0fd848fc171a4d3eb432ad52ef6b78235dc6a3004e6d9b6c2d64213ebf18dba2

General

Target
0fd848fc171a4d3eb432ad52ef6b78235dc6a3004e6d9b6c2d64213ebf18dba2
Size 105KB
Sample260821-vrt18sce37
SHA256 0fd848fc171a4d3eb432ad52ef6b78235dc6a3004e6d9b6c2d64213ebf18dba2
MD5 4e76d0364eb81c8a9c0bd7fcb93e0359
SHA1 168af943fc9ab42316ba1ef41c70231317eede5d
SHA512 b4ecb415a1652d1195294e8b62ccb33ef25cf569f80cba55dcc8f488792d04e2b389a675b8104afc835e8d1c48e3b6d44c5aeb9053634c054802094a940f7ba4
SSDEEP 3072:OjjweC0HJhXh9W/uOf/m/pNdpNdtNt1QOusaULRjvU:OjjG0Dhs/uAe2sK
TLSH
T171B35A1BB3A940BBE1768678C5631905D772B86117329BAF43A4434A2F277C19E3EF31
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0fd848fc171a4d3eb432ad52ef6b78235dc6a3004e6d9b6c2d64213ebf18dba2

File Explorer

0fd848fc171a4d3eb432ad52ef6b78235dc6a3004e6d9b6c2d64213ebf18dba2

.dll 105KB

0fd848fc171a4d3eb432ad52ef6b78235dc6a3004e6d9b6c2d64213ebf18dba2

IMPHASH 2c1f1742f3640bb7fdfe2f10d84bc3b3
SHA256 0fd848fc171a4d3eb432ad52ef6b78235dc6a3004e6d9b6c2d64213ebf18dba2
MD5 4e76d0364eb81c8a9c0bd7fcb93e0359
SHA1 168af943fc9ab42316ba1ef41c70231317eede5d
SHA512 b4ecb415a1652d1195294e8b62ccb33ef25cf569f80cba55dcc8f488792d04e2b389a675b8104afc835e8d1c48e3b6d44c5aeb9053634c054802094a940f7ba4
SSDEEP 3072:OjjweC0HJhXh9W/uOf/m/pNdpNdtNt1QOusaULRjvU:OjjG0Dhs/uAe2sK
TLSH
T171B35A1BB3A940BBE1768678C5631905D772B86117329BAF43A4434A2F277C19E3EF31
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

12020

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\Project\ReflectiveLoader\Bin\ReflectiveLoader64.pdb

kernel32

CreateThread VirtualProtect HeapFree SetLastError VirtualFree VirtualAlloc LoadLibraryA GetNativeSystemInfo HeapAlloc GetProcAddress GetProcessHeap GetModuleHandleW FreeLibrary IsBadReadPtr DisableThreadLibraryCalls CloseHandle SetUnhandledExceptionFilter RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlPcToFileHeader EncodePointer RaiseException RtlUnwindEx InterlockedFlushSList GetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameA MultiByteToWideChar WideCharToMultiByte GetStringTypeW GetACP HeapReAlloc LCMapStringW FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetStdHandle GetFileType HeapSize SetStdHandle WriteFile FlushFileBuffers GetConsoleCP GetConsoleMode SetFilePointerEx WriteConsoleW CreateFileW

Name

.text

Size

55KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

38KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

216B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

768B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

0fd848fc171a4d3eb432ad52ef6b78235dc6a3004e6d9b6c2d64213ebf18dba2

kernel32

generic