1a8d00805287a55e52ca4f8dc7faf25781564825a99149a7af5be3b3a29a6e7b

Sharing

Copy URL Twitter E-mail

General

Target
1a8d00805287a55e52ca4f8dc7faf25781564825a99149a7af5be3b3a29a6e7b
Size 3.2MB
Sample260825-2mtcgazdnb
SHA256 1a8d00805287a55e52ca4f8dc7faf25781564825a99149a7af5be3b3a29a6e7b
MD5 ba985e2d83321818fbf4b0aee96bcc61
SHA1 eed7d066c437a13c21fddd0b56d23c4feb392342
SHA512 03fa078d1417ed7051393ac13648311e6a79c7fe9ec36f293f983aea42c3c7f8c7b0f63c321c19f3f6b4b8c6bdb7de781cad33b295853afdeef55f01b7c6ca4c
SSDEEP 49152:Iubp9PgWmrK5uDeMjL7I18/pEb+fv4Kgk9DBIWVdcA12s5CRRwani14F568:0FbppSKai14P68
TLSH
T1F7F54A026F5A88E9C0CDC834C34B8A934E2274DB0A36B9AF45D515293F7EAF55F2D358
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1a8d00805287a55e52ca4f8dc7faf25781564825a99149a7af5be3b3a29a6e7b

File Explorer

1a8d00805287a55e52ca4f8dc7faf25781564825a99149a7af5be3b3a29a6e7b

.exe 3.2MB

1a8d00805287a55e52ca4f8dc7faf25781564825a99149a7af5be3b3a29a6e7b

IMPHASH 85ec1fedf99de42c6e512c1bf71dcbc8
SHA256 1a8d00805287a55e52ca4f8dc7faf25781564825a99149a7af5be3b3a29a6e7b
MD5 ba985e2d83321818fbf4b0aee96bcc61
SHA1 eed7d066c437a13c21fddd0b56d23c4feb392342
SHA512 03fa078d1417ed7051393ac13648311e6a79c7fe9ec36f293f983aea42c3c7f8c7b0f63c321c19f3f6b4b8c6bdb7de781cad33b295853afdeef55f01b7c6ca4c
SSDEEP 49152:Iubp9PgWmrK5uDeMjL7I18/pEb+fv4Kgk9DBIWVdcA12s5CRRwani14F568:0FbppSKai14P68
TLSH
T1F7F54A026F5A88E9C0CDC834C34B8A934E2274DB0A36B9AF45D515293F7EAF55F2D358
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2021392

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

AMD_HUB_Service.pdb

kernel32

SetConsoleMode GetConsoleScreenBufferInfo SetConsoleTextAttribute HeapReAlloc SwitchToThread GetOEMCP GetACP IsValidCodePage GetFinalPathNameByHandleW GetQueuedCompletionStatusEx PostQueuedCompletionStatus ReadFile GetOverlappedResult CreateIoCompletionPort SetFileCompletionNotificationModes WriteFile CancelIoEx LoadLibraryExA GetCurrentThread LCMapStringW CompareStringW SetThreadStackGuarantee SetFileInformationByHandle DeleteFileW UnhandledExceptionFilter IsDebuggerPresent GetCommandLineA DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetCPInfo SetEnvironmentVariableW RaiseException RtlPcToFileHeader CreateFileW SetFilePointerEx GetProcessId RtlUnwindEx GetSystemInfo SetLastError SetUnhandledExceptionFilter GetModuleHandleW CopyFileExW InitializeSListHead EncodePointer GetCurrentThreadId WaitForSingleObjectEx LoadLibraryA GetCurrentProcessId CreateMutexA ReleaseMutex GetStdHandle GetConsoleOutputCP WriteConsoleW FlsAlloc GetModuleHandleExW FlsFree FlsSetValue IsThreadAFiber GetLastError SleepEx ReadFileEx WriteFileEx HeapSize GetFileSizeEx SetHandleInformation GetModuleHandleA GetFullPathNameW SetFileTime FindFirstFileExW FindClose GetFileInformationByHandle GetFileInformationByHandleEx GetSystemTimePreciseAsFileTime CreateDirectoryW ExitProcess GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW GetModuleFileNameW DuplicateHandle CreateThread FlushFileBuffers GetTempPathW CreateMutexW GetFileType SetStdHandle FindNextFileW LoadLibraryExW VirtualProtect LoadLibraryW FreeLibrary Sleep WaitForSingleObject IsProcessorFeaturePresent SetWaitableTimer TerminateProcess FlsGetValue CreateWaitableTimerExW GetStartupInfoW GetSystemTimeAsFileTime GetConsoleMode GetProcAddress GetCurrentProcess GetTimeZoneInformationForYear GetComputerNameExW GetStringTypeW HeapAlloc HeapFree FreeEnvironmentStringsW GetEnvironmentStringsW CompareStringOrdinal QueryPerformanceCounter FormatMessageW QueryPerformanceFrequency GetEnvironmentVariableW MultiByteToWideChar GetProcessHeap CloseHandle GetCommandLineW AddVectoredExceptionHandler RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetCurrentDirectoryW lstrlenW WideCharToMultiByte

advapi32

RegOpenKeyExW RegSetValueExW RegCloseKey RegGetValueW RegQueryValueExW

crypt32

CertFreeCertificateChain CertVerifyCertificateChainPolicy CertGetCertificateChain CertDuplicateCertificateContext CertDuplicateStore CertOpenStore CertEnumCertificatesInStore CertFreeCertificateContext CertDuplicateCertificateChain CertCloseStore CertAddCertificateContextToStore

ntdll

NtWriteFile RtlNtStatusToDosError NtCreateFile NtCancelIoFileEx NtOpenFile NtDeviceIoControlFile NtCreateNamedPipeFile NtReadFile

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

ws2_32

closesocket WSASend WSASocketW recv ioctlsocket connect getsockopt bind setsockopt WSAIoctl WSACleanup getaddrinfo freeaddrinfo getsockname WSAGetLastError getpeername send shutdown WSAStartup

secur32

AcceptSecurityContext FreeContextBuffer DecryptMessage InitializeSecurityContextW FreeCredentialsHandle QueryContextAttributesW ApplyControlToken DeleteSecurityContext EncryptMessage AcquireCredentialsHandleA

bcryptprimitives

ProcessPrng

oleaut32

GetErrorInfo SysFreeString SysStringLen

mfplat

MFStartup MFShutdown MFCreateAttributes MFCreateSample

ole32

CoInitializeEx CoUninitialize

mfreadwrite

MFCreateSourceReaderFromMediaSource

mf

MFEnumDeviceSources

user32

GetDesktopWindow ReleaseDC EnumDisplayMonitors GetMonitorInfoW GetWindowDC EnumDisplaySettingsW

gdi32

DeleteObject DeleteDC GetDeviceCaps CreateCompatibleDC GetDIBits BitBlt SelectObject CreateDCW CreateCompatibleBitmap

Name

.text

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

121KB

Virtual Size

121KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

1a8d00805287a55e52ca4f8dc7faf25781564825a99149a7af5be3b3a29a6e7b

kernel32

advapi32

crypt32

ntdll

api-ms-win-core-synch-l1-2-0

ws2_32

secur32

bcryptprimitives

oleaut32

mfplat

ole32

mfreadwrite

mf

user32

gdi32

generic