37b5bb600cef2e37a1dbdef9fc7904b435aafa201fa2fa5bc00bb14e30f4f7dd

Sharing

Copy URL Twitter E-mail

General

Target
37b5bb600cef2e37a1dbdef9fc7904b435aafa201fa2fa5bc00bb14e30f4f7dd
Size 235KB
Sample260822-xp378ss1ht
SHA256 37b5bb600cef2e37a1dbdef9fc7904b435aafa201fa2fa5bc00bb14e30f4f7dd
MD5 cf7969db50fd675c0bd508f58e1b1c0b
SHA1 e17cf7a3f4aa734f2ab9a3b794b08dbd4c62e372
SHA512 72aef47ffd6f6d42b6300ff4fcd2e9668e7b372a73f622f03ac5e561835eded53e0bcd2db3d1f7ca511005e569ca8e2ef55823c69671fab91d2a1f1d75a0e505
SSDEEP 6144:OrBv8pjTrN+yVs+Y2kJbMvXqIVeYMf63XEspb81bI8d401h40cVIikexI9nMe7P1:OrBOjf6JbMCzkkGv
TLSH
T1FF342A83B184057AEC17E13D935FE72AEBB67CA00354E4CB13B061112F5BBE069BEA55
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
37b5bb600cef2e37a1dbdef9fc7904b435aafa201fa2fa5bc00bb14e30f4f7dd

File Explorer

37b5bb600cef2e37a1dbdef9fc7904b435aafa201fa2fa5bc00bb14e30f4f7dd

.dll 235KB

37b5bb600cef2e37a1dbdef9fc7904b435aafa201fa2fa5bc00bb14e30f4f7dd

IMPHASH 9614d1079b1c5e652ea121a24bee3c65
SHA256 37b5bb600cef2e37a1dbdef9fc7904b435aafa201fa2fa5bc00bb14e30f4f7dd
MD5 cf7969db50fd675c0bd508f58e1b1c0b
SHA1 e17cf7a3f4aa734f2ab9a3b794b08dbd4c62e372
SHA512 72aef47ffd6f6d42b6300ff4fcd2e9668e7b372a73f622f03ac5e561835eded53e0bcd2db3d1f7ca511005e569ca8e2ef55823c69671fab91d2a1f1d75a0e505
SSDEEP 6144:OrBv8pjTrN+yVs+Y2kJbMvXqIVeYMf63XEspb81bI8d401h40cVIikexI9nMe7P1:OrBOjf6JbMCzkkGv
TLSH
T1FF342A83B184057AEC17E13D935FE72AEBB67CA00354E4CB13B061112F5BBE069BEA55
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4576

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

api-ms-win-crt-runtime-l1-1-0

_assert _errno _execute_onexit_table _exit _initialize_onexit_table _initterm _initterm_e _register_onexit_function _register_thread_local_exe_atexit_callback abort strerror

api-ms-win-crt-string-l1-1-0

memset strcmp strlen strncmp strnlen wcslen wcsnlen

kernel32

AcquireSRWLockExclusive DeleteCriticalSection DisableThreadLibraryCalls EnterCriticalSection ExitProcess GetCurrentProcess GetCurrentThread GetLastError GetModuleHandleW GetProcAddress GetSystemInfo GetSystemTimeAsFileTime GetThreadContext GlobalMemoryStatusEx InitializeCriticalSection LeaveCriticalSection MultiByteToWideChar RaiseException ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlRestoreContext RtlUnwindEx RtlVirtualUnwind Sleep TlsAlloc TlsFree TlsGetValue TlsSetValue VirtualProtect VirtualQuery WideCharToMultiByte

api-ms-win-crt-private-l1-1-0

memchr memcmp memcpy memmove

api-ms-win-crt-heap-l1-1-0

_aligned_free _aligned_malloc calloc free malloc realloc

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __stdio_common_vfprintf __stdio_common_vfwprintf _fileno _setmode fflush fputc fputwc

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func ___mb_cur_max_func localeconv

