c8cb4b42f6c35e6d167c606f39c7ea4c88414a612dd220e53740037d5ac14137

Sharing

Copy URL Twitter E-mail

General

Target
c8cb4b42f6c35e6d167c606f39c7ea4c88414a612dd220e53740037d5ac14137
Size 13.1MB
Sample260825-lskdrazdqf
SHA256 c8cb4b42f6c35e6d167c606f39c7ea4c88414a612dd220e53740037d5ac14137
MD5 8ccbb2818d05168491f2d08b588e5e1c
SHA1 a8981641994950fb4e5c61aa6c71a984dbead865
SHA512 53c4572c9f99861158fcaef6571c3d5520ac98a332406c0bf70e84db853c237a0c8efedfeba6ad193d337ffa830d50d4554647932f6e98791d3bdd79c6c5d6a0
SSDEEP 49152:TMxI2zNv6BpCz33s4sL0UENho72XN7qzk7YDEzui4BB97KqnjN2LniIpXjK6RqAS:TLNqSxzQQcuwP3dQ
TLSH
T16DD6506CB5B47CCEFEAAC139BF431CAF2D137D08621BD22362A426671F324641F99651
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c8cb4b42f6c35e6d167c606f39c7ea4c88414a612dd220e53740037d5ac14137

File Explorer

c8cb4b42f6c35e6d167c606f39c7ea4c88414a612dd220e53740037d5ac14137

.exe 13.1MB

c8cb4b42f6c35e6d167c606f39c7ea4c88414a612dd220e53740037d5ac14137

IMPHASH 5ed5342f08c9394ac439770b98e86ac1
SHA256 c8cb4b42f6c35e6d167c606f39c7ea4c88414a612dd220e53740037d5ac14137
MD5 8ccbb2818d05168491f2d08b588e5e1c
SHA1 a8981641994950fb4e5c61aa6c71a984dbead865
SHA512 53c4572c9f99861158fcaef6571c3d5520ac98a332406c0bf70e84db853c237a0c8efedfeba6ad193d337ffa830d50d4554647932f6e98791d3bdd79c6c5d6a0
SSDEEP 49152:TMxI2zNv6BpCz33s4sL0UENho72XN7qzk7YDEzui4BB97KqnjN2LniIpXjK6RqAS:TLNqSxzQQcuwP3dQ
TLSH
T16DD6506CB5B47CCEFEAAC139BF431CAF2D137D08621BD22362A426671F324641F99651
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7941680

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

demo.pdb

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv

api-ms-win-crt-private-l1-1-0

memchr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _cexit _configure_narrow_argv _crt_atexit _errno _exit _initialize_narrow_environment _initterm _initterm_e _seh_filter_exe _set_app_type _set_invalid_parameter_handler abort exit signal strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf _close _dup _dup2 _fileno _fseeki64 _ftelli64 _get_osfhandle _isatty _setmode _wfopen clearerr fclose ferror fflush fgetc fgets fputc fread fwrite setvbuf ungetc

api-ms-win-crt-string-l1-1-0

strcmp strncmp wcslen

kernel32

CreateProcessW DeleteCriticalSection EnterCriticalSection GetLastError GetProcAddress InitializeCriticalSection LeaveCriticalSection LoadLibraryA RtlLookupFunctionEntry RtlVirtualUnwind SetUnhandledExceptionFilter Sleep TlsGetValue VirtualAlloc VirtualFree VirtualProtect VirtualQuery

api-ms-win-crt-environment-l1-1-0

__p__environ

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-math-l1-1-0

__setusermatherr

ntdll

LdrFindEntryForAddress LdrGetProcedureAddress LdrLoadDll LdrRegisterDllNotification LdrUnloadDll NtAlertThread NtAlertThreadByThreadId NtAllocateVirtualMemory NtCancelIoFileEx NtCancelSynchronousIoFile NtClose NtCreateFile NtCreateNamedPipeFile NtCreateSection NtCreateThreadEx NtDelayExecution NtDeviceIoControlFile NtFlushBuffersFile NtFreeVirtualMemory NtFsControlFile NtLockFile NtMapViewOfSection NtOpenFile NtOpenThread NtQueryAttributesFile NtQueryDirectoryFile NtQueryInformationFile NtQueryInformationProcess NtQueryInformationThread NtQueryObject NtQuerySystemInformation NtQueryVolumeInformationFile NtReadFile NtResumeThread NtSetInformationFile NtTerminateProcess NtUnlockFile NtUnmapViewOfSection NtWaitForAlertByThreadId NtWaitForSingleObject NtWriteFile RtlActivateActivationContextEx RtlAllocateHeap RtlEnterCriticalSection RtlEqualUnicodeString RtlExitUserProcess RtlFreeHeap RtlGetActiveActivationContext RtlGetCurrentDirectory_U RtlGetFullPathName_U RtlGetSystemTimePrecise RtlLeaveCriticalSection RtlQueryPerformanceCounter RtlQueryPerformanceFrequency RtlReleaseActivationContext RtlReportSilentProcessExit RtlSetCurrentDirectory_U RtlUpcaseUnicodeChar

api-ms-win-crt-convert-l1-1-0

mbrtowc wcrtomb

Name

.text

Size

8.0MB

Virtual Size

8.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

867KB

Virtual Size

867KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

61B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3.7MB

Virtual Size

3.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

63KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

552B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

483KB

Virtual Size

482KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

c8cb4b42f6c35e6d167c606f39c7ea4c88414a612dd220e53740037d5ac14137

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

kernel32

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

ntdll

api-ms-win-crt-convert-l1-1-0

generic