f0cc715228c1314abef19f20cfe7d993f645ee7c9ed66333543e0c029d8698e0

Sharing

Copy URL Twitter E-mail

General

Target
f0cc715228c1314abef19f20cfe7d993f645ee7c9ed66333543e0c029d8698e0
Size 1.8MB
Sample260823-rerhssstez
SHA256 f0cc715228c1314abef19f20cfe7d993f645ee7c9ed66333543e0c029d8698e0
MD5 6cc278edb12f346496febd6899d60f65
SHA1 4b75dd1f41b6320f2ab51f9517f97f1590bd165e
SHA512 304f58e329e5f0b3451a45a48de5272668c58abce3bcc262222439166afa0936249a54ae660da270e4c4832abd7b55b22ec76aba56af2b9ef8845647c061bbb3
SSDEEP 24576:JDJn93K3XofktwC/f+R+eVkADn3jpJhNZ2qtZYeYeD9fVYujD4ODvIb7btD7XbO:5JnpKHo6wkz9izp1BYeD9fVYuPL0Zr
TLSH
T153956D4BA6A801FCD06BC179C95A5A07D7B67805036197DF16A08EEF6F63BE10F79320
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f0cc715228c1314abef19f20cfe7d993f645ee7c9ed66333543e0c029d8698e0

File Explorer

f0cc715228c1314abef19f20cfe7d993f645ee7c9ed66333543e0c029d8698e0

.exe 1.8MB

f0cc715228c1314abef19f20cfe7d993f645ee7c9ed66333543e0c029d8698e0

IMPHASH 3e392ee4dea4db804fa6118d35a770ea
SHA256 f0cc715228c1314abef19f20cfe7d993f645ee7c9ed66333543e0c029d8698e0
MD5 6cc278edb12f346496febd6899d60f65
SHA1 4b75dd1f41b6320f2ab51f9517f97f1590bd165e
SHA512 304f58e329e5f0b3451a45a48de5272668c58abce3bcc262222439166afa0936249a54ae660da270e4c4832abd7b55b22ec76aba56af2b9ef8845647c061bbb3
SSDEEP 24576:JDJn93K3XofktwC/f+R+eVkADn3jpJhNZ2qtZYeYeD9fVYujD4ODvIb7btD7XbO:5JnpKHo6wkz9izp1BYeD9fVYuPL0Zr
TLSH
T153956D4BA6A801FCD06BC179C95A5A07D7B67805036197DF16A08EEF6F63BE10F79320
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1382768

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\claudeCode\wct\SmsGatewaySystem\bin\Release\x64\wct.pdb

winhttp

WinHttpAddRequestHeaders WinHttpSendRequest WinHttpReceiveResponse WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpReadData WinHttpOpen WinHttpSetTimeouts WinHttpConnect WinHttpQueryHeaders WinHttpCrackUrl WinHttpCloseHandle

dbghelp

MiniDumpWriteDump

mfc140u

ord4083 ord3096 ord8822 ord6342 ord6775 ord5672 ord266 ord265 ord14278 ord12087 ord14225 ord2340 ord12030 ord6505 ord4726 ord14220 ord3270 ord3161 ord6584 ord13199 ord1667 ord1670 ord13986 ord489 ord1121 ord3952 ord6090 ord488 ord1120 ord12464 ord5328 ord5326 ord6309 ord482 ord11644 ord5676 ord2801 ord12033 ord5379 ord6006 ord6007 ord5978 ord9056 ord5604 ord13299 ord1631 ord12926 ord4721 ord8819 ord3745 ord6247 ord8440 ord4724 ord6728 ord4511 ord8416 ord962 ord12933 ord1428 ord12265 ord11772 ord2427 ord2149 ord5675 ord306 ord1034 ord8058 ord287 ord8452 ord290 ord2419 ord316 ord4513 ord12443 ord4510 ord14033 ord14026 ord2904 ord1632 ord311 ord1678 ord4512 ord8410 ord14030 ord8453 ord8454 ord8059 ord4182 ord1508 ord1665 ord8409 ord12442 ord14299 ord2815 ord3089 ord3058 ord4081 ord8439 ord2906 ord3746 ord2344 ord4181 ord13999 ord2479 ord3803 ord6361 ord4086 ord8441 ord13309 ord7780 ord5641 ord7775 ord12706 ord8468 ord1369 ord878 ord8451 ord14027 ord12563 ord2909 ord12111 ord11654 ord1427 ord961 ord7426 ord4499 ord13307 ord13302 ord3097 ord6343 ord5771 ord8823 ord4084 ord7249 ord2903 ord9159 ord13761 ord1420 ord1053 ord6251 ord8817 ord3056 ord4078 ord1503 ord6619 ord1055 ord361 ord2316 ord6588 ord8826 ord3164 ord4095 ord7394 ord8449 ord9109 ord3713 ord13864 ord8507 ord7783 ord12782 ord6596 ord5904 ord8829 ord3167 ord3273 ord4098 ord7893 ord11813 ord11085 ord3308 ord3307 ord3071 ord6000 ord13397 ord2697 ord11855 ord8926 ord3748 ord6287 ord9392 ord3825 ord4722 ord12763 ord13679 ord12967 ord12762 ord6549 ord886 ord12761 ord357 ord2473 ord1086 ord438 ord8731 ord13136 ord4335 ord1501 ord10704 ord7551 ord2475 ord5240 ord3509 ord13767 ord2212 ord2187 ord10163 ord7235 ord3599 ord990 ord1454 ord6303 ord9946 ord5916 ord5582 ord11850 ord3172 ord3278 ord3279 ord3812 ord11806 ord2629 ord5723 ord13354 ord11406 ord6631 ord14217 ord7651 ord14211 ord2967 ord4352 ord9384 ord4360 ord4828 ord4767 ord4752 ord4814 ord4859 ord4782 ord4837 ord4853 ord4794 ord4800 ord4806 ord4788 ord4843 ord4776 ord1755 ord1734 ord1748 ord1722 ord1700 ord11940 ord11944 ord13513 ord3173 ord8947 ord10691 ord6729 ord11902 ord8656 ord14209 ord11625 ord3718 ord11771 ord8830 ord11415 ord11414 ord5451 ord9979 ord9975 ord2907 ord1491 ord286 ord2370 ord5674 ord9977 ord9978 ord9976 ord14360 ord2698 ord7913 ord3209 ord3212 ord13401 ord6002 ord450 ord1489 ord5709 ord285 ord2921 ord8167 ord8084 ord12544 ord8023 ord5183 ord2439 ord12222 ord12223 ord14210 ord7650 ord14216 ord9089 ord4011 ord3949 ord12625 ord7668 ord2011 ord11664 ord11665 ord14088 ord12212 ord7719 ord14288 ord6121 ord14290 ord6123 ord14289 ord6122 ord3731 ord5706 ord11921 ord11929 ord7920 ord10124 ord11933 ord11901 ord12606 ord14194 ord5080 ord2689 ord5363 ord5552 ord9041 ord5339 ord5555 ord5083 ord5229 ord5062 ord7460 ord7461 ord7450 ord5227 ord7922 ord9941 ord8900 ord6614 ord4445 ord1157 ord1424 ord1057 ord1149 ord1158 ord1432 ord1091 ord6250 ord1089 ord1111 ord6313 ord6320 ord3756 ord4656 ord2270 ord3951 ord2178 ord7716 ord1450 ord8901 ord983 ord7393 ord296 ord6258 ord280 ord1033 ord528

