f566eb323ad8a6cbad11b20b75881c3c108fec88c0b4db0b9a4c832dc9cf58fb

Sharing

Copy URL Twitter E-mail

General

Target
f566eb323ad8a6cbad11b20b75881c3c108fec88c0b4db0b9a4c832dc9cf58fb
Size 780KB
Sample260903-mcd3gavbqa
SHA256 f566eb323ad8a6cbad11b20b75881c3c108fec88c0b4db0b9a4c832dc9cf58fb
MD5 15bc7dfea05584aa67e3948ad898a802
SHA1 360518a552acdaeafcb4b1a74be74aa089d53aff
SHA512 8cd23f0c3e992c1b251edae7cac916da226bcaabb920d37287fb7c180e0094c5db0aebc806cb02a16c5c614aa09ba84ce202802e065c92f5d70652f6e5bf6f32
SSDEEP 12288:3hhGUFyKeqcqn+IMyGw7LQBQweJpaffBF1lXvrl:3hhGUFfeqcqrMXULQ1tfZhfrl
TLSH
T141055A257E8556ECC12AC07483598AB27A7174CA0F35B9FF0594427C2EBAEF91F3D224
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f566eb323ad8a6cbad11b20b75881c3c108fec88c0b4db0b9a4c832dc9cf58fb

File Explorer

f566eb323ad8a6cbad11b20b75881c3c108fec88c0b4db0b9a4c832dc9cf58fb

.exe 780KB

f566eb323ad8a6cbad11b20b75881c3c108fec88c0b4db0b9a4c832dc9cf58fb

IMPHASH c220874c5926f1c049191c4e3cb4e21a
SHA256 f566eb323ad8a6cbad11b20b75881c3c108fec88c0b4db0b9a4c832dc9cf58fb
MD5 15bc7dfea05584aa67e3948ad898a802
SHA1 360518a552acdaeafcb4b1a74be74aa089d53aff
SHA512 8cd23f0c3e992c1b251edae7cac916da226bcaabb920d37287fb7c180e0094c5db0aebc806cb02a16c5c614aa09ba84ce202802e065c92f5d70652f6e5bf6f32
SSDEEP 12288:3hhGUFyKeqcqn+IMyGw7LQBQweJpaffBF1lXvrl:3hhGUFfeqcqrMXULQ1tfZhfrl
TLSH
T141055A257E8556ECC12AC07483598AB27A7174CA0F35B9FF0594427C2EBAEF91F3D224
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

446352

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

CyxWMIBridge.pdb

kernel32

WriteFile GetStartupInfoW SetNamedPipeHandleState GetNamedPipeClientProcessId ConnectNamedPipe ReadFile FlsGetValue IsProcessorFeaturePresent SetStdHandle DisconnectNamedPipe EncodePointer WaitForSingleObject GetLastError GetConsoleMode CreateFileW ReleaseSemaphore QueryFullProcessImageNameW OpenProcess ProcessIdToSessionId LocalFree SetEvent CreateNamedPipeW LoadLibraryExA GetProcAddress FreeLibrary GetProcessHeap HeapFree HeapAlloc SetConsoleCtrlHandler CreateSemaphoreA FormatMessageW CreateEventW CloseHandle LoadLibraryExW GetEnvironmentStringsW HeapSize LCMapStringW CompareStringW VirtualProtect GetStringTypeW GetCPInfo GetOEMCP GetACP IsValidCodePage UnhandledExceptionFilter IsDebuggerPresent GetCommandLineA DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection RaiseException RtlPcToFileHeader RtlUnwindEx SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime FindNextFileW QueryPerformanceFrequency GetModuleHandleA GetFileType IsThreadAFiber FlsSetValue GetModuleHandleW GetModuleHandleExW FlsAlloc FlsFree Sleep SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP WriteConsoleW MultiByteToWideChar GetModuleFileNameW SetEnvironmentVariableW GetEnvironmentVariableW ReleaseMutex CreateMutexA LoadLibraryA WaitForSingleObjectEx WideCharToMultiByte SwitchToThread ExitProcess FindClose FindFirstFileExW lstrlenW GetCommandLineW GetCurrentDirectoryW GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler SetFilePointerEx CreateDirectoryW TerminateProcess GetFileInformationByHandleEx FreeEnvironmentStringsW SetLastError GetFullPathNameW GetCurrentThreadId SetFileInformationByHandle GetStdHandle GetCurrentProcess HeapReAlloc QueryPerformanceCounter CreateThread GetCurrentProcessId FlushFileBuffers RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetSystemTimePreciseAsFileTime SetFileTime GetFileInformationByHandle

advapi32

StartServiceW ChangeServiceConfig2W OpenSCManagerW StartServiceCtrlDispatcherW RegisterServiceCtrlHandlerExW CreateServiceW SetServiceStatus CloseServiceHandle QueryServiceStatusEx ChangeServiceConfigW ControlService DeleteService OpenServiceW ConvertStringSecurityDescriptorToSecurityDescriptorW

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

ole32

CoUninitialize CoInitializeEx CoSetProxyBlanket CoCreateInstance CoInitializeSecurity

wintrust

WinVerifyTrust WTHelperGetProvCertFromChain WTHelperGetProvSignerFromChain WTHelperProvDataFromStateData

crypt32

CertGetNameStringW

oleaut32

VariantClear SafeArrayDestroy SafeArrayAccessData SafeArrayCreateVector SysFreeString SafeArrayGetLBound GetErrorInfo SysAllocStringLen SysStringLen SafeArrayUnaccessData SafeArrayGetUBound

ntdll

NtWriteFile RtlNtStatusToDosError NtReadFile

Name

.text

Size

514KB

Virtual Size

513KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

223KB

Virtual Size

223KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

f566eb323ad8a6cbad11b20b75881c3c108fec88c0b4db0b9a4c832dc9cf58fb

kernel32

advapi32

api-ms-win-core-synch-l1-2-0

ole32

wintrust

crypt32

oleaut32

ntdll

generic