9ef0b066661cc5c796c2dda9fa5013b2880eb4da385c94fa146310c661b78648

Sharing

Copy URL Twitter E-mail

General

Target
9ef0b066661cc5c796c2dda9fa5013b2880eb4da385c94fa146310c661b78648
Size 4.3MB
Sample260816-e4bsesdj2t
SHA256 9ef0b066661cc5c796c2dda9fa5013b2880eb4da385c94fa146310c661b78648
MD5 1a527aa0816b234134d07eb927a69b49
SHA1 0c41a7671b5191a839dab8648c9c5d9030c64dd4
SHA512 d7cdccf64b337d92a742e202d7ae193f7574deea2dee81cb51e9ae2f74dd6304005ffb82c4186f7da6d295735e1a84aef70bde68528f686919e9b9aaa6e07783
SSDEEP 98304:rbD3oiqAHFqMkDjAcF04Ezfh2fMBcW5u4RSFtvmIQaNm36XVmMDN1d7F6CnQi2hU:rX3oClwju4EzJ6Mz44QlmkqWVmsr0lhU
TLSH
T1F526BF85B3C8AAE9C142DE7E9714F231D1A2AC338FB790C59D97D70A4AB69414F39F40
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9ef0b066661cc5c796c2dda9fa5013b2880eb4da385c94fa146310c661b78648

File Explorer

9ef0b066661cc5c796c2dda9fa5013b2880eb4da385c94fa146310c661b78648

.dll 4.3MB

9ef0b066661cc5c796c2dda9fa5013b2880eb4da385c94fa146310c661b78648

IMPHASH b1ee8cad62aefbc15bc55581d96594ac
SHA256 9ef0b066661cc5c796c2dda9fa5013b2880eb4da385c94fa146310c661b78648
MD5 1a527aa0816b234134d07eb927a69b49
SHA1 0c41a7671b5191a839dab8648c9c5d9030c64dd4
SHA512 d7cdccf64b337d92a742e202d7ae193f7574deea2dee81cb51e9ae2f74dd6304005ffb82c4186f7da6d295735e1a84aef70bde68528f686919e9b9aaa6e07783
SSDEEP 98304:rbD3oiqAHFqMkDjAcF04Ezfh2fMBcW5u4RSFtvmIQaNm36XVmMDN1d7F6CnQi2hU:rX3oClwju4EzJ6Mz44QlmkqWVmsr0lhU
TLSH
T1F526BF85B3C8AAE9C142DE7E9714F231D1A2AC338FB790C59D97D70A4AB69414F39F40
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1036364

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

advapi32

ConvertSidToStringSidW DeregisterEventSource GetTokenInformation ImpersonateLoggedOnUser OpenProcessToken RegCloseKey RegCreateKeyExW RegSetValueExW RegisterEventSourceW ReportEventW RevertToSelf AdjustTokenPrivileges LookupPrivilegeValueW

bcrypt

BCryptGenRandom BCryptFinishHash BCryptCloseAlgorithmProvider BCryptHashData BCryptGetProperty BCryptDestroyHash BCryptCreateHash BCryptOpenAlgorithmProvider

kernel32

EncodePointer FlsFree RaiseException RtlPcToFileHeader InterlockedFlushSList RtlUnwindEx CloseHandle CopyFileExW CreateDirectoryW CreateEventExW CreateFileW DuplicateHandle FindClose FindFirstFileExW FormatMessageW FreeLibrary GetConsoleOutputCP GetCurrentProcess GetCurrentProcessorNumberEx GetCurrentThread GetEnvironmentVariableW GetFileAttributesExW GetFullPathNameW GetLastError GetLongPathNameW GetModuleFileNameW GetModuleHandleW GetProcAddress GetStdHandle GetThreadPriority GetTickCount64 IsDebuggerPresent LoadLibraryExW LocalAlloc LocalFree MultiByteToWideChar PeekNamedPipe QueryPerformanceCounter QueryPerformanceFrequency RaiseFailFastException ReadFile SetEvent SetLastError SetNamedPipeHandleState SetThreadErrorMode Sleep VirtualAlloc VirtualFree WaitForMultipleObjectsEx WideCharToMultiByte WriteFile FlushProcessWriteBuffers WaitForSingleObjectEx AddVectoredExceptionHandler RtlVirtualUnwind RtlCaptureContext RtlRestoreContext VerSetConditionMask FlsAlloc FlsGetValue FlsSetValue CreateEventW SwitchToThread CreateThread GetCurrentThreadId SetThreadPriority SuspendThread ResumeThread GetThreadContext SetThreadContext FlushInstructionCache VirtualProtect CreateMemoryResourceNotification QueryInformationJobObject GetModuleHandleExW GetProcessAffinityMask VerifyVersionInfoW InitializeContext GetEnabledXStateFeatures LocateXStateFeature SetXStateFeaturesMask VirtualQuery GetSystemTimeAsFileTime DeleteCriticalSection EnterCriticalSection InitializeCriticalSectionEx LeaveCriticalSection ResetEvent SleepEx DebugBreak InitializeCriticalSection WaitForSingleObject GetCurrentProcessId GlobalMemoryStatusEx GetSystemInfo GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo InitializeSListHead

ole32

CoUninitialize CoGetApartmentType CoWaitForMultipleHandles CoInitializeEx

secur32

QueryContextAttributesW DeleteSecurityContext InitializeSecurityContextW AcceptSecurityContext AcquireCredentialsHandleW QuerySecurityContextToken FreeContextBuffer FreeCredentialsHandle GetUserNameExW

api-ms-win-crt-math-l1-1-0

ceil

api-ms-win-crt-heap-l1-1-0

malloc _callnewh calloc free

api-ms-win-crt-string-l1-1-0

strcpy_s _stricmp strlen strcmp

api-ms-win-crt-convert-l1-1-0

strtoull

vcruntime140

memset memmove _purecall memcpy

api-ms-win-crt-runtime-l1-1-0

_initterm abort _seh_filter_dll _configure_narrow_argv terminate _initialize_narrow_environment _cexit _crt_atexit _execute_onexit_table _register_onexit_function _initialize_onexit_table _initterm_e