kernel32

CreateEventW SetEvent WaitForSingleObject CloseHandle EnterCriticalSection LeaveCriticalSection WaitForMultipleObjects GetFileAttributesW SetUnhandledExceptionFilter IsDebuggerPresent CreateFileW GetCurrentThreadId GetCurrentProcessId GetCurrentProcess ResumeThread GetCommState SetCommState SetCommTimeouts PurgeComm CancelIoEx ResetEvent ReadFile WriteFile GetOverlappedResult Sleep GetTickCount64 AcquireSRWLockExclusive AcquireSRWLockShared ReleaseSRWLockExclusive ReleaseSRWLockShared InitializeSRWLock GetModuleFileNameW CopyFileW AreFileApisANSI TryEnterCriticalSection HeapCreate GetFullPathNameW GetDiskFreeSpaceW OutputDebugStringA LockFile SetFilePointer GetFullPathNameA SetEndOfFile UnlockFileEx GetTempPathW CreateDirectoryW UnmapViewOfFile HeapValidate GetTempPathA FormatMessageW GetDiskFreeSpaceA GetFileAttributesA GetFileAttributesExW OutputDebugStringW FlushViewOfFile CreateFileA LoadLibraryA WaitForSingleObjectEx DeleteFileA DeleteFileW GetSystemInfo LoadLibraryW HeapCompact UnlockFile GetProcAddress LocalFree LockFileEx GetFileSize SystemTimeToFileTime GetModuleHandleW FreeLibrary InitializeCriticalSection HeapFree GetTickCount FlushFileBuffers InitializeCriticalSectionAndSpinCount RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetEnvironmentVariableW MultiByteToWideChar WideCharToMultiByte InitializeSListHead GetStartupInfoW GetSystemTimeAsFileTime QueryPerformanceCounter MapViewOfFile CreateFileMappingW FormatMessageA GetVolumeInformationW GetLocalTime lstrcpynW GlobalUnlock GlobalLock GlobalAlloc GetProcessHeap DeleteCriticalSection HeapDestroy HeapAlloc RaiseException HeapReAlloc GetLastError HeapSize InitializeCriticalSectionEx CreateMutexW GetSystemTime

user32

OpenClipboard SetClipboardData LoadIconW EnableWindow CloseClipboard CopyRect EmptyClipboard GetWindowTextW GetClientRect InvalidateRect IsWindow LoadCursorW GetWindowRect SetTimer InflateRect KillTimer GetSysColor CreatePopupMenu AppendMenuW OffsetRect GetParent IsWindowVisible GetDC ReleaseDC FillRect PostMessageW wsprintfW SendMessageW

gdi32

CreateCompatibleBitmap Ellipse GetTextExtentPoint32W GetObjectW GetTextMetricsW RoundRect CreateFontIndirectW

advapi32

CryptAcquireContextW CryptHashData CryptCreateHash RegSetValueExW RegEnumValueW CryptReleaseContext CryptDestroyHash RegOpenKeyExW RegQueryValueExW RegCloseKey RegCreateKeyExW CryptGetHashParam

shell32

DragQueryFileW DragFinish DragAcceptFiles

comctl32

ImageList_AddMasked InitCommonControlsEx

ole32

CoCreateInstance CoInitializeSecurity CoInitializeEx CoSetProxyBlanket CoUninitialize

oleaut32

VariantClear SysAllocString VariantInit SysFreeString

msvcp140

?_Xlength_error@std@@YAXPEBD@Z ?_Random_device@std@@YAIXZ ?_Xbad_function_call@std@@YAXXZ

iphlpapi

GetAdaptersAddresses

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcmp __std_terminate __std_exception_copy __std_exception_destroy wcschr __C_specific_handler strchr strrchr memset __current_exception __current_exception_context memmove _CxxThrowException memchr memcpy

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc free _msize realloc

api-ms-win-crt-runtime-l1-1-0

_cexit exit _register_thread_local_exe_atexit_callback _initterm_e _initterm _get_wide_winmain_command_line _configure_wide_argv _initialize_onexit_table _register_onexit_function _crt_atexit terminate _initialize_wide_environment _set_app_type _seh_filter_exe _errno _invalid_parameter_noinfo _invalid_parameter_noinfo_noreturn _exit _beginthreadex _endthreadex _c_exit

api-ms-win-crt-convert-l1-1-0

strtod atoi strtoll _wtoi strtoull

api-ms-win-crt-string-l1-1-0

iswxdigit strspn strncmp strcspn iswdigit wcscpy_s isdigit strcmp

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf __p__commode _set_fmode __stdio_common_vswscanf

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv

api-ms-win-crt-math-l1-1-0

_dclass _dsign __setusermatherr

api-ms-win-crt-time-l1-1-0

_time64 _localtime64_s

Sharing

General

Malware Config

Signatures

File Explorer

f0cc715228c1314abef19f20cfe7d993f645ee7c9ed66333543e0c029d8698e0

winhttp

dbghelp

mfc140u

kernel32

user32

gdi32

advapi32

shell32

comctl32

ole32

oleaut32

msvcp140

iphlpapi

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-time-l1-1-0

generic