48aed76a868e5b9fd6e53736c1e7153f595378b38650930310ee58137a443eb1

Sharing

Copy URL Twitter E-mail

General

Target
48aed76a868e5b9fd6e53736c1e7153f595378b38650930310ee58137a443eb1
Size 726KB
Sample260826-lycabswerf
SHA256 48aed76a868e5b9fd6e53736c1e7153f595378b38650930310ee58137a443eb1
MD5 d8fabb25ecf4dd7aa8a705b1c6136001
SHA1 9e7fced6e7cbe525fa1141e8b1d9ad6b075d2b85
SHA512 86b8adebf073f20708807c5f1f324e9092615eb0e02d5f17b18e851100fec84ff806c305657ffd74d9907d71009742c446cbce648862235a5cce30d095ba3f0f
SSDEEP 12288:T7d1AV1ttf0P3DRy1THNskfJenyFrSTYRjuRczzXib49AUf78AKPgyeacDKTv/j5:T73utgNyZtbMRcIUq4BEtHPtbn
TLSH
T169F4B0B876047DE6E66F477BDE96ACD813B226239ACBA4CD40647BC30563375EE02C05
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
48aed76a868e5b9fd6e53736c1e7153f595378b38650930310ee58137a443eb1

File Explorer

48aed76a868e5b9fd6e53736c1e7153f595378b38650930310ee58137a443eb1

.dll 726KB

48aed76a868e5b9fd6e53736c1e7153f595378b38650930310ee58137a443eb1

IMPHASH 6c25b44719a9e5c0d7d4816ffc675965
SHA256 48aed76a868e5b9fd6e53736c1e7153f595378b38650930310ee58137a443eb1
MD5 d8fabb25ecf4dd7aa8a705b1c6136001
SHA1 9e7fced6e7cbe525fa1141e8b1d9ad6b075d2b85
SHA512 86b8adebf073f20708807c5f1f324e9092615eb0e02d5f17b18e851100fec84ff806c305657ffd74d9907d71009742c446cbce648862235a5cce30d095ba3f0f
SSDEEP 12288:T7d1AV1ttf0P3DRy1THNskfJenyFrSTYRjuRczzXib49AUf78AKPgyeacDKTv/j5:T73utgNyZtbMRcIUq4BEtHPtbn
TLSH
T169F4B0B876047DE6E66F477BDE96ACD813B226239ACBA4CD40647BC30563375EE02C05
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4592

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

BIO_ctrl BIO_free BIO_new BIO_s_mem BIO_write BN_CTX_free BN_CTX_new BN_bin2bn BN_bn2bin BN_clear_free BN_cmp BN_div BN_dup BN_new BN_num_bits BN_print_fp BN_set_flags BN_sub BN_value_one ECDSA_SIG_free ECDSA_SIG_get0 ECDSA_SIG_new ECDSA_SIG_set0 EC_GROUP_cmp EC_GROUP_free EC_GROUP_get_curve_name EC_GROUP_get_order EC_GROUP_method_of EC_GROUP_new_by_curve_name EC_GROUP_set_asn1_flag EC_KEY_METHOD_free EC_KEY_METHOD_get_init EC_KEY_METHOD_get_sign EC_KEY_METHOD_new EC_KEY_METHOD_set_init EC_KEY_METHOD_set_sign EC_KEY_OpenSSL EC_KEY_free EC_KEY_get0_group EC_KEY_get0_private_key EC_KEY_get0_public_key EC_KEY_get_method EC_KEY_new_by_curve_name EC_KEY_set_group EC_KEY_set_method EC_KEY_set_private_key EC_KEY_set_public_key EC_METHOD_get_field_type EC_POINT_free EC_POINT_get_affine_coordinates_GFp EC_POINT_is_at_infinity EC_POINT_mul EC_POINT_new EC_POINT_oct2point EC_POINT_point2oct ERR_get_error ERR_peek_error ERR_peek_last_error EVP_CIPHER_CTX_ctrl EVP_CIPHER_CTX_free EVP_CIPHER_CTX_get_iv_length EVP_CIPHER_CTX_get_key_length EVP_CIPHER_CTX_get_updated_iv EVP_CIPHER_CTX_iv EVP_CIPHER_CTX_iv_noconst EVP_CIPHER_CTX_new EVP_CIPHER_CTX_set_key_length EVP_Cipher EVP_CipherInit EVP_Digest EVP_DigestFinal_ex EVP_DigestInit_ex EVP_DigestSign EVP_DigestSignInit EVP_DigestUpdate EVP_DigestVerify EVP_DigestVerifyInit EVP_MD_CTX_copy_ex EVP_MD_CTX_free EVP_MD_CTX_get0_md EVP_MD_CTX_new EVP_MD_get_block_size EVP_PKEY_CTX_free EVP_PKEY_CTX_new_id EVP_PKEY_CTX_set_ec_paramgen_curve_nid EVP_PKEY_CTX_set_rsa_keygen_bits EVP_PKEY_cmp EVP_PKEY_free EVP_PKEY_get0_EC_KEY EVP_PKEY_get0_RSA EVP_PKEY_get1_EC_KEY EVP_PKEY_get1_RSA EVP_PKEY_get_base_id EVP_PKEY_get_bits EVP_PKEY_get_raw_private_key EVP_PKEY_get_raw_public_key EVP_PKEY_get_size EVP_PKEY_keygen EVP_PKEY_keygen_init EVP_PKEY_new EVP_PKEY_set1_EC_KEY EVP_PKEY_set1_RSA EVP_PKEY_up_ref EVP_aes_128_cbc EVP_aes_128_ctr EVP_aes_128_gcm EVP_aes_192_cbc EVP_aes_192_ctr EVP_aes_256_cbc EVP_aes_256_ctr EVP_aes_256_gcm EVP_chacha20 EVP_des_ede3_cbc EVP_md5 EVP_sha1 EVP_sha256 EVP_sha384 EVP_sha512 OPENSSL_init_crypto OpenSSL_version_num PEM_read_bio_PrivateKey PEM_write_bio_ECPrivateKey PEM_write_bio_PrivateKey PEM_write_bio_RSAPrivateKey RAND_status RSA_blinding_on RSA_free RSA_get0_crt_params RSA_get0_factors RSA_get0_key RSA_get_default_method RSA_get_method RSA_meth_dup RSA_meth_free RSA_meth_get_finish RSA_meth_set1_name RSA_meth_set_finish RSA_meth_set_priv_enc RSA_new RSA_set0_crt_params RSA_set0_factors RSA_set0_key RSA_set_method RSA_size d2i_ECDSA_SIG i2d_ECDSA_SIG

Name

.text

Size

27KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

680KB

Virtual Size

680KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

48aed76a868e5b9fd6e53736c1e7153f595378b38650930310ee58137a443eb1

kernel32

msvcrt

user32

generic