0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6

Sharing

Copy URL Twitter E-mail

General

Target
0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6
Size 1.6MB
Sample260906-spfpqaxbnd
SHA256 0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6
MD5 83803beb0ddf793b9dc073847cc3da85
SHA1 b71ffc844297a38a88cc761c3e2586ef6c63361a
SHA512 f2a263801b5cf70985b5b3217d4a506b37a9a234b4fc9b8b92a410222e0438b02f0a6b68b0c335e49652c9338f3f7cf4c950318f1571ac3041ad3d04c599ba64
SSDEEP 24576:aj7CD05uJiIfSucFUM8DbpUgkHVUpoijR2:ajEgutpGepoOR
TLSH
T17E754A2C9BA4836FC393613D58A985DBE221AB4583E5715E3BC3350B0DBE5F3450EA2D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6

File Explorer

0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6

.exe 1.6MB

0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6

IMPHASH 42735880f24f2e0f70543964e6be6205
SHA256 0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6
MD5 83803beb0ddf793b9dc073847cc3da85
SHA1 b71ffc844297a38a88cc761c3e2586ef6c63361a
SHA512 f2a263801b5cf70985b5b3217d4a506b37a9a234b4fc9b8b92a410222e0438b02f0a6b68b0c335e49652c9338f3f7cf4c950318f1571ac3041ad3d04c599ba64
SSDEEP 24576:aj7CD05uJiIfSucFUM8DbpUgkHVUpoijR2:ajEgutpGepoOR
TLSH
T17E754A2C9BA4836FC393613D58A985DBE221AB4583E5715E3BC3350B0DBE5F3450EA2D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

94808

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

Process32FirstW GetWindowsDirectoryW ExitProcess ReadProcessMemory GetCurrentProcessId GetModuleHandleW QueryFullProcessImageNameW CreateFileMappingW MapViewOfFile WideCharToMultiByte CreateDirectoryW SizeofResource VirtualProtect WriteFile TerminateProcess GetTempPathW WaitForSingleObject Process32NextW LockResource CreateThread LoadResource FindResourceW CreateProcessW CopyFileW GetSystemTimeAsFileTime WriteConsoleW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage CreateToolhelp32Snapshot OpenProcess UnmapViewOfFile GetFileAttributesW CreateFileW GetModuleFileNameW FindNextFileW GetFullPathNameW GetCommandLineW QueryDosDeviceW LocalAlloc LocalFree IsDebuggerPresent QueryPerformanceCounter GetProcessHeap DeleteCriticalSection GetProcAddress DecodePointer HeapAlloc CloseHandle HeapReAlloc GetLastError Sleep HeapSize FindClose InitializeCriticalSectionEx GetCurrentProcess SetLastError HeapFree MultiByteToWideChar ReadConsoleW ReadFile GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetFileSizeEx GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW RtlUnwind FlsFree FlsSetValue FlsGetValue FlsAlloc GetStdHandle FreeLibraryAndExitThread ExitThread GetModuleHandleExW LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlPcToFileHeader RtlUnwindEx InitializeSListHead IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo WakeAllConditionVariable TryAcquireSRWLockExclusive AcquireSRWLockExclusive ReleaseSRWLockExclusive LCMapStringEx EncodePointer OutputDebugStringW RaiseException EnterCriticalSection LeaveCriticalSection GetStringTypeW GetCurrentThreadId FindFirstFileExW

advapi32

QueryServiceStatus StartServiceW GetSidSubAuthorityCount AllocateAndInitializeSid GetSidSubAuthority FreeSid CheckTokenMembership CreateServiceW RegQueryValueExW CloseServiceHandle OpenSCManagerW RegCreateKeyExW RegSetValueExW OpenProcessToken RegOpenKeyExW OpenServiceW GetTokenInformation RegCloseKey

shell32

CommandLineToArgvW SHGetFolderPathW

ole32

CoCreateGuid CoInitialize CoTaskMemFree CoGetObject CoUninitialize CoInitializeEx StringFromCLSID CoCreateInstance

oleaut32

SysAllocString VariantClear SysFreeString

shlwapi

PathRemoveFileSpecW

setupapi

SetupDiDestroyDeviceInfoList SetupDiGetDeviceRegistryPropertyW SetupDiGetClassDevsW SetupDiEnumDeviceInfo

Name

.text

Size

235KB

Virtual Size

235KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

662KB

Virtual Size

661KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

170KB

Virtual Size

169KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

0fcc20a3bdfb89b516cab06ec7ce733b043c50b469e3f14c1b6904bda1b348c6

kernel32

advapi32

shell32

ole32

oleaut32

shlwapi

setupapi

generic