c150073e54c5bb1f8d9d20c3565512f33d30d51b5e248807540f05c34b53f08d[.]bin

General

Target
c150073e54c5bb1f8d9d20c3565512f33d30d51b5e248807540f05c34b53f08d.bin
Size 160.1MB
Sample260816-nerxsach76
SHA256 c150073e54c5bb1f8d9d20c3565512f33d30d51b5e248807540f05c34b53f08d
MD5 06e98df800bb64b12ed50901ebf16df0
SHA1 26951cb6da0f9de35acb5e4ad6add3c0eaf48148
SHA512 a6d0081165e5651e906859d45c03aa683030aea59cdb29998da4500f5bc7201d5bb8a2d1ca832519bd2a3b52a0a14a4aa007c5c07f8ab41ebc3c16e76ac5a619
SSDEEP 6144:vYClF5dFkaLrpzIrTY7ix2gMVtYoXGDTCA9ohN00E9LvaZlYtrw4hcw29Ct:vXlHzfpzIPJx2gyaCA9oDDDf4vV
TLSH
T1B188BF1AF7A504F9D5B7D138C8520902EA72BC5A43B097DF23E44AA62F273D09E3E751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c150073e54c5bb1f8d9d20c3565512f33d30d51b5e248807540f05c34b53f08d.bin

File Explorer

c150073e54c5bb1f8d9d20c3565512f33d30d51b5e248807540f05c34b53f08d.bin

.exe 160.1MB

c150073e54c5bb1f8d9d20c3565512f33d30d51b5e248807540f05c34b53f08d.bin

IMPHASH 9c00054d041da26874cd2619d872dd9e
SHA256 c150073e54c5bb1f8d9d20c3565512f33d30d51b5e248807540f05c34b53f08d
MD5 06e98df800bb64b12ed50901ebf16df0
SHA1 26951cb6da0f9de35acb5e4ad6add3c0eaf48148
SHA512 a6d0081165e5651e906859d45c03aa683030aea59cdb29998da4500f5bc7201d5bb8a2d1ca832519bd2a3b52a0a14a4aa007c5c07f8ab41ebc3c16e76ac5a619
SSDEEP 6144:vYClF5dFkaLrpzIrTY7ix2gMVtYoXGDTCA9ohN00E9LvaZlYtrw4hcw29Ct:vXlHzfpzIPJx2gyaCA9oDDDf4vV
TLSH
T1B188BF1AF7A504F9D5B7D138C8520902EA72BC5A43B097DF23E44AA62F273D09E3E751
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

95384

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\danar\OneDrive\Рабочий стол\Sources\Add\gdd\x64\Release\gdd.pdb

kernel32

SetEndOfFile CloseHandle Sleep WaitForSingleObject GetCurrentProcess GetTickCount CreateProcessA GetModuleFileNameA WriteConsoleW HeapSize GetProcessHeap SetStdHandle LocalFree FormatMessageA GetLocaleInfoEx CreateDirectoryW CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesW GetFileAttributesExW SetFileInformationByHandle GetTempPathW AreFileApisANSI GetLastError GetModuleHandleW GetProcAddress GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte QueryPerformanceCounter QueryPerformanceFrequency GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WaitForSingleObjectEx GetExitCodeThread InitializeCriticalSectionEx GetSystemTimeAsFileTime EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx WakeAllConditionVariable GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW CreateThread ExitThread FreeLibraryAndExitThread SetConsoleCtrlHandler GetStdHandle WriteFile GetModuleFileNameW GetFileSizeEx SetFilePointerEx GetFileType HeapAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadFile ReadConsoleW HeapReAlloc IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW RtlUnwind

advapi32

RegSetValueExA OpenProcessToken RegOpenKeyExA GetTokenInformation RegCloseKey

shell32

SHGetFolderPathA ShellExecuteExA

urlmon

URLDownloadToFileW

Sharing