16fc435c8fceeb96dba3362577e7cf6c569c95f24fe3129e56484278b1676dae

Sharing

Copy URL Twitter E-mail

General

Target
16fc435c8fceeb96dba3362577e7cf6c569c95f24fe3129e56484278b1676dae
Size 2.1MB
Sample260821-dddcwsfl8t
SHA256 16fc435c8fceeb96dba3362577e7cf6c569c95f24fe3129e56484278b1676dae
MD5 d00dd4c62ac0cd77dba30d696cf4e873
SHA1 b346174fc0394585b6fb26e0daa1784d862f10cf
SHA512 6caeea57f3b763b3204fd80b8adefdb4bd783951190351f27f2f8c9ec8a3a275df49654f02e6af037ea339837fddf52b46b0e3bb7b83e31c055c71e5214e78fb
SSDEEP 24576:eCq0fh28eszu6+yBjxUya5uTj2Ng/qtUyuJk6RGZa0zOvqWq/qdgRXxLmrFzb54J:vfh2lszu+june2gqtUt1RGvydqLoF
TLSH
T1BCA52B92B94572CFD48F27B895ABCD4D6D1D47F942208903AC4DB8BE7E67CC116CAC28
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
16fc435c8fceeb96dba3362577e7cf6c569c95f24fe3129e56484278b1676dae

File Explorer

16fc435c8fceeb96dba3362577e7cf6c569c95f24fe3129e56484278b1676dae

.dll 2.1MB

16fc435c8fceeb96dba3362577e7cf6c569c95f24fe3129e56484278b1676dae

IMPHASH 47d4e87503facd78ec520ec12677811a
SHA256 16fc435c8fceeb96dba3362577e7cf6c569c95f24fe3129e56484278b1676dae
MD5 d00dd4c62ac0cd77dba30d696cf4e873
SHA1 b346174fc0394585b6fb26e0daa1784d862f10cf
SHA512 6caeea57f3b763b3204fd80b8adefdb4bd783951190351f27f2f8c9ec8a3a275df49654f02e6af037ea339837fddf52b46b0e3bb7b83e31c055c71e5214e78fb
SSDEEP 24576:eCq0fh28eszu6+yBjxUya5uTj2Ng/qtUyuJk6RGZa0zOvqWq/qdgRXxLmrFzb54J:vfh2lszu+june2gqtUt1RGvydqLoF
TLSH
T1BCA52B92B94572CFD48F27B895ABCD4D6D1D47F942208903AC4DB8BE7E67CC116CAC28
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

213136

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

F:\Codex\code\ms-extends\build\release\Client.pdb

kernel32

VirtualQuery OutputDebugStringA GetCurrentProcess ReadProcessMemory UnmapViewOfFile CloseHandle DisableThreadLibraryCalls CreateThread HeapFree HeapAlloc GetProcessHeap GetModuleFileNameA GetTickCount64 ExitProcess GetFileSizeEx SetLastError GetProcAddress MapViewOfFile GetLastError MultiByteToWideChar WideCharToMultiByte SetEvent GetModuleHandleW CreateFileMappingW GetModuleHandleA GetCurrentThreadId SuspendThread ResumeThread GetThreadContext SetThreadContext FlushInstructionCache VirtualAlloc VirtualFree FreeLibrary LoadLibraryExW LoadLibraryA GetCurrentThread WriteConsoleW HeapSize CreateFileW GetConsoleMode InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetStdHandle GetEnvironmentVariableA WriteFile QueryPerformanceCounter QueryPerformanceFrequency Sleep GetProcessTimes GetCurrentProcessorNumber GetSystemInfo GetLargePageMinimum GetNumaHighestNodeNumber GetNumaNodeProcessorMask WriteConsoleA GetConsoleScreenBufferInfo WakeAllConditionVariable SleepConditionVariableSRW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead InitOnceComplete InitOnceBeginInitialize SwitchToThread EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer GetCPInfo GetStringTypeW RtlUnwind RaiseException InterlockedFlushSList InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW GetModuleFileNameW GetFileType FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetFilePointerEx SetStdHandle FlushFileBuffers GetConsoleOutputCP VirtualProtect

oleaut32

VariantClear VariantInit

winmm

timeGetTime

advapi32

AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken

Name

.text

Size

287KB

Virtual Size

287KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

69KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

17KB

Virtual Size

152KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.detourc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.vlizer

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

16fc435c8fceeb96dba3362577e7cf6c569c95f24fe3129e56484278b1676dae

kernel32

oleaut32

winmm

advapi32

generic