d75d1bd039ae5b73a3bff3f859d37600188b406beb4be6053d0105250f69f138

Sharing

Copy URL Twitter E-mail

General

Target
d75d1bd039ae5b73a3bff3f859d37600188b406beb4be6053d0105250f69f138
Size 358KB
Sample260825-2c2wvser4x
SHA256 d75d1bd039ae5b73a3bff3f859d37600188b406beb4be6053d0105250f69f138
MD5 bc5cedccbae742d8376e4370034f4652
SHA1 8556ce3c2bf8dadbe5a1a1f4e9896c0ba5f3b85b
SHA512 f94f3dee847b3c007f59cc99cfc73be461fcc07057c7dbfffaae26517af9ca825c1edb0c47578b4dc9e5064229fa04557eaede4464c7a4ea9d2222bf300cc554
SSDEEP 3072:EbWlUylopz+hYT7EcTQBbBr409tUS2YBCFnOBloA3BYdibBFKXbB:sEHlUnEtBnH2Rn3ACi2X
TLSH
T1AC74B05263FE0148F6F77A7859B591649A377C92A93DC68D059C204E4BF3E809E30BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d75d1bd039ae5b73a3bff3f859d37600188b406beb4be6053d0105250f69f138

File Explorer

d75d1bd039ae5b73a3bff3f859d37600188b406beb4be6053d0105250f69f138

.exe 358KB

d75d1bd039ae5b73a3bff3f859d37600188b406beb4be6053d0105250f69f138

IMPHASH 367ff3cd894122da161b2fd2870dcb8e
SHA256 d75d1bd039ae5b73a3bff3f859d37600188b406beb4be6053d0105250f69f138
MD5 bc5cedccbae742d8376e4370034f4652
SHA1 8556ce3c2bf8dadbe5a1a1f4e9896c0ba5f3b85b
SHA512 f94f3dee847b3c007f59cc99cfc73be461fcc07057c7dbfffaae26517af9ca825c1edb0c47578b4dc9e5064229fa04557eaede4464c7a4ea9d2222bf300cc554
SSDEEP 3072:EbWlUylopz+hYT7EcTQBbBr409tUS2YBCFnOBloA3BYdibBFKXbB:sEHlUnEtBnH2Rn3ACi2X
TLSH
T1AC74B05263FE0148F6F77A7859B591649A377C92A93DC68D059C204E4BF3E809E30BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

49760

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

R:\buildbot\output-VS-amd64\msvc_pdb\net.pdb

advapi32

ControlService OpenSCManagerW OpenServiceW EnumServicesStatusW StartServiceW CloseServiceHandle

netapi32

NetGroupDel NetGroupSetInfo NetGroupGetInfo NetGroupEnum NetGroupAddUser NetGroupAdd NetServerTransportEnum NetServerSetInfo NetServerGetInfo NetGroupDelUser NetUserModalsGet NetUserModalsSet NetApiBufferFree NetUserAdd NetUserDel NetWkstaGetInfo NetGroupGetUsers NetLocalGroupAdd NetLocalGroupEnum NetLocalGroupGetInfo NetLocalGroupDel NetLocalGroupGetMembers NetLocalGroupAddMembers NetLocalGroupDelMembers NetSessionDel NetSessionEnum NetShareAdd NetShareDel NetShareEnum NetShareGetInfo NetStatisticsGet NetUserEnum NetUserGetInfo NetUserSetInfo NetUserGetGroups NetUserGetLocalGroups NetWkstaUserGetInfo NetWkstaTransportEnum NetLocalGroupSetInfo

mpr

WNetUseConnectionW WNetOpenEnumW WNetEnumResourceW WNetCloseEnum WNetCancelConnection2W

msvcrt

printf wcschr towupper iswctype wcsstr rand srand wcscmp wcspbrk __C_specific_handler memcpy swprintf wcscpy _wcsnicmp wcstoul _wcsicmp wcscat memset _vsnwprintf wcsncmp wcslen qsort wcstol _wcslwr __lconv_init signal _wcmdln __winitenv _initterm _fpreset _cexit exit __set_app_type malloc __wgetmainargs _amsg_exit __setusermatherr wcsncpy

kernel32

DeleteCriticalSection GetModuleHandleA QueryPerformanceCounter GetCurrentThreadId GetCurrentProcessId Sleep SetUnhandledExceptionFilter GetStartupInfoW GetProcAddress GetFileType WideCharToMultiByte WriteConsoleW GetConsoleOutputCP WriteFile SetLastError LeaveCriticalSection EnterCriticalSection InitializeCriticalSection GetLocaleInfoW LocalFileTimeToFileTime GetTickCount GetSystemTimeAsFileTime SystemTimeToFileTime GetTimeZoneInformation GetTimeFormatW GetDateFormatW FileTimeToLocalFileTime FileTimeToSystemTime GetLastError __chkstk SetConsoleMode GetConsoleMode MultiByteToWideChar ReadFile LocalFree LoadLibraryW HeapFree HeapAlloc GetSystemDirectoryW GetStdHandle GetProcessHeap GetModuleHandleW FreeLibrary FormatMessageW TlsGetValue

ntdll

RtlSecondsSince1970ToTime RtlFreeHeap RtlAllocateHeap RtlGetNtProductType RtlTimeToSecondsSince1970

Sharing

General

Malware Config

Signatures

File Explorer

d75d1bd039ae5b73a3bff3f859d37600188b406beb4be6053d0105250f69f138

advapi32

netapi32

mpr

msvcrt

kernel32

ntdll

generic