api-ms-win-crt-convert-l1-1-0

mbrtowc strtof wcrtomb

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

??0KernelLoggingSession@@QEAA@PEBG0PEBUSESSION_PROPERTIES@@_N_K@Z ??0LoggingSession@@QEAA@PEBG0PEBUSESSION_PROPERTIES@@_N_K@Z ??1KernelLoggingSession@@UEAA@XZ ??1LoggingSession@@UEAA@XZ ?AddFlagToTracingFlags@KernelLoggingSession@@MEAAHPEBG@Z ?AddFlagToTracingFlags@LoggingSession@@MEAAHPEBG@Z ?CaptureState@KernelLoggingSession@@UEAAKPEBGE@Z ?CaptureState@LoggingSession@@UEAAKPEBGK@Z ?ClearTracingFlags@KernelLoggingSession@@MEAAXXZ ?ClearTracingFlags@LoggingSession@@MEAAXXZ ?CreateMergedETLFile@@YAKQEAPEBGKPEBG@Z ?CreateMergedETLFileEx@@YAKQEAPEBGKPEBGK@Z ?DisableBootTracing@KernelLoggingSession@@SAKXZ ?EnableBootTracing@KernelLoggingSession@@QEBAKXZ ?EnumFlags@KernelLoggingSession@@UEBAPEBUFlagName@LoggingSession@@AEAK@Z ?EnumFlags@LoggingSession@@UEBAPEBUFlagName@1@AEAK@Z ?EnumGroups@KernelLoggingSession@@UEBAPEBUGroupName@LoggingSession@@AEAK@Z ?EnumGroups@LoggingSession@@UEBAPEBUGroupName@1@AEAK@Z ?EnumLoggers@LoggingSession@@SAKPEAPEAV1@AEAK@Z ?FlushLogger@KernelLoggingSession@@UEAAKXZ ?FlushLogger@LoggingSession@@UEAAKXZ ?FlushLoggerWithSuppressedEvents@KernelLoggingSession@@UEAAK_N@Z ?FlushLoggerWithSuppressedEvents@LoggingSession@@UEAAK_N@Z ?GetBootTracingStatus@KernelLoggingSession@@SAHPEAV1@@Z ?GetDecodedTraceFlags@LoggingSession@@QEBAKPEAGK@Z ?GetOSVersionInfo@LoggingSession@@SAAEBU_OSVERSIONINFOEXW@@XZ ?GetRunningEtwInternalVersion@KernelLoggingSession@@SAKXZ ?GetRunningOSMaximumStackWalkedKernelEventTypes@KernelLoggingSession@@SAKXZ ?GetTraceFlags@KernelLoggingSession@@UEBAKPEAGK@Z ?GetTraceFlags@LoggingSession@@UEBAKPEAGK@Z ?InitTraceProperties@KernelLoggingSession@@MEBAPEAU_EVENT_TRACE_PROPERTIES_V2@@XZ ?InitTraceProperties@LoggingSession@@MEBAPEAU_EVENT_TRACE_PROPERTIES_V2@@XZ ?IsProviderAvailable@LoggingSession@@UEBAHAEBU_GUID@@@Z ?IsProviderAvailable@LoggingSession@@UEBAHPEBG@Z ?IsSpinlockSupported@LoggingSession@@SA_NXZ ?IsWin8AndUp@LoggingSession@@SA_NXZ ?LogMark@LoggingSession@@UEAAKEKEEGPEBG_N@Z ?LogMark@LoggingSession@@UEAAKEPEAU_PERFINFO_MARK_EVENT@@_K_N@Z ?QueryPerfTrackProviderInfos@LoggingSession@@SAJPEAKPEAPEBUCProviderInfo@@@Z ?QueryProviderInfos@LoggingSession@@SAJPEAKPEAPEBUCProviderInfo@@@Z ?QueryStackWalkingFlags@CKernelStackWalkingFlagTranslator@@SAJPEAKPEAPEBUCStackWalkingFlag@1@@Z ?QueryStackWalkingFlags@CKernelStackWalkingFlagTranslator@@SAJQEAUCStackWalkingFlag@1@AEAKH@Z ?QueryUTCProviderInfos@LoggingSession@@SAJPEAKPEAPEBUCProviderInfo@@@Z ?RunningOSUsesVistaStyleKernelEventStackwalkingControlDescriptors@KernelLoggingSession@@SAHXZ ?SessionProperties@LoggingSession@@QEAAAEBUSESSION_PROPERTIES@@_N@Z ?SetLastBranchRecordConfiguration@KernelLoggingSession@@QEAAXQEAU_LBR_SETTINGS@@@Z ?SetLogFileName@LoggingSession@@UEAAHPEBG@Z ?SetMark@KernelLoggingSession@@SAHPEBGH@Z ?SetPmcConfiguration@KernelLoggingSession@@QEAAXPEBU_PMC_SETTINGS@@_N@Z ?SetPoolTagFilter@KernelLoggingSession@@UEAAJPEBG@Z ?SetPoolTagFilter@LoggingSession@@UEAAJPEBG@Z ?SetSessionName@KernelLoggingSession@@UEAAHPEBG@Z ?SetSessionName@LoggingSession@@UEAAHPEBG@Z ?SetStackCaching@KernelLoggingSession@@QEAAXKK@Z ?SetTraceFlags@LoggingSession@@UEAAHPEBG@Z ?StartTracing@KernelLoggingSession@@UEAAKXZ ?StartTracing@LoggingSession@@UEAAKXZ ?StopTracing@KernelLoggingSession@@UEAAKXZ ?StopTracing@LoggingSession@@UEAAKXZ ?TranslateFlagString@CKernelStackWalkingFlagTranslator@@SAJQEAUCStackWalkingFlag@1@AEAKPEBGPEAUCParsingErrorInformation@1@@Z ?UpdateTracing@KernelLoggingSession@@UEAAKXZ ?UpdateTracing@LoggingSession@@UEAAKXZ ?pSetTraceFlags@LoggingSession@@MEAAHPEBG@Z

Name

.text

Size

176KB

Virtual Size

176KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

48KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

80B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

37b5bb600cef2e37a1dbdef9fc7904b435aafa201fa2fa5bc00bb14e30f4f7dd

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

kernel32

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

generic