b947fd99b67eb110aa96fb1057261a3c834599c114b2b80dc6e87b27019f6774

Sharing

Copy URL Twitter E-mail

General

Target
b947fd99b67eb110aa96fb1057261a3c834599c114b2b80dc6e87b27019f6774
Size 1.0MB
Sample260817-ekkwzsshja
SHA256 b947fd99b67eb110aa96fb1057261a3c834599c114b2b80dc6e87b27019f6774
MD5 adaca4f05f86d1f0394aed1d8a3209f2
SHA1 0461f48574bc1ce494f4bc979b99441fe6a5612b
SHA512 7efd2ea4a364cec34f722beac0e9fae249816339d9e752b7b20f24368a11885e8e9cbc017455c824a74c1d87d7404cbae65a351ac0bcfcaf82d8ad15e383892b
SSDEEP 12288:ftX/k3J/Dgm4FXemlZQU3ZacMH0F+KEkxnjz+8rV1:Fs3J/D+/Zac80FIGnjz+0
TLSH
T1AD359E16A2A502F9E177D17DC9A64E46FAB27C090320EBC707E467A52F176E04B7F312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b947fd99b67eb110aa96fb1057261a3c834599c114b2b80dc6e87b27019f6774

File Explorer

b947fd99b67eb110aa96fb1057261a3c834599c114b2b80dc6e87b27019f6774

.exe 1.0MB

b947fd99b67eb110aa96fb1057261a3c834599c114b2b80dc6e87b27019f6774

IMPHASH 1af532d5ace7de2e5ea5461446ea2a71
SHA256 b947fd99b67eb110aa96fb1057261a3c834599c114b2b80dc6e87b27019f6774
MD5 adaca4f05f86d1f0394aed1d8a3209f2
SHA1 0461f48574bc1ce494f4bc979b99441fe6a5612b
SHA512 7efd2ea4a364cec34f722beac0e9fae249816339d9e752b7b20f24368a11885e8e9cbc017455c824a74c1d87d7404cbae65a351ac0bcfcaf82d8ad15e383892b
SSDEEP 12288:ftX/k3J/Dgm4FXemlZQU3ZacMH0F+KEkxnjz+8rV1:Fs3J/D+/Zac80FIGnjz+0
TLSH
T1AD359E16A2A502F9E177D17DC9A64E46FAB27C090320EBC707E467A52F176E04B7F312
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

394588

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\progarm\VS\C2\debug\beacon\windows\build\Release\ToolExe.pdb

ws2_32

inet_ntop freeaddrinfo getaddrinfo gethostname

advapi32

GetUserNameA

kernel32

SetConsoleOutputCP GetFileAttributesA GetNativeSystemInfo GetModuleFileNameA MultiByteToWideChar WideCharToMultiByte DeleteFileA FindClose FindFirstFileW FindNextFileW SetConsoleCP RemoveDirectoryA SetFileAttributesA CloseHandle CreateProcessA MoveFileExA SystemTimeToTzSpecificLocalTime FileTimeToSystemTime SetStdHandle OutputDebugStringW GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetModuleHandleA Sleep GetCommandLineA CreateFileW HeapSize WriteConsoleW SetEndOfFile GetLogicalDrives QueryPerformanceCounter FormatMessageA EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection LocalFree GetLocaleInfoEx EncodePointer DecodePointer LCMapStringEx GetStringTypeW CompareStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile GetCommandLineW GetCurrentThread HeapAlloc HeapFree GetTempPathW FlsAlloc FlsGetValue FlsSetValue FlsFree IsThreadAFiber VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW CreateDirectoryW MoveFileExW HeapReAlloc SetConsoleCtrlHandler GetTimeZoneInformation FindFirstFileExW IsValidCodePage GetACP GetOEMCP

user32

GetDC GetSystemMetrics SetProcessDPIAware ReleaseDC

gdi32

DeleteObject DeleteDC GetObjectA GetDIBits SelectObject CreateCompatibleDC CreateCompatibleBitmap BitBlt

Name

.text

Size

850KB

Virtual Size

850KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

154KB

Virtual Size

153KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

39KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

b947fd99b67eb110aa96fb1057261a3c834599c114b2b80dc6e87b27019f6774

ws2_32

advapi32

kernel32

user32

gdi32

generic