3476d2d03c9e6e0d1539a9d44d406800b0b5c7c178c8b133e11d8945cede456e

Sharing

Copy URL Twitter E-mail

General

Target
3476d2d03c9e6e0d1539a9d44d406800b0b5c7c178c8b133e11d8945cede456e
Size 1.1MB
Sample260825-e3gmaawgrh
SHA256 3476d2d03c9e6e0d1539a9d44d406800b0b5c7c178c8b133e11d8945cede456e
MD5 dbcc02d992bceffe77a9ba0b4e225a63
SHA1 ce31a623ec16eecf82a8387d6a8f7ffa7f6dc9ea
SHA512 42e138e88c015104dcb70d714d63ecd833bf2e1f676b6d197a1b7d79e9ca28170e8e26700eaa872cd3ff7ac263d4544e0fc161134d4a156b31f41bdd3969d247
SSDEEP 24576:WNo8PUrjpgt9TQrTRIbM68YZwmSJmKh3vjhkChq:WNot3pgt9srKo68YZwnmKVjht
TLSH
T1BC457C56BA66D0FCC46EC0B5C75A5673BF21B84A0B317AEB41D056383E66EE02B3D704
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3476d2d03c9e6e0d1539a9d44d406800b0b5c7c178c8b133e11d8945cede456e

File Explorer

3476d2d03c9e6e0d1539a9d44d406800b0b5c7c178c8b133e11d8945cede456e

.exe 1.1MB

3476d2d03c9e6e0d1539a9d44d406800b0b5c7c178c8b133e11d8945cede456e

IMPHASH 3791962f7492f014d3ff166e0236f167
SHA256 3476d2d03c9e6e0d1539a9d44d406800b0b5c7c178c8b133e11d8945cede456e
MD5 dbcc02d992bceffe77a9ba0b4e225a63
SHA1 ce31a623ec16eecf82a8387d6a8f7ffa7f6dc9ea
SHA512 42e138e88c015104dcb70d714d63ecd833bf2e1f676b6d197a1b7d79e9ca28170e8e26700eaa872cd3ff7ac263d4544e0fc161134d4a156b31f41bdd3969d247
SSDEEP 24576:WNo8PUrjpgt9TQrTRIbM68YZwmSJmKh3vjhkChq:WNot3pgt9srKo68YZwnmKVjht
TLSH
T1BC457C56BA66D0FCC46EC0B5C75A5673BF21B84A0B317AEB41D056383E66EE02B3D704
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1200128

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

SwitchToThread WaitForMultipleObjects GetExitCodeProcess CreateProcessW ReadFile GetOverlappedResult Sleep FindNextFileW CreateEventW GetExitCodeThread CreateIoCompletionPort PostQueuedCompletionStatus CreateDirectoryW GetFileInformationByHandleEx GetFileInformationByHandle FindClose CancelIo SetFilePointerEx GetProcessHeap HeapFree AddVectoredExceptionHandler HeapReAlloc GetFileAttributesW FindFirstFileExW GetCurrentDirectoryW RtlCaptureContext DuplicateHandle LoadLibraryA GetProcAddress lstrlenW SetWaitableTimer WideCharToMultiByte GetStdHandle GetConsoleMode GetConsoleOutputCP MultiByteToWideChar WriteConsoleW HeapAlloc GetEnvironmentVariableW QueryPerformanceFrequency GetModuleHandleW FormatMessageW QueryPerformanceCounter GetModuleHandleA CompareStringOrdinal GetEnvironmentStringsW FreeEnvironmentStringsW GetModuleFileNameW GetSystemDirectoryW GetWindowsDirectoryW CreateFileMappingW GetSystemInfo MapViewOfFile UnmapViewOfFile VirtualProtect GetSystemTimePreciseAsFileTime RtlLookupFunctionEntry SetFileInformationByHandle SetFileTime CreateFileW GetFullPathNameW CreateThread SetHandleInformation CreateWaitableTimerExW DeleteFileW WriteFileEx SleepEx ReadFileEx WaitForSingleObject RtlVirtualUnwind ReleaseMutex CreateMutexA GetCurrentProcessId GetCurrentProcess WaitForSingleObjectEx SetLastError GetCurrentThreadId CloseHandle GetLastError GetQueuedCompletionStatusEx GetSystemTimeAsFileTime InitializeSListHead GetCurrentThread GetTempPathW SetThreadStackGuarantee SetUnhandledExceptionFilter

ntdll

RtlNtStatusToDosError NtDeviceIoControlFile NtCancelIoFileEx NtWriteFile NtReadFile NtOpenFile NtCreateNamedPipeFile

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

ws2_32

recv getaddrinfo connect send ioctlsocket closesocket WSAGetLastError WSASocketW WSACleanup WSAStartup select getsockopt setsockopt freeaddrinfo

bcryptprimitives

ProcessPrng

bcrypt

BCryptGenRandom

advapi32

SystemFunction036

vcruntime140

__current_exception_context __current_exception __CxxFrameHandler3 memcpy __C_specific_handler memset memcmp memmove

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-math-l1-1-0

pow cosf sinf __setusermatherr sin

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment _configure_narrow_argv _initterm _initterm_e __p___argv exit _exit _cexit __p___argc _c_exit _set_app_type _register_thread_local_exe_atexit_callback _seh_filter_exe _get_initial_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit terminate

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Name

.text

Size

789KB

Virtual Size

788KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

341KB

Virtual Size

340KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.gfids

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

3476d2d03c9e6e0d1539a9d44d406800b0b5c7c178c8b133e11d8945cede456e

kernel32

ntdll

api-ms-win-core-synch-l1-2-0

ws2_32

bcryptprimitives

bcrypt

advapi32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic