aa4cc936db87bc3eae126b606859bc1b9e8f22f8025afa01a1ef1ac8bc76e04b

Sharing

Copy URL Twitter E-mail

General

Target
aa4cc936db87bc3eae126b606859bc1b9e8f22f8025afa01a1ef1ac8bc76e04b
Size 5.4MB
Sample260909-jawmystdpb
SHA256 aa4cc936db87bc3eae126b606859bc1b9e8f22f8025afa01a1ef1ac8bc76e04b
MD5 6e9698e471f79ebc9da2f80d9184be2f
SHA1 27d285f73119cc7d029338a999db5b0a83e363f6
SHA512 2f0651b516bf9f96d7ed6b24d0c5793cd5722971f91118e6840ece868bccb6d7fe8695d78c91ac6c53b0b2cdf0a73b4bd7d91f85a8aa3138adae616451c0d83e
SSDEEP 98304:z76gPTtIaj9yHhLeJDPfGDmP6Pd8sB1O9O2uZQwTGX8v3x5:zNbUVgD3GDePO2uZQIGsf
TLSH
T1B646BE1014239BDCFB7279702F722433A71A2F174329995B67D6BFE03BAC6E0A4415B6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aa4cc936db87bc3eae126b606859bc1b9e8f22f8025afa01a1ef1ac8bc76e04b

File Explorer

aa4cc936db87bc3eae126b606859bc1b9e8f22f8025afa01a1ef1ac8bc76e04b

.exe 5.4MB

aa4cc936db87bc3eae126b606859bc1b9e8f22f8025afa01a1ef1ac8bc76e04b

IMPHASH 903cdf1ef9d315fcd2c563c14b28e134
SHA256 aa4cc936db87bc3eae126b606859bc1b9e8f22f8025afa01a1ef1ac8bc76e04b
MD5 6e9698e471f79ebc9da2f80d9184be2f
SHA1 27d285f73119cc7d029338a999db5b0a83e363f6
SHA512 2f0651b516bf9f96d7ed6b24d0c5793cd5722971f91118e6840ece868bccb6d7fe8695d78c91ac6c53b0b2cdf0a73b4bd7d91f85a8aa3138adae616451c0d83e
SSDEEP 98304:z76gPTtIaj9yHhLeJDPfGDmP6Pd8sB1O9O2uZQwTGX8v3x5:zNbUVgD3GDePO2uZQIGsf
TLSH
T1B646BE1014239BDCFB7279702F722433A71A2F174329995B67D6BFE03BAC6E0A4415B6
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

CloseServiceHandle CryptAcquireContextA CryptCreateHash CryptDestroyHash CryptGenRandom CryptHashData CryptReleaseContext EnumServicesStatusA GetUserNameA OpenProcessToken OpenSCManagerA RegCloseKey RegOpenKeyExA RegQueryValueExA

comctl32

InitCommonControlsEx

crypt32

CertCloseStore CertOpenSystemStoreA

dbghelp

SymCleanup SymInitialize

gdi32

CreateDCA DeleteDC

imagehlp

MapFileAndCheckSumA

iphlpapi

GetAdaptersInfo

kernel32

CancelWaitableTimer CloseHandle CreateEventA CreateFileA CreateMutexA CreateSemaphoreA CreateThread CreateToolhelp32Snapshot CreateWaitableTimerA DeleteCriticalSection DuplicateHandle EnterCriticalSection ExitProcess FlushFileBuffers FreeLibrary GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetLastError GetLocalTime GetModuleFileNameA GetModuleHandleA GetProcAddress GetProcessAffinityMask GetProcessHeap GetSystemDirectoryA GetSystemTime GetSystemTimeAsFileTime GetTempPathA GetThreadContext GetThreadPriority GetTickCount GetWindowsDirectoryA HeapAlloc HeapFree InitializeCriticalSection IsProcessorFeaturePresent K32EnumProcessModules LeaveCriticalSection LoadLibraryA OpenProcess OutputDebugStringA Process32First Process32Next QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseMutex ReleaseSemaphore ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEvent SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter SetWaitableTimer Sleep SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WriteFile __C_specific_handler

api-ms-win-crt-convert-l1-1-0

mbrtowc mbsrtowcs strtoul wcrtomb

api-ms-win-crt-environment-l1-1-0

__p__environ getenv

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-private-l1-1-0

__intrinsic_setjmp longjmp memcmp memcpy memmove strchr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _assert _beginthreadex _cexit _configure_narrow_argv _crt_atexit _endthreadex _errno _exit _initialize_narrow_environment _set_app_type _initterm _initterm_e _set_invalid_parameter_handler abort exit signal strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf _fileno _setmode _write fflush fputc fputs fwrite setvbuf

api-ms-win-crt-string-l1-1-0

_strdup memset strcmp strlen strncmp strnlen wcslen wcsnlen

api-ms-win-crt-utility-l1-1-0

rand_s

ole32

CLSIDFromProgID CoInitializeEx CoUninitialize

oleaut32

VariantClear VariantInit

powrprof

GetPwrCapabilities

rpcrt4

UuidCreate

setupapi

SetupDiDestroyDeviceInfoList SetupDiGetClassDevsA

shell32

SHGetFolderPathA

urlmon

CoInternetGetSession

user32

DefWindowProcA EnumWindows GetDesktopWindow GetWindowRect GetWindowTextLengthA IsWindow IsWindowEnabled IsWindowVisible PeekMessageA

userenv

GetUserProfileDirectoryA

version

GetFileVersionInfoSizeA

wininet

InternetCloseHandle InternetOpenA InternetOpenUrlA

winmm

timeGetTime

ws2_32

WSACleanup WSAStartup closesocket htons inet_pton socket

Name

.text

Size

144KB

Virtual Size

143KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

5.2MB

Virtual Size

5.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

1024B

Virtual Size

651B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

952B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

aa4cc936db87bc3eae126b606859bc1b9e8f22f8025afa01a1ef1ac8bc76e04b

advapi32

comctl32

crypt32

dbghelp

gdi32

imagehlp

iphlpapi

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

ole32

oleaut32

powrprof

rpcrt4

setupapi

shell32

urlmon

user32

userenv

version

wininet

winmm

ws2_32

generic