436488e01ab66b61e8a8751c2cba5a662ccc0442c193be46cff3d5716c1c494e

Sharing

Copy URL Twitter E-mail

General

Target
436488e01ab66b61e8a8751c2cba5a662ccc0442c193be46cff3d5716c1c494e
Size 9.6MB
Sample260831-prptmage82
SHA256 436488e01ab66b61e8a8751c2cba5a662ccc0442c193be46cff3d5716c1c494e
MD5 471927b8dca4445b93c9f1cb00d4c39c
SHA1 59a6ae1ee783fb8d747f2f0377fd49e8cf1e77a5
SHA512 05c5bd206ce87465952bbc54aba4af772f5f365ef794bdae408d9616e7abbe9751182b8036da00d7bad98aa22646b67aaa865a1c3822c8a42a427da34e476909
SSDEEP 196608:+zP7uNZ7FnkudJzPYfHAL7zjUh74xTeVPWTy4gd3tACJ9s/2oJ4DHsHnJ:+fufhkuLzPYfHdUxAuudd+q9W2oJ4un
TLSH
T17CA63380F89F5365D0DAF3F3567A665DB0773FB119A68D243689884C2D8DE241E3E832
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
436488e01ab66b61e8a8751c2cba5a662ccc0442c193be46cff3d5716c1c494e

File Explorer

436488e01ab66b61e8a8751c2cba5a662ccc0442c193be46cff3d5716c1c494e

.exe 9.6MB

436488e01ab66b61e8a8751c2cba5a662ccc0442c193be46cff3d5716c1c494e

IMPHASH 2c8d6200bf56d363ff1c6c6a6bd23604
SHA256 436488e01ab66b61e8a8751c2cba5a662ccc0442c193be46cff3d5716c1c494e
MD5 471927b8dca4445b93c9f1cb00d4c39c
SHA1 59a6ae1ee783fb8d747f2f0377fd49e8cf1e77a5
SHA512 05c5bd206ce87465952bbc54aba4af772f5f365ef794bdae408d9616e7abbe9751182b8036da00d7bad98aa22646b67aaa865a1c3822c8a42a427da34e476909
SSDEEP 196608:+zP7uNZ7FnkudJzPYfHAL7zjUh74xTeVPWTy4gd3tACJ9s/2oJ4DHsHnJ:+fufhkuLzPYfHdUxAuudd+q9W2oJ4un
TLSH
T17CA63380F89F5365D0DAF3F3567A665DB0773FB119A68D243689884C2D8DE241E3E832
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

56793862

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

dwmapi

DwmExtendFrameIntoClientArea

wininet

InternetOpenUrlA

winhttp

WinHttpSendRequest

advapi32

OpenServiceA

ntdll

VerSetConditionMask

shell32

SHGetFolderPathA

ole32

CoUninitialize

kernel32

CreateFileW GetSystemTimeAsFileTime HeapAlloc HeapFree ExitProcess GetModuleHandleA LoadLibraryA GetProcAddress

user32

GetKeyboardLayout

msvcp140

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@N@Z

bcrypt

BCryptGetProperty

imm32

ImmReleaseContext

userenv

UnloadUserProfile

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_destroy

api-ms-win-crt-heap-l1-1-0

malloc

api-ms-win-crt-string-l1-1-0

isdigit

api-ms-win-crt-stdio-l1-1-0

feof

api-ms-win-crt-runtime-l1-1-0

_beginthreadex

api-ms-win-crt-math-l1-1-0

atan2f

api-ms-win-crt-convert-l1-1-0

strtoul

api-ms-win-crt-filesystem-l1-1-0

_unlink

api-ms-win-crt-locale-l1-1-0

localeconv

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-time-l1-1-0

_time64

api-ms-win-crt-environment-l1-1-0

getenv

psapi

GetModuleInformation

shlwapi

PathFindFileNameW

crypt32

CertCreateCertificateChainEngine

ws2_32

recv

Name

.text

Size

Virtual Size

4.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

35.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.0uQ

Size

Virtual Size

4.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.j>6

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.56y

Size

9.5MB

Virtual Size

9.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

469B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

436488e01ab66b61e8a8751c2cba5a662ccc0442c193be46cff3d5716c1c494e

d3d11

dwmapi

wininet

winhttp

advapi32

ntdll

shell32

ole32

kernel32

user32

msvcp140

bcrypt

imm32

userenv

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-environment-l1-1-0

psapi

shlwapi

crypt32

ws2_32

generic