ab53b592fbaf9ca246003ba95a0234cfb5539d5790776174dfbca6c0a3f73037

Sharing

Copy URL Twitter E-mail

General

Target
ab53b592fbaf9ca246003ba95a0234cfb5539d5790776174dfbca6c0a3f73037
Size 3.6MB
Sample260909-jaw9gstdpd
SHA256 ab53b592fbaf9ca246003ba95a0234cfb5539d5790776174dfbca6c0a3f73037
MD5 ab835dd691c66e36dd167894cbc08d5e
SHA1 6fb38e3a609cb94c5096331b9c0578399d1306ba
SHA512 645fa4df15916ef9ff7c0c1a22ece72ebec31fc74d2d72c9f72b4cf00420940a06ee31341cee72ab5fc928ea36094b5756c85b8eb1e59e1667496ef9d7766830
SSDEEP 98304:g2c0OMpsEXuJc5lHYDRomDlID3/KG8ODjG/1:TO3EXP5laRrID/1DjG/
TLSH
T1CC06126E32E181E4C4DCE239DB468EE27169778C057277BF42ACCFF12A5A5520A9C734
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ab53b592fbaf9ca246003ba95a0234cfb5539d5790776174dfbca6c0a3f73037

File Explorer

ab53b592fbaf9ca246003ba95a0234cfb5539d5790776174dfbca6c0a3f73037

.exe 3.6MB

ab53b592fbaf9ca246003ba95a0234cfb5539d5790776174dfbca6c0a3f73037

IMPHASH b25557f316c563f336766cfbc5e9ece4
SHA256 ab53b592fbaf9ca246003ba95a0234cfb5539d5790776174dfbca6c0a3f73037
MD5 ab835dd691c66e36dd167894cbc08d5e
SHA1 6fb38e3a609cb94c5096331b9c0578399d1306ba
SHA512 645fa4df15916ef9ff7c0c1a22ece72ebec31fc74d2d72c9f72b4cf00420940a06ee31341cee72ab5fc928ea36094b5756c85b8eb1e59e1667496ef9d7766830
SSDEEP 98304:g2c0OMpsEXuJc5lHYDRomDlID3/KG8ODjG/1:TO3EXP5laRrID/1DjG/
TLSH
T1CC06126E32E181E4C4DCE239DB468EE27169778C057277BF42ACCFF12A5A5520A9C734
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

kernel32

AddVectoredExceptionHandler CloseHandle CreateFileMappingA CreateFileW CreateToolhelp32Snapshot DeleteCriticalSection DuplicateHandle EnterCriticalSection FreeLibrary GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentThread GetEnvironmentVariableW GetFileInformationByHandle GetFileInformationByHandleEx GetFullPathNameW GetLastError GetModuleHandleA GetProcAddress GetProcessHeap GetStdHandle HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete InitializeCriticalSection LeaveCriticalSection LoadLibraryA MapViewOfFile Module32FirstW Module32NextW MultiByteToWideChar RaiseException RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter Sleep TlsAlloc TlsFree TlsGetValue TlsSetValue UnmapViewOfFile VirtualAlloc VirtualProtect VirtualQuery WaitForSingleObject WriteConsoleW __C_specific_handler

api-ms-win-crt-environment-l1-1-0

__p__environ __p__wenviron

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-private-l1-1-0

memcmp memcpy memmove

api-ms-win-crt-runtime-l1-1-0

_set_app_type __p___argc __p___argv __p___wargv _cexit _configure_narrow_argv _configure_wide_argv _crt_at_quick_exit _crt_atexit _exit _fpreset _initialize_narrow_environment _initialize_wide_environment _initterm _set_invalid_parameter_handler abort exit signal

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vfwprintf fwrite

api-ms-win-crt-string-l1-1-0

memset strlen strncmp

api-ms-win-crt-time-l1-1-0

__daylight __timezone __tzname _tzset

ntdll

NtWriteFile RtlNtStatusToDosError

Name

.text

Size

200KB

Virtual Size

199KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

3.3MB

Virtual Size

3.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

640B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1024B

Virtual Size

888B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ab53b592fbaf9ca246003ba95a0234cfb5539d5790776174dfbca6c0a3f73037

api-ms-win-core-synch-l1-2-0

kernel32

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

ntdll

generic