0H6HdDkKkMVMfnjKdyH9 0en44wxxbEPMv9syKg5hgpMWeTnvAHI3 0ir2ZucZB5K8EPc 1e6NIaWA4eX5to7qwef 21JAU3HIIHZbERlQ 2DH7Fg5rX6PFPCtRuyMvVJ 2ekByynRDtmb1u2kAi7xrks8TfJT3o 3gTTg9gk2uurK 4LCVCxaru9cATpUAMn6kk 5hw5zwnfOx01YetcjmAEH 6RcWn3Ufh4OZUBmlczvKK0A0MLRCgv 8J5Bje5qmGnelFrbonmkvAxj5eM21I 8SDXo6WxBFoguT7ghbOATb5MqwJs 8jAtptNCmI7Ypz 8pFcRMT 9v4OlTUb5atFhzsOgUCJRL225cAGi A8DMsFSgvMfZCq2OcP4rL AnalyzeSnapshot BLSkA08iBt8nskHvbz BYhMyxJfBlYhKplv6nBmHw1efsTRnw BlrV2DU1covzfxG4bNlYE Bpc68pRe7zHkQkGesAstRZssd7 CoM16X0sFV4FHHo9w2VITie DllGetClassObject GX1VFr5ynOYFQT9h6CTGq GetUnixDomainSocketSizes GetVilValueFieldOffset Glcj2VvVtS8xcAkrF1sIKXS4GHS GonIFEO7lhUS2M2 GzAN7xN Initialize InitializePAL InitializeSession InitializeUnhandledExceptionFilter JK2uFoawERqLuvVzCtwVI57OZECqxqhR Kk8QqAOFXfFlUu3LMmsXqdT LBk2Z7g844tC9zZtmHYWJ4P8dA9R MePBwtebDpSOcbslDCOYbR9PSyG OSazHEqJEXBTjOpiAkdcVQii48 OcDANrzetZBBahmNDAd6BFjbzdv OiOpf85LF OyqWarrbXxev PMteuo4bO8eQGP9 PdBimRPerj PnBPiUhy QMFEktIKXH1kGZbKplMpykbchqO QSLs838csetjlU8eda7G QeYYWywM QppZG4WAE R6QxrbJQmtEi R7994mjN2dMFepdJe RfGVMkCZCA6Ah6OX5v5T5 RunDiagnosticAnalysis RunMainLoop RxOMgLr56G23tC4TjuDsiCYAuCQiCS Shutdown ShutdownSession TS3kLlABai9rkjYlXOFspnGMh8 VdxFYCIf VmoqetF2Be W8bODZkwklYw6VOR4zhZ4cPYTtTWXt WrapICorDebugHandleValue YVA99ID1MrSdkoNSvXnbX18B1 aMeYxv2V7bIsC9txHyg aVyVPX1iSFWBQuf b07CmnQvhO9kR81 bDp0HxtsH dIFAEGFFqF27O3VnCTA1ivAWj dZzDelbrfzXGtTL2nBxXtvo0S8 doKDlYTMvfC doYfGs6LBv0jQgpZBmRNqK ejZci3SsLTn1TOQrjVF5l eob7FgqbnciNEd f9drxQ0dAcn fYqLwYp88TioY7E gIeq2cRP2563FVYzUrbP9hNObOYi2 hRlQl5JgcoKFewkznK iQxgHUHH8VWVmbmvTGfuZTibaYo idskl7UJNVYnVRePe3 j8GFaJenvzG jb5VSGO jehZAsPBN4oWB8voZL keYI82C6y lZOgfICvex4vbdmbTo6YgWU8 loFDxvrixWls mGR5HT2M mY4EsYOmsz n3ksmaGK ngsu5C5RPJJe55fHkrab76fOE oebQzS6jF9qNp3JM4IrkFklIQCo ogGGYhgA5DSXGS2vb oulNr3x9q0FH2EL p4zyGfmm5KaUWtEbYJSYAjo pZL5AnUqO8fNvyvHF8a2 ruugXmDqtB2WIYvrfLUwO sN3Hmv8if slkgSiLCqLX3hiKSx3IcLoOqRVCHo2fE tAx7tSdN6x3GFu6UNvZ tpu13QcgclesH2NhET2vERC uTPVJMni8z2 veIfN58 xjSpziqYP1IYh3LEagNNUSqXh9k8MG yv58R1fm4

Sharing

General

Malware Config

Signatures

File Explorer

9ef0b066661cc5c796c2dda9fa5013b2880eb4da385c94fa146310c661b78648

advapi32

bcrypt

kernel32

ole32

secur32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

vcruntime140

api-ms-win-crt-runtime-l1-1-0

generic