3b21fb13a95086c1f02d07e3725d89e0911766585011e93dbab4ee74f9a72a57

Sharing

Copy URL Twitter E-mail

General

Target
3b21fb13a95086c1f02d07e3725d89e0911766585011e93dbab4ee74f9a72a57
Size 5.8MB
Sample260830-2ehwrsdf67
SHA256 3b21fb13a95086c1f02d07e3725d89e0911766585011e93dbab4ee74f9a72a57
MD5 0b333de3297c6635b9c353da287be215
SHA1 3be239de6c141c57231aee1de4dece2533913e8a
SHA512 4fbfed0d61a1c61f295bf3d1091f06e5f072012f86a5143bb803d9a4cc34ccf03a9c438501800423cb6265286e0824ce03164a5789e6974f85751f3b8536665a
SSDEEP 98304:95PkK/0kpORCJegS5zZkDECUNANi3+kvFxeYE07mDUECG:9J/0OJqbkIC8AAO8RE07alC
TLSH
T14856BE19D3D904A9D52BD638CA56C333DAB0BE925735C00F099DF6022F779A28B2F725
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3b21fb13a95086c1f02d07e3725d89e0911766585011e93dbab4ee74f9a72a57

File Explorer

3b21fb13a95086c1f02d07e3725d89e0911766585011e93dbab4ee74f9a72a57

.dll 5.8MB

3b21fb13a95086c1f02d07e3725d89e0911766585011e93dbab4ee74f9a72a57

IMPHASH 3abb2525259aaef7f986ef0e78b3d0ac
SHA256 3b21fb13a95086c1f02d07e3725d89e0911766585011e93dbab4ee74f9a72a57
MD5 0b333de3297c6635b9c353da287be215
SHA1 3be239de6c141c57231aee1de4dece2533913e8a
SHA512 4fbfed0d61a1c61f295bf3d1091f06e5f072012f86a5143bb803d9a4cc34ccf03a9c438501800423cb6265286e0824ce03164a5789e6974f85751f3b8536665a
SSDEEP 98304:95PkK/0kpORCJegS5zZkDECUNANi3+kvFxeYE07mDUECG:9J/0OJqbkIC8AAO8RE07alC
TLSH
T14856BE19D3D904A9D52BD638CA56C333DAB0BE925735C00F099DF6022F779A28B2F725
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

473832

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

advapi32

RegCreateKeyExW RegCloseKey RegQueryValueExW OpenProcessToken LookupPrivilegeValueW AdjustTokenPrivileges RegEnumKeyExW RegEnumValueW RegOpenKeyExW

bcrypt

BCryptCreateHash BCryptFinishHash BCryptGetProperty BCryptHashData BCryptOpenAlgorithmProvider BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptGenRandom

kernel32

RtlUnwind TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount EncodePointer RaiseException RtlPcToFileHeader SetLastError CreateFileW GetLastError ReadFile WriteFile GetModuleHandleW GetProcAddress QueryPerformanceCounter FreeConsole VirtualAllocEx FlushInstructionCache ReadProcessMemory WriteProcessMemory VirtualProtectEx GetModuleHandleA LocalFree FormatMessageW GetCPInfoExW GetConsoleMode GetFileType ReadConsoleW WriteConsoleW GetConsoleOutputCP GetStdHandle MultiByteToWideChar WideCharToMultiByte CloseHandle GetExitCodeProcess TerminateProcess OpenProcess K32EnumProcesses GetProcessId DuplicateHandle GetCurrentProcess GetCurrentProcessId RaiseFailFastException TzSpecificLocalTimeToSystemTime SystemTimeToFileTime FileTimeToSystemTime GetSystemTime GetCalendarInfoEx CompareStringOrdinal CompareStringEx FindNLSStringEx GetLocaleInfoEx ResolveLocaleName GetUserPreferredUILanguages FindStringOrdinal GetTickCount64 GetCurrentThread WaitForSingleObject Sleep DeleteCriticalSection EnterCriticalSection SleepConditionVariableCS LeaveCriticalSection WakeConditionVariable InitializeCriticalSection InitializeConditionVariable CreateThreadpoolTimer SetThreadpoolTimer WaitForMultipleObjectsEx CreateThreadpoolWork CloseThreadpoolWork SubmitThreadpoolWork QueryPerformanceFrequency GetFullPathNameW GetLongPathNameW LocalAlloc LocaleNameToLCID LCMapStringEx EnumTimeFormatsEx EnumCalendarInfoExEx CreateIoCompletionPort ExpandEnvironmentStringsW FindClose FindFirstFileExW FreeLibrary GetFileAttributesExW GetModuleFileNameW GetSystemDirectoryW LoadLibraryExW QueryUnbiasedInterruptTime SetThreadErrorMode CreateThread ResumeThread GetThreadPriority SetThreadPriority GetDynamicTimeZoneInformation GetTimeZoneInformation GetCurrentProcessorNumberEx SetEvent ResetEvent CreateEventExW GetEnvironmentVariableW FlushProcessWriteBuffers WaitForSingleObjectEx RtlVirtualUnwind RtlCaptureContext RtlRestoreContext AddVectoredExceptionHandler FlsAlloc FlsGetValue FlsSetValue CreateEventW SwitchToThread GetCurrentThreadId SuspendThread GetThreadContext SetThreadContext VirtualAlloc VirtualProtect VirtualFree QueryInformationJobObject GetModuleHandleExW GetProcessAffinityMask InitializeContext GetEnabledXStateFeatures SetXStateFeaturesMask InitializeCriticalSectionEx VirtualQuery GetSystemTimeAsFileTime DebugBreak SleepEx GlobalMemoryStatusEx GetSystemInfo GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLargePageMinimum VirtualUnlock VirtualAllocExNuma IsProcessInJob GetNumaHighestNodeNumber GetProcessGroupAffinity K32GetProcessMemoryInfo InterlockedFlushSList RtlUnwindEx IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlLookupFunctionEntry InitializeSListHead

ole32

CoTaskMemAlloc CoGetApartmentType CoCreateGuid CoTaskMemFree CoWaitForMultipleHandles CoUninitialize CoInitializeEx

user32

LoadStringW

api-ms-win-crt-heap-l1-1-0

_callnewh free malloc calloc

api-ms-win-crt-math-l1-1-0

cos modf tan sin floor ceil pow

api-ms-win-crt-string-l1-1-0

wcsncmp strncpy_s _stricmp strcmp strcpy_s

api-ms-win-crt-convert-l1-1-0

strtoull

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _register_onexit_function _initterm _execute_onexit_table _initialize_narrow_environment _crt_atexit abort _initterm_e _configure_narrow_argv _cexit terminate _seh_filter_dll

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vfprintf __stdio_common_vsprintf_s __stdio_common_vsscanf __acrt_iob_func

Name

.text

Size

489KB

Virtual Size

488KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.managed

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

hydrated

Size

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

2.3MB

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

22KB

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

214KB

Virtual Size

214KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

3b21fb13a95086c1f02d07e3725d89e0911766585011e93dbab4ee74f9a72a57

advapi32

bcrypt

kernel32

ole32

user32

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

generic