f9f6cf407cb87be5ffb1116f8e845f280301e757ecdabbe3c90f786e4eb1acc9

Sharing

Copy URL Twitter E-mail

General

Target
f9f6cf407cb87be5ffb1116f8e845f280301e757ecdabbe3c90f786e4eb1acc9
Size 2.1MB
Sample260827-m762qstdla
SHA256 f9f6cf407cb87be5ffb1116f8e845f280301e757ecdabbe3c90f786e4eb1acc9
MD5 ab22ef30e0e67d07957ab0356ff386ce
SHA1 f01a752894747f7e390889832f8c7b8d1a2b7716
SHA512 2b543743b0869cc52a90b8b0c84e4bbbadeac421dada0c38cf48867509472bd22acd5323b36fcd0d3053358e92c8128e853909bdaea760c3ffe8dfc3040a4bb3
SSDEEP 49152:3qmUMWYS4AyvPKVqEwZe/BYVq+m0SCBqXzbVqLn5Cm:3q8WjJuZeIq+m0SCBqXzb
TLSH
T1E5A5385F72A700ABC07A933887C64B17D6717404CB20BADB1EB44EA63B536E15A3E75C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f9f6cf407cb87be5ffb1116f8e845f280301e757ecdabbe3c90f786e4eb1acc9

File Explorer

f9f6cf407cb87be5ffb1116f8e845f280301e757ecdabbe3c90f786e4eb1acc9

.exe 2.1MB

f9f6cf407cb87be5ffb1116f8e845f280301e757ecdabbe3c90f786e4eb1acc9

IMPHASH 01c1d4a9ae9642c30b368be0d95cbe9e
SHA256 f9f6cf407cb87be5ffb1116f8e845f280301e757ecdabbe3c90f786e4eb1acc9
MD5 ab22ef30e0e67d07957ab0356ff386ce
SHA1 f01a752894747f7e390889832f8c7b8d1a2b7716
SHA512 2b543743b0869cc52a90b8b0c84e4bbbadeac421dada0c38cf48867509472bd22acd5323b36fcd0d3053358e92c8128e853909bdaea760c3ffe8dfc3040a4bb3
SSDEEP 49152:3qmUMWYS4AyvPKVqEwZe/BYVq+m0SCBqXzbVqLn5Cm:3q8WjJuZeIq+m0SCBqXzb
TLSH
T1E5A5385F72A700ABC07A933887C64B17D6717404CB20BADB1EB44EA63B536E15A3E75C
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

504656

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Administrator\Desktop\launcher\launcher\build\release\AimLab_tb.pdb

ntdll

NtReadVirtualMemory NtTerminateProcess NtUnmapViewOfSection NtGetContextThread RtlAddFunctionTable NtWriteVirtualMemory VerSetConditionMask NtResumeThread NtSetContextThread

d3d11

D3D11CreateDeviceAndSwapChain

advapi32

LookupPrivilegeValueA CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW AdjustTokenPrivileges CryptEncrypt OpenProcessToken GetUserNameA GetCurrentHwProfileA RegOpenKeyExA RegCloseKey RegSetValueExA

