ws2_32

psapi

bcrypt

oleaut32

ntdll

generic