fb999926e5637145f61f9d33df9cf7abe6527c736a8149bcdd8e2366e5531ce9

Sharing

Copy URL Twitter E-mail

General

Target
fb999926e5637145f61f9d33df9cf7abe6527c736a8149bcdd8e2366e5531ce9
Size 297KB
Sample260820-krpfmscd26
SHA256 fb999926e5637145f61f9d33df9cf7abe6527c736a8149bcdd8e2366e5531ce9
MD5 103fe1df58348f16f61a80951a27d2da
SHA1 ddb723e5ac2a052ec0a916ac6d06271693d7764e
SHA512 9ffedcfaa3ff84e8c2f1f41446c60e636aa01bc2f33e3c46d62630b3e9cad4cc9c8fc33337e808256dade9000b71c36f6d6c87816e0652541bb830f92a597042
SSDEEP 6144:iMigALlPk4wO9NVUaUUqjUaC4I7mcp2PT95oqagkcY3PSH9GD:cxRVx0I7mcIr95J3c3PSUD
TLSH
T1A3547D1AF7A510F9E97BC57CC9424906EBB27C124761EBCF03A14A962F236E09E3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fb999926e5637145f61f9d33df9cf7abe6527c736a8149bcdd8e2366e5531ce9

File Explorer

fb999926e5637145f61f9d33df9cf7abe6527c736a8149bcdd8e2366e5531ce9

.exe 297KB

fb999926e5637145f61f9d33df9cf7abe6527c736a8149bcdd8e2366e5531ce9

IMPHASH 0aa6edab19dac5d940abc7a5173267b3
SHA256 fb999926e5637145f61f9d33df9cf7abe6527c736a8149bcdd8e2366e5531ce9
MD5 103fe1df58348f16f61a80951a27d2da
SHA1 ddb723e5ac2a052ec0a916ac6d06271693d7764e
SHA512 9ffedcfaa3ff84e8c2f1f41446c60e636aa01bc2f33e3c46d62630b3e9cad4cc9c8fc33337e808256dade9000b71c36f6d6c87816e0652541bb830f92a597042
SSDEEP 6144:iMigALlPk4wO9NVUaUUqjUaC4I7mcp2PT95oqagkcY3PSH9GD:cxRVx0I7mcIr95J3c3PSUD
TLSH
T1A3547D1AF7A510F9E97BC57CC9424906EBB27C124761EBCF03A14A962F236E09E3D711
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

92160

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetModuleFileNameW CreateMutexW GetTickCount64 GetLastError CloseHandle GetModuleHandleW ReadFile HeapFree CreateFileW HeapAlloc GetFileSize GetProcessHeap CreateProcessW GetCurrentProcess WideCharToMultiByte WriteConsoleW HeapSize SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA FindNextFileW FindFirstFileExW FindClose SetEndOfFile MultiByteToWideChar GetOEMCP GetACP IsValidCodePage ReadConsoleW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW LoadLibraryExW VirtualProtect GetConsoleMode GetConsoleOutputCP GetStringTypeW CompareStringEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW SetUnhandledExceptionFilter GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress IsProcessorFeaturePresent GetStdHandle WriteFile RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapReAlloc GetFileSizeEx SetFilePointerEx GetFileType FlushFileBuffers RtlUnwind

user32

MessageBoxW

bcrypt

BCryptHashData BCryptGenerateSymmetricKey BCryptSetProperty BCryptCloseAlgorithmProvider BCryptOpenAlgorithmProvider BCryptDecrypt BCryptGetProperty BCryptDestroyKey BCryptCreateHash BCryptDestroyHash BCryptFinishHash

crypt32

CryptStringToBinaryW

ws2_32

send socket InetPtonW connect recv htons WSAStartup WSACleanup closesocket setsockopt

wininet

InternetCloseHandle HttpOpenRequestW InternetConnectW InternetReadFile InternetOpenW HttpSendRequestW

Name

.text

Size

194KB

Virtual Size

194KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

81KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

fb999926e5637145f61f9d33df9cf7abe6527c736a8149bcdd8e2366e5531ce9

kernel32

user32

bcrypt

crypt32

ws2_32

wininet

generic