kernel32

Process32First Process32Next GetProcessTimes K32GetProcessMemoryInfo GetFileAttributesA DeleteFileA WaitForSingleObject GetCurrentProcess Beep GetTickCount TerminateProcess SetFileAttributesA LocalFree ExitProcess GetLastError WriteFile FlushFileBuffers MultiByteToWideChar GetCurrentProcessId GetSystemDirectoryA FreeLibrary OutputDebugStringA WideCharToMultiByte GetLocaleInfoA QueryPerformanceFrequency IsDBCSLeadByte QueryPerformanceCounter RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW IsDebuggerPresent GetStartupInfoW GetModuleHandleW GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ReadFile GetModuleFileNameW GetStdHandle VirtualAlloc HeapFree HeapAlloc FlsAlloc FlsGetValue FlsSetValue GetComputerNameA InitializeCriticalSectionEx VirtualProtect GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FindNextFileA GetConsoleMode GetFileSizeEx SetFilePointerEx ReadConsoleW GetTimeZoneInformation FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle GetStringTypeW CreateFileW HeapSize HeapReAlloc WriteConsoleW SetEndOfFile FormatMessageA WaitForSingleObjectEx GetLocaleInfoEx DecodePointer LCMapStringEx TryAcquireSRWLockExclusive GetCurrentDirectoryW FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetFileInformationByHandle GetDriveTypeW RtlUnwind FormatMessageW VerifyVersionInfoW WaitForMultipleObjects PeekNamedPipe MoveFileExW SleepEx GetFullPathNameW CreateToolhelp32Snapshot FlsFree OpenProcess CreateProcessA Sleep CloseHandle GetProcAddress LoadLibraryA VirtualAllocEx GlobalFree GetModuleHandleA GlobalAlloc GlobalUnlock GlobalLock DeleteFileW GetTempPathA FindClose FindFirstFileA GetEnvironmentVariableA GetConsoleOutputCP VirtualFree AreFileApisANSI

user32

GetMessageExtraInfo GetKeyState GetWindowTextA SetCursor GetClientRect IsWindowUnicode SetCursorPos DefWindowProcW DispatchMessageA LoadCursorA DestroyWindow SetActiveWindow GetCapture ClientToScreen TrackMouseEvent GetKeyboardLayout GetWindowRect GetSystemMetrics SetWindowPos OpenClipboard GetClipboardData CloseClipboard SetFocus GetDC SetWindowRgn CreateWindowExW UnregisterClassW RegisterClassExW GetWindowPlacement ScreenToClient GetForegroundWindow FindWindowA IsWindowVisible MessageBoxA EmptyClipboard SetClipboardData MessageBoxW GetCursorPos SetForegroundWindow ReleaseCapture FindWindowExA UpdateWindow SetWindowLongPtrA GetClassInfoExW PostQuitMessage GetWindowLongPtrA PeekMessageA SetCapture TranslateMessage BringWindowToTop SetWindowDisplayAffinity SetWindowPlacement GetWindowLongA SetWindowLongA GetAsyncKeyState IsWindow ShowWindow ReleaseDC

gdi32

CreateRoundRectRgn DeleteObject BitBlt SelectObject DeleteDC CreateCompatibleDC CreateCompatibleBitmap

shell32

ShellExecuteW

ole32

CoUninitialize CoCreateInstance CLSIDFromString CoInitialize

gdiplus

GdipCloneImage GdipSaveImageToFile GdipCreateBitmapFromHBITMAP GdipFree GdiplusStartup GdipAlloc GdipDisposeImage GdiplusShutdown

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

bcrypt

BCryptGenRandom

ws2_32

freeaddrinfo ioctlsocket recvfrom sendto listen htonl gethostname select __WSAFDIsSet WSACleanup WSAStartup ntohs WSAWaitForMultipleEvents WSAResetEvent WSAEventSelect WSAEnumNetworkEvents WSACreateEvent WSACloseEvent WSAIoctl WSASetLastError setsockopt send recv getsockname getpeername connect bind accept socket htons closesocket WSAGetLastError getaddrinfo getsockopt

crypt32

CryptStringToBinaryW CertFreeCertificateContext CertFindCertificateInStore CertEnumCertificatesInStore CertCloseStore PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringW CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertOpenStore

iphlpapi

if_nametoindex

secur32

InitSecurityInterfaceW

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

271KB

Virtual Size

271KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

9KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

58KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

551KB

Virtual Size

551KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

f9f6cf407cb87be5ffb1116f8e845f280301e757ecdabbe3c90f786e4eb1acc9

ntdll

d3d11

advapi32

kernel32

user32

gdi32

shell32

ole32

gdiplus

imm32

bcrypt

ws2_32

crypt32

iphlpapi

secur32

generic