69868cc43e0572002644ed48a708c5a9b698c96af7a0e496e420df5b92e733df

Sharing

Copy URL Twitter E-mail

General

Target
69868cc43e0572002644ed48a708c5a9b698c96af7a0e496e420df5b92e733df
Size 7.6MB
Sample260824-mn5dssda48
SHA256 69868cc43e0572002644ed48a708c5a9b698c96af7a0e496e420df5b92e733df
MD5 5fde7158cdc4be4c9780c1a9d971026c
SHA1 8965c7e42b333b063a5d6c66eb9aacca847b9632
SHA512 1a945e876e7f0da5eaec4d71f854f962ecb54ae03fa9f07b3c6d15545232c7159df3b47e8f5dce919f702e0df8840e5a250125701eff01169dd764590be96667
SSDEEP 196608:M6f6cz97IkrUBP2q9gX65l0VgzG/t1SoblAnvIYhlIaFIE5IZJI:M6S8VIVgqYgGt1fCnjXFIE58
TLSH
T1748623C89C65DEA9BD7EA23186064712AF8833CC629C317B4025FE2137D4AD3BD5B54E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
69868cc43e0572002644ed48a708c5a9b698c96af7a0e496e420df5b92e733df

File Explorer

69868cc43e0572002644ed48a708c5a9b698c96af7a0e496e420df5b92e733df

.exe 7.6MB

69868cc43e0572002644ed48a708c5a9b698c96af7a0e496e420df5b92e733df

IMPHASH 0dc3828526c932d9c36dc6b20d4e13ed
SHA256 69868cc43e0572002644ed48a708c5a9b698c96af7a0e496e420df5b92e733df
MD5 5fde7158cdc4be4c9780c1a9d971026c
SHA1 8965c7e42b333b063a5d6c66eb9aacca847b9632
SHA512 1a945e876e7f0da5eaec4d71f854f962ecb54ae03fa9f07b3c6d15545232c7159df3b47e8f5dce919f702e0df8840e5a250125701eff01169dd764590be96667
SSDEEP 196608:M6f6cz97IkrUBP2q9gX65l0VgzG/t1SoblAnvIYhlIaFIE5IZJI:M6S8VIVgqYgGt1fCnjXFIE58
TLSH
T1748623C89C65DEA9BD7EA23186064712AF8833CC629C317B4025FE2137D4AD3BD5B54E
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

148344

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\Users\D\source\repos\gH\x64\Release\qBz.pdb

kernel32

GetVolumeInformationByHandleW GetDriveTypeW RtlLookupFunctionEntry RtlVirtualUnwind GetVolumePathNameA SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent UnhandledExceptionFilter QueryDosDeviceW GetVolumePathNamesForVolumeNameW FindVolumeClose FindNextVolumeA GetLogicalDriveStringsA FindNextVolumeMountPointW GetLogicalDriveStringsW GetVolumePathNamesForVolumeNameA FindNextVolumeMountPointA GetVolumeInformationA GetVolumePathNameW FindFirstVolumeA QueryDosDeviceA GetDriveTypeA GetModuleHandleW GetStartupInfoW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId GetLogicalDrives QueryPerformanceCounter GetVolumeInformationW FindNextVolumeW RtlCaptureContext

user32

GetWindowTextLengthW GetWindow FindWindowExW IsWindowVisible EnumChildWindows GetClassNameA FindWindowExA GetForegroundWindow EnumWindows FindWindowW GetDesktopWindow SetParent EnumThreadWindows GetClassNameW GetWindowTextW SetForegroundWindow FindWindowA GetParent GetWindowTextLengthA

gdi32

CreateCompatibleBitmap CreateFontA CloseMetaFile CreateBitmapIndirect CreateDCW CreateFontW CreateDIBPatternBrushPt CreateEnhMetaFileW DeleteEnhMetaFile CreatePatternBrush CreatePen CreateFontIndirectW CreateBitmap CreateSolidBrush CreateEnhMetaFileA CreateMetaFileW

advapi32

RegQueryValueExW RegGetValueW RegOpenKeyExW RegSetValueExW RegDeleteKeyExW RegEnumKeyW RegQueryInfoKeyW RegCreateKeyExW RegReplaceKeyW RegSaveKeyW RegEnumKeyExW RegSetKeySecurity RegDeleteValueW

ole32

StringFromCLSID CLSIDFromString StringFromIID IIDFromString CoTaskMemFree CoCreateGuid CoInitialize CoInitializeEx

crypt32

CertDeleteCRLFromStore CertDeleteCertificateFromStore CertCreateCertificateContext CertDuplicateCRLContext CertEnumCRLsInStore CertOpenSystemStoreA CertControlStore CertAddCRLContextToStore CertEnumCertificatesInStore CertDuplicateCertificateContext CertCloseStore CertSetCertificateContextProperty CertFindCertificateInStore CertGetCertificateContextProperty CertGetStoreProperty CertFindCRLInStore

vcruntime140

__current_exception __C_specific_handler memcpy __current_exception_context memset

api-ms-win-crt-heap-l1-1-0

_set_new_mode

api-ms-win-crt-runtime-l1-1-0

_c_exit _cexit _exit exit _initialize_onexit_table _register_onexit_function _crt_atexit terminate _initterm_e _seh_filter_exe _register_thread_local_exe_atexit_callback _initterm _get_narrow_winmain_command_line _configure_narrow_argv _set_app_type _initialize_narrow_environment

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

69868cc43e0572002644ed48a708c5a9b698c96af7a0e496e420df5b92e733df

kernel32

user32

gdi32

advapi32

ole32

crypt32

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic