bf69ca50d8137b6e02e41755eb1d35b0b63fd3e81a2c466fff0375d55e1927a5

Sharing

Copy URL Twitter E-mail

General

Target
bf69ca50d8137b6e02e41755eb1d35b0b63fd3e81a2c466fff0375d55e1927a5
Size 302KB
Sample260820-vft7vs1fkd
SHA256 bf69ca50d8137b6e02e41755eb1d35b0b63fd3e81a2c466fff0375d55e1927a5
MD5 6e144ab2aaff763d8bee927a6a22b46d
SHA1 09c0a6ab4a5397b0166815f5b38a43a04d582302
SHA512 3e896f98da4a1d2d545131451ecc61a958aca866668eb03cd29294a02956033bac4661710c26363a53d421c3e5b91561013a06241a52272a2b84897af51d2c60
SSDEEP 6144:mOtgZjM7oB12to2h2MWla+TQe9UP6b+X1:ntgZ4KS2L0q5UPcU1
TLSH
T10C64F9B6F9CC88A8DEA00AF9377CCDE0652ABA70CEB044DA534461751D2B6B0C571DDB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bf69ca50d8137b6e02e41755eb1d35b0b63fd3e81a2c466fff0375d55e1927a5

File Explorer

bf69ca50d8137b6e02e41755eb1d35b0b63fd3e81a2c466fff0375d55e1927a5

.exe 302KB

bf69ca50d8137b6e02e41755eb1d35b0b63fd3e81a2c466fff0375d55e1927a5

IMPHASH 19f72e30429683ac5de8d6a39ee8095b
SHA256 bf69ca50d8137b6e02e41755eb1d35b0b63fd3e81a2c466fff0375d55e1927a5
MD5 6e144ab2aaff763d8bee927a6a22b46d
SHA1 09c0a6ab4a5397b0166815f5b38a43a04d582302
SHA512 3e896f98da4a1d2d545131451ecc61a958aca866668eb03cd29294a02956033bac4661710c26363a53d421c3e5b91561013a06241a52272a2b84897af51d2c60
SSDEEP 6144:mOtgZjM7oB12to2h2MWla+TQe9UP6b+X1:ntgZ4KS2L0q5UPcU1
TLSH
T10C64F9B6F9CC88A8DEA00AF9377CCDE0652ABA70CEB044DA534461751D2B6B0C571DDB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11431

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\workspace\memu-service\Release\MemuService.pdb

kernel32

CloseHandle GetLogicalDriveStringsA SetConsoleCtrlHandler CreateMutexW WaitForSingleObject GetLastError SetEvent CreateEventA GetCurrentThreadId ProcessIdToSessionId Sleep LoadLibraryA DeleteFileA WritePrivateProfileStringA Process32Next GetProcAddress WTSGetActiveConsoleSessionId FreeLibrary WinExec CreateFileW DecodePointer HeapReAlloc HeapSize GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx CreateToolhelp32Snapshot OpenProcess QueryDosDeviceA K32GetProcessImageFileNameA SetLastError Process32First GetModuleHandleA CreateThread GetModuleFileNameA GetFileSizeEx GetStringTypeW SetStdHandle UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetModuleHandleW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind RaiseException EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile HeapFree HeapAlloc GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect LCMapStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap WriteConsoleW

user32

GetProcessWindowStation SetProcessWindowStation OpenDesktopA CloseWindowStation SetThreadDesktop GetThreadDesktop CloseDesktop OpenWindowStationA

advapi32

CreateProcessAsUserA SetTokenInformation LookupPrivilegeValueA DuplicateTokenEx OpenProcessToken AdjustTokenPrivileges

wtsapi32

WTSQueryUserToken

userenv

CreateEnvironmentBlock

Name

.text

Size

84KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

30KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

179KB

Virtual Size

179KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

bf69ca50d8137b6e02e41755eb1d35b0b63fd3e81a2c466fff0375d55e1927a5

kernel32

user32

advapi32

wtsapi32

userenv

generic