178f85a9c6a0881f8b2e13efb103cdbe3626e7061c1f787038d3fbb158999b68

Sharing

Copy URL Twitter E-mail

General

Target
178f85a9c6a0881f8b2e13efb103cdbe3626e7061c1f787038d3fbb158999b68
Size 3.3MB
Sample260826-dzrgmsytht
SHA256 178f85a9c6a0881f8b2e13efb103cdbe3626e7061c1f787038d3fbb158999b68
MD5 72082962aea3af2bf6b7487356953c57
SHA1 dd60c886cbeeeb0955de15241a4f8d3ee5e9c81e
SHA512 f660cbda5e719c95b684627824887144c8c7b0f4a1e2269d75bb22ec7f706df36e9ca20bad1e5c341f55f986fb202e4dd5869e1b7161d02e3fdc8191d4cd2c70
SSDEEP 49152:jak5SfdVqzU3isMM7jtAF2Pky8KUFcVWxBSrUIiB/wx89GYIU6iOH:g2xMSkPnTM1B6n+k
TLSH
T115F55A02B79B95FCC59AC474D30A46B36F2174CB0B2278EF80D895383F6AAA45B3D355
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
178f85a9c6a0881f8b2e13efb103cdbe3626e7061c1f787038d3fbb158999b68

File Explorer

178f85a9c6a0881f8b2e13efb103cdbe3626e7061c1f787038d3fbb158999b68

.exe 3.3MB

178f85a9c6a0881f8b2e13efb103cdbe3626e7061c1f787038d3fbb158999b68

IMPHASH 5575e2a67acfbb8aa417473f5321cc9e
SHA256 178f85a9c6a0881f8b2e13efb103cdbe3626e7061c1f787038d3fbb158999b68
MD5 72082962aea3af2bf6b7487356953c57
SHA1 dd60c886cbeeeb0955de15241a4f8d3ee5e9c81e
SHA512 f660cbda5e719c95b684627824887144c8c7b0f4a1e2269d75bb22ec7f706df36e9ca20bad1e5c341f55f986fb202e4dd5869e1b7161d02e3fdc8191d4cd2c70
SSDEEP 49152:jak5SfdVqzU3isMM7jtAF2Pky8KUFcVWxBSrUIiB/wx89GYIU6iOH:g2xMSkPnTM1B6n+k
TLSH
T115F55A02B79B95FCC59AC474D30A46B36F2174CB0B2278EF80D895383F6AAA45B3D355
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2078396

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

NetSvcDiag.pdb

kernel32

CreateToolhelp32Snapshot Process32FirstW Process32NextW GetSystemTimePreciseAsFileTime OpenProcess TerminateProcess QueryFullProcessImageNameW ReadProcessMemory LoadLibraryExW GetProcAddress FreeLibrary GetCurrentProcess SetThreadExecutionState FindNextFileW CreateMutexW SetFileTime GlobalMemoryStatusEx GetTickCount64 GetComputerNameExW GetFileInformationByHandleEx SetFileInformationByHandle SwitchToThread AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentThreadId SetLastError GetCurrentDirectoryW RtlCaptureContext RtlLookupFunctionEntry WaitForSingleObjectEx LoadLibraryA lstrlenW GetCurrentProcessId CreateMutexA ReleaseMutex RtlVirtualUnwind WideCharToMultiByte FormatMessageW GetStdHandle GetConsoleMode GetConsoleOutputCP MultiByteToWideChar GetOverlappedResult FlsAlloc GetModuleHandleExW FlsFree FlsSetValue HeapAlloc IsThreadAFiber GetEnvironmentVariableW SleepEx ReadFileEx WriteFileEx QueryPerformanceFrequency QueryPerformanceCounter SetHandleInformation GetModuleHandleA GetFullPathNameW FindFirstFileExW GetFileInformationByHandle CreateDirectoryW ExitProcess CreateEventW CancelIo ReadFile CompareStringOrdinal GetEnvironmentStringsW FreeEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetFileAttributesW GetModuleFileNameW DuplicateHandle GetTempPathW DeleteFileW CopyFileExW MoveFileExW CreateWaitableTimerExW SetWaitableTimer Sleep IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetExitCodeProcess WaitForMultipleObjects CreateFileW WaitForSingleObject HeapReAlloc GetModuleHandleW CloseHandle FindClose GetLastError CreateThread HeapFree WriteConsoleW GetProcessHeap

user32

GetWindow IsWindowVisible SetForegroundWindow SendMessageW ShowWindow SetProcessDPIAware DestroyWindow PostMessageW DefWindowProcW GetWindowThreadProcessId GetMonitorInfoW GetLastInputInfo IsWindow GetDC ReleaseDC CreateWindowExW SetWindowDisplayAffinity PostQuitMessage SendInput BlockInput GetWindowTextW GetAsyncKeyState SetCursorPos EnumDisplayMonitors EnumWindows GetForegroundWindow RegisterClassW DispatchMessageW TranslateMessage GetMessageW ShowCursor

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

advapi32

RegCreateKeyExW OpenProcessToken GetTokenInformation RegOpenKeyExW RegEnumValueW RegQueryValueExW RegDeleteValueW RegCloseKey RegGetValueW SystemFunction036 GetUserNameW RegSetValueExW

ws2_32

WSASend WSARecv WSADuplicateSocketW recv WSASocketW WSACleanup send select connect ioctlsocket getsockopt getsockname WSAGetLastError setsockopt WSAStartup closesocket getaddrinfo shutdown freeaddrinfo getpeername

gdi32

DeleteObject GetStockObject DeleteDC GetDIBits GetDeviceCaps BitBlt SelectObject CreateCompatibleDC CreateCompatibleBitmap

ntdll

NtSuspendProcess RtlNtStatusToDosError NtQueryInformationProcess NtResumeProcess NtCreateNamedPipeFile NtOpenFile NtWriteFile NtReadFile

shell32

ShellExecuteW

bcrypt

BCryptGenRandom

vcruntime140

__current_exception_context __current_exception __C_specific_handler memset memcmp memmove __CxxFrameHandler3 memcpy _CxxThrowException

api-ms-win-crt-math-l1-1-0

roundf __setusermatherr

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-heap-l1-1-0

free malloc _set_new_mode

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _initialize_onexit_table _crt_atexit _seh_filter_exe terminate _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv __p___argc _set_app_type _exit exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

178f85a9c6a0881f8b2e13efb103cdbe3626e7061c1f787038d3fbb158999b68

kernel32

user32

bcryptprimitives

api-ms-win-core-synch-l1-2-0

advapi32

ws2_32

gdi32

ntdll

shell32

bcrypt

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic