2ff2661b97dde7eec11d9f79d221c4df9ec534aa674907e2d2d8d4e034f09c93

Sharing

Copy URL Twitter E-mail

General

Target
2ff2661b97dde7eec11d9f79d221c4df9ec534aa674907e2d2d8d4e034f09c93
Size 403KB
Sample260823-req72astex
SHA256 2ff2661b97dde7eec11d9f79d221c4df9ec534aa674907e2d2d8d4e034f09c93
MD5 6b0595b823741f33cd4709e0042b5d51
SHA1 e7c0edc8398d1b25d52a16fd32103d7f9995f55a
SHA512 cad2d1a646c60037c9a95372fada3ecf350af2f5e3851d372ef8dd01786b16edbb99f5c0d7e6b2496eccfd4ccea592502dd68fb0e88c1f8d5a0f06ab255ef8ae
SSDEEP 6144:BRUZiGTqbJgrt8DAKWLiRAcOUCmFDTTW1mT5bl41Ltc:rU9TqCW0KWLiRAcjrTmtc
TLSH
T13F94392AFB5554D9D0BFC07882878F62BD20709C0B396BF7469582392E26DF4AE3D750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2ff2661b97dde7eec11d9f79d221c4df9ec534aa674907e2d2d8d4e034f09c93

File Explorer

2ff2661b97dde7eec11d9f79d221c4df9ec534aa674907e2d2d8d4e034f09c93

.exe 403KB

2ff2661b97dde7eec11d9f79d221c4df9ec534aa674907e2d2d8d4e034f09c93

IMPHASH 2015ffc4d7535bd173bc0970f4fd193f
SHA256 2ff2661b97dde7eec11d9f79d221c4df9ec534aa674907e2d2d8d4e034f09c93
MD5 6b0595b823741f33cd4709e0042b5d51
SHA1 e7c0edc8398d1b25d52a16fd32103d7f9995f55a
SHA512 cad2d1a646c60037c9a95372fada3ecf350af2f5e3851d372ef8dd01786b16edbb99f5c0d7e6b2496eccfd4ccea592502dd68fb0e88c1f8d5a0f06ab255ef8ae
SSDEEP 6144:BRUZiGTqbJgrt8DAKWLiRAcOUCmFDTTW1mT5bl41Ltc:rU9TqCW0KWLiRAcjrTmtc
TLSH
T13F94392AFB5554D9D0BFC07882878F62BD20709C0B396BF7469582392E26DF4AE3D750
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

280860

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

草稿2.pdb

kernel32

GetProcessHeap VirtualQueryEx HeapFree HeapAlloc GetCurrentThreadId Process32NextW Process32FirstW CreateToolhelp32Snapshot LocalFree GetSystemTimeAsFileTime InitializeSListHead CloseHandle ReadProcessMemory GetProcessIoCounters GetCurrentProcessId GetProcessTimes GetSystemTimes GetProcAddress OpenProcess GlobalMemoryStatusEx K32GetPerformanceInfo IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter CreateMutexA FormatMessageW GetLastError GetSystemInfo GetLogicalProcessorInformation VirtualAlloc LoadLibraryA WaitForSingleObjectEx AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread WaitForSingleObject QueryPerformanceCounter RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetLastError GetCurrentDirectoryW GetEnvironmentVariableW GetCurrentProcess WideCharToMultiByte WriteConsoleW MultiByteToWideChar GetConsoleOutputCP GetConsoleMode GetStdHandle QueryPerformanceFrequency GetSystemTimePreciseAsFileTime HeapReAlloc lstrlenW ReleaseMutex GetModuleHandleW GetModuleFileNameW ExitProcess GetModuleHandleA IsProcessorFeaturePresent

powrprof

CallNtPowerInformation

oleaut32

GetErrorInfo

advapi32

GetTokenInformation CopySid IsValidSid GetLengthSid OpenProcessToken

psapi

GetProcessMemoryInfo GetModuleFileNameExW

ntdll

NtWriteFile NtQueryInformationProcess RtlGetVersion RtlNtStatusToDosError

shell32

CommandLineToArgvW

pdh

PdhCollectQueryData PdhAddEnglishCounterW PdhRemoveCounter PdhCloseQuery PdhEnumObjectsW PdhOpenQueryW PdhGetFormattedCounterValue

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

bcryptprimitives

ProcessPrng

vcruntime140

__current_exception_context __current_exception __C_specific_handler _CxxThrowException memcmp memcpy memset __CxxFrameHandler3 memmove

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

api-ms-win-crt-string-l1-1-0

wcslen

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment _get_initial_narrow_environment _register_thread_local_exe_atexit_callback __p___argv _configure_narrow_argv _initterm_e exit _exit _cexit _set_app_type _initterm _initialize_onexit_table _register_onexit_function _seh_filter_exe terminate _crt_atexit __p___argc _c_exit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2ff2661b97dde7eec11d9f79d221c4df9ec534aa674907e2d2d8d4e034f09c93

kernel32

powrprof

oleaut32

advapi32

psapi

ntdll

shell32

pdh

api-ms-win-core-synch-l1-2-0

bcryptprimitives

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic