166295bfdc10f3ef5d07c9eef2cb6c24ab3e9f114baa4b11ae6f66fd9a5a627e

General

Target
166295bfdc10f3ef5d07c9eef2cb6c24ab3e9f114baa4b11ae6f66fd9a5a627e
Size 317KB
Sample260826-e227layxbx
SHA256 166295bfdc10f3ef5d07c9eef2cb6c24ab3e9f114baa4b11ae6f66fd9a5a627e
MD5 fde971ff8ae719839eec5d6b4f121327
SHA1 42282ba30cd18bde043065256f47c4f716351b2a
SHA512 80ffbc32a8e537e02a2cc27984f277a6ea0919675e1f73c87385675d5cccb2b9f861dfbccfdcef0a1e8c2aaebe640c76fc90e95a4e394bfa2a32bba35b455176
SSDEEP 6144:Dc/IyJ/LolCrWWc4PWxteku2ffbHEnqB6yWWD:EpooaWEMku27EnqB6yW
TLSH
T1B864F51366CC7DB6D5321932273283D1E7AFFC618E61C94E12E8592D9E3C583B6247E2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
166295bfdc10f3ef5d07c9eef2cb6c24ab3e9f114baa4b11ae6f66fd9a5a627e

File Explorer

166295bfdc10f3ef5d07c9eef2cb6c24ab3e9f114baa4b11ae6f66fd9a5a627e

.exe 317KB

166295bfdc10f3ef5d07c9eef2cb6c24ab3e9f114baa4b11ae6f66fd9a5a627e

IMPHASH 6b272a7c8ea8ae11335df81bad305cff
SHA256 166295bfdc10f3ef5d07c9eef2cb6c24ab3e9f114baa4b11ae6f66fd9a5a627e
MD5 fde971ff8ae719839eec5d6b4f121327
SHA1 42282ba30cd18bde043065256f47c4f716351b2a
SHA512 80ffbc32a8e537e02a2cc27984f277a6ea0919675e1f73c87385675d5cccb2b9f861dfbccfdcef0a1e8c2aaebe640c76fc90e95a4e394bfa2a32bba35b455176
SSDEEP 6144:Dc/IyJ/LolCrWWc4PWxteku2ffbHEnqB6yWWD:EpooaWEMku27EnqB6yW
TLSH
T1B864F51366CC7DB6D5321932273283D1E7AFFC618E61C94E12E8592D9E3C583B6247E2
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

76780

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\a\_work\1\s\binaries\Win32\Release\vsjitdebugger.pdb

kernel32

RaiseException OpenEventW CreateToolhelp32Snapshot Module32FirstW Module32NextW GetCommandLineW SetErrorMode HeapSetInformation AddVectoredExceptionHandler IsDebuggerPresent SetUnhandledExceptionFilter GetExitCodeProcess DuplicateHandle ReadFile SetFilePointer OpenFileMappingW ConvertDefaultLocale GetThreadUILanguage QueryFullProcessImageNameW SetEnvironmentVariableW GetEnvironmentVariableW MultiByteToWideChar FreeLibrary lstrcmpiW GetPrivateProfileStringW CreateEventExW IsWow64Process UnhandledExceptionFilter IsProcessorFeaturePresent QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead RtlUnwind InterlockedPushEntrySList EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW GetStdHandle WriteFile GetCurrentThread GetFileType FindClose FindFirstFileExW FindNextFileW LeaveCriticalSection GetACP GetOEMCP GetCPInfo GetCommandLineA WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW OutputDebugStringW SetStdHandle GetStringTypeW SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode WriteConsoleW EnterCriticalSection SetLastError OpenProcess GetTickCount Sleep GetCurrentProcessId FindResourceW LoadResource FindResourceExW CreateThread LockResource SetEvent GetExitCodeThread QueueUserWorkItem GetCurrentProcess SizeofResource LoadLibraryExW LoadLibraryW OpenThread GetThreadContext DebugSetProcessKillOnExit MapViewOfFile CreateFileMappingW GetModuleHandleW CreateProcessW GetProcessHeap ReadProcessMemory DeleteCriticalSection GetProcAddress HeapDestroy DecodePointer HeapAlloc CloseHandle HeapReAlloc GetLastError GetFileInformationByHandle CreateEventW HeapSize UnmapViewOfFile GetCurrentThreadId InterlockedPopEntrySList FlushInstructionCache VirtualAlloc VirtualFree LoadLibraryExA GetSystemInfo VirtualProtect VirtualQuery FormatMessageW LocalFree FormatMessageA GetThreadLocale GetVersion GlobalAlloc GlobalFree GlobalLock GlobalUnlock GetModuleHandleA CheckRemoteDebuggerPresent ReleaseMutex OpenMutexW ContinueDebugEvent ResumeThread GetSystemDirectoryW SuspendThread DebugActiveProcessStop GetFileAttributesW CreateFileW WaitForSingleObject InitializeCriticalSectionEx WaitForMultipleObjects GetModuleFileNameW TerminateProcess WaitForDebugEvent HeapFree WriteProcessMemory SearchPathW IsValidCodePage GetStartupInfoW

advapi32

GetKernelObjectSecurity PrivilegeCheck AccessCheck SetSecurityDescriptorOwner GetSidSubAuthorityCount AllocateAndInitializeSid IsValidSecurityDescriptor OpenProcessToken FreeSid DuplicateToken AddAccessAllowedAce OpenThreadToken LookupAccountSidW SetSecurityDescriptorGroup GetSidIdentifierAuthority GetTokenInformation DeregisterEventSource RegDeleteKeyW RegEnumKeyExW RegisterEventSourceW ReportEventW GetSecurityDescriptorSacl SetSecurityDescriptorDacl GetSecurityDescriptorDacl RegGetKeySecurity GetAclInformation RegQueryInfoKeyW GetAce EqualSid GetSecurityDescriptorGroup GetSidSubAuthority GetSidLengthRequired RegCreateKeyExW GetSecurityDescriptorControl CopySid InitializeSid GetSecurityDescriptorOwner RegSetKeySecurity IsValidSid AddAce InitializeSecurityDescriptor InitializeAcl GetLengthSid GetSecurityDescriptorLength MakeSelfRelativeSD MakeAbsoluteSD CreateRestrictedToken SetThreadToken DuplicateTokenEx RegQueryValueExW RegCloseKey RegSetValueExW RegOpenKeyExW RegDeleteValueW LookupPrivilegeValueW AdjustTokenPrivileges

Sharing

General

Malware Config

Signatures

File Explorer

166295bfdc10f3ef5d07c9eef2cb6c24ab3e9f114baa4b11ae6f66fd9a5a627e

kernel32

advapi32

generic