c38158db709caa8a40cb36e5767c5cc5d5085067c2dfa75a3afe18b99fde6928

Sharing

Copy URL Twitter E-mail

General

Target
c38158db709caa8a40cb36e5767c5cc5d5085067c2dfa75a3afe18b99fde6928
Size 1.2MB
Sample260821-r267rssbkh
SHA256 c38158db709caa8a40cb36e5767c5cc5d5085067c2dfa75a3afe18b99fde6928
MD5 00388f55fbdab2eaea1cce5590b8e18c
SHA1 70c5a7b7b7c5fe03bf94290cafd5642dce253592
SHA512 6929722cacec28e6fe61e1b1b55b77b3b2e8cd6013433f67d20dd45f68eab64965e104129b082402192c7eb420d0abb17d404a24f8c652e7c1e04d5eab5d5480
SSDEEP 384:wULYKWgplTc7YL2UlsVb4GxwxSCntlLS4jzVlos:rMZg1seGxwxlxzVCs
TLSH
T1E245C50A180A04D9E70AC63A80115526DB6DFF22D72425FF16A3B2265CF1BF78EF95DC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c38158db709caa8a40cb36e5767c5cc5d5085067c2dfa75a3afe18b99fde6928

File Explorer

c38158db709caa8a40cb36e5767c5cc5d5085067c2dfa75a3afe18b99fde6928

.exe 1.2MB

c38158db709caa8a40cb36e5767c5cc5d5085067c2dfa75a3afe18b99fde6928

IMPHASH 560138c4f3e487305f50cc90d201f332
SHA256 c38158db709caa8a40cb36e5767c5cc5d5085067c2dfa75a3afe18b99fde6928
MD5 00388f55fbdab2eaea1cce5590b8e18c
SHA1 70c5a7b7b7c5fe03bf94290cafd5642dce253592
SHA512 6929722cacec28e6fe61e1b1b55b77b3b2e8cd6013433f67d20dd45f68eab64965e104129b082402192c7eb420d0abb17d404a24f8c652e7c1e04d5eab5d5480
SSDEEP 384:wULYKWgplTc7YL2UlsVb4GxwxSCntlLS4jzVlos:rMZg1seGxwxlxzVCs
TLSH
T1E245C50A180A04D9E70AC63A80115526DB6DFF22D72425FF16A3B2265CF1BF78EF95DC
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

WSACleanup WSAStartup closesocket connect gethostbyname htons inet_addr recv send socket

kernel32

CloseHandle CopyFileW CreateDirectoryW CreateFileW CreateMutexW CreateToolhelp32Snapshot DeleteCriticalSection EnterCriticalSection FreeConsole GetConsoleWindow GetCurrentProcess GetCurrentProcessId GetCurrentProcessorNumber GetEnvironmentVariableW GetFileAttributesW GetFileTime GetLastError GetLogicalProcessorInformation GetModuleFileNameW GetProcAddress GetProcessWorkingSetSize GetStartupInfoA GetSystemDefaultLangID GetSystemFileCacheSize GetSystemRegistryQuota GetTempPathW GetTickCount GetTickCount64 GetUserDefaultLCID GetVersionExA InitializeCriticalSection IsDBCSLeadByte K32GetPerformanceInfo LeaveCriticalSection LoadLibraryA OpenProcess Process32FirstW Process32NextW QueryFullProcessImageNameW SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForSingleObject WriteFile __C_specific_handler lstrcatW lstrcmpiW lstrlenW

user32

GetKeyboardLayout ShowWindow wsprintfA wsprintfW

shell32

ShellExecuteExW

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf fflush setvbuf

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv __p__acmdln _cexit _configure_narrow_argv _crt_atexit _exit _initialize_narrow_environment _initterm _initterm_e _set_app_type _set_invalid_parameter_handler abort exit signal

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc

api-ms-win-crt-private-l1-1-0

memcpy

api-ms-win-crt-string-l1-1-0

memset strlen strncmp

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-environment-l1-1-0

__p__environ

Name

.text

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

344B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

512B

Virtual Size

288B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

100B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

c38158db709caa8a40cb36e5767c5cc5d5085067c2dfa75a3afe18b99fde6928

ws2_32

kernel32

user32

shell32

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

generic