df8dbef4350697cb2d1bbbdfcf223174382798e970ed6bcb371f6e41d0b752bc

General

Target
df8dbef4350697cb2d1bbbdfcf223174382798e970ed6bcb371f6e41d0b752bc
Size 789KB
Sample260819-ls36vstset
SHA256 df8dbef4350697cb2d1bbbdfcf223174382798e970ed6bcb371f6e41d0b752bc
MD5 405099d6ad2603deef5662472dcc75d7
SHA1 35f0b75608a52d44e144b902cf55f6e3b6a90cbb
SHA512 896f2f5f6efcd2820228baf797c457503b07a09021da0346bdf117d7d139109c2925e9e8d320f8107277a631b21b7a7d419dc9c0cbb5c323da65e954a0bee3a9
SSDEEP 24576:eaVhxQ5QLGlTHZpkcZx1dMXqqMGT5WM2u:eaLxQQGdpkcL1dMV94
TLSH
T18D05AE17664941EFDCC185F6C8950EBF5E6A7C2A37A141FF33A0335DEE32A9118299B0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
df8dbef4350697cb2d1bbbdfcf223174382798e970ed6bcb371f6e41d0b752bc

File Explorer

df8dbef4350697cb2d1bbbdfcf223174382798e970ed6bcb371f6e41d0b752bc

.exe 789KB

df8dbef4350697cb2d1bbbdfcf223174382798e970ed6bcb371f6e41d0b752bc

IMPHASH c3f495117e78c5f6c19aa3fa0cb35347
SHA256 df8dbef4350697cb2d1bbbdfcf223174382798e970ed6bcb371f6e41d0b752bc
MD5 405099d6ad2603deef5662472dcc75d7
SHA1 35f0b75608a52d44e144b902cf55f6e3b6a90cbb
SHA512 896f2f5f6efcd2820228baf797c457503b07a09021da0346bdf117d7d139109c2925e9e8d320f8107277a631b21b7a7d419dc9c0cbb5c323da65e954a0bee3a9
SSDEEP 24576:eaVhxQ5QLGlTHZpkcZx1dMXqqMGT5WM2u:eaLxQQGdpkcL1dMV94
TLSH
T18D05AE17664941EFDCC185F6C8950EBF5E6A7C2A37A141FF33A0335DEE32A9118299B0
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

48288

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\circleci\project\vendor\squirrel.windows\src\StubExecutable\bin\Release\StubExecutable.pdb

kernel32

GetModuleFileNameW GetModuleHandleW FindFirstFileW FindNextFileW FindClose CreateProcessW WriteConsoleW CreateFileW CloseHandle MultiByteToWideChar WideCharToMultiByte GetStringTypeW EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection LCMapStringEx GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW ExitProcess GetModuleHandleExW GetStdHandle WriteFile HeapFree HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapReAlloc GetFileType FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle SetFilePointerEx HeapSize FlushFileBuffers GetConsoleOutputCP GetConsoleMode

user32

AllowSetForegroundWindow WaitForInputIdle

Sharing

General

Malware Config

Signatures

File Explorer

df8dbef4350697cb2d1bbbdfcf223174382798e970ed6bcb371f6e41d0b752bc

kernel32

user32

generic