1654f77db19a67e57421a3c293fa9ebe3a82b4baca8d82f487fea8f37076f565

General

Target
1654f77db19a67e57421a3c293fa9ebe3a82b4baca8d82f487fea8f37076f565
Size 1.3MB
Sample260909-vxtyesda44
SHA256 1654f77db19a67e57421a3c293fa9ebe3a82b4baca8d82f487fea8f37076f565
MD5 8a4ad442e545dd699c786bd0157b6b8d
SHA1 c373589ddfb982450e7cdbcdb543a2ba5531d230
SHA512 c0c682f5e3a0e243877b910dd606e1e34774749441a2a983cd10e15cdd55ad1f9903fa72f4f20b54fa3c07c3064ca94e9856b5c13407f542f49b2187a182f643
SSDEEP 12288:y2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:lnQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T1EE5502566FECA48DF5B34774AD768055A632BC649F12D2EFB100630D9876BC08EB2723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1654f77db19a67e57421a3c293fa9ebe3a82b4baca8d82f487fea8f37076f565

File Explorer

1654f77db19a67e57421a3c293fa9ebe3a82b4baca8d82f487fea8f37076f565

.exe 1.3MB

1654f77db19a67e57421a3c293fa9ebe3a82b4baca8d82f487fea8f37076f565

IMPHASH a220beeafc75603adf8a3e0eebda23d9
SHA256 1654f77db19a67e57421a3c293fa9ebe3a82b4baca8d82f487fea8f37076f565
MD5 8a4ad442e545dd699c786bd0157b6b8d
SHA1 c373589ddfb982450e7cdbcdb543a2ba5531d230
SHA512 c0c682f5e3a0e243877b910dd606e1e34774749441a2a983cd10e15cdd55ad1f9903fa72f4f20b54fa3c07c3064ca94e9856b5c13407f542f49b2187a182f643
SSDEEP 12288:y2GyS0VTBG//sop9bw/W1wR/kjy6FtgQAdJsg0HjoMWQ:lnQ/tbw/2Mkjy6Fr7g0oQ
TLSH
T1EE5502566FECA48DF5B34774AD768055A632BC649F12D2EFB100630D9876BC08EB2723
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

10

Entry point

19328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

diagtrackrunner.pdb

advapi32

EventWriteTransfer RegCreateKeyExW RegDeleteValueW RegGetValueW RegCloseKey OpenThreadToken

kernel32

LoadLibraryExW SetEnvironmentVariableW GetModuleHandleExW OutputDebugStringW GetModuleHandleW GetCurrentThread FormatMessageW RaiseException GetLastError SetLastError GetProcAddress GetModuleFileNameA GetCurrentThreadId CloseHandle ExpandEnvironmentStringsW GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter Sleep QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetTickCount TerminateProcess

msvcrt

_CxxThrowException ??0exception@@QEAA@AEBV0@@Z ??1exception@@UEAA@XZ ?what@exception@@UEBAPEBDXZ _callnewh _XcptFilter _amsg_exit __wgetmainargs __set_app_type exit _exit _cexit __setusermatherr ??0exception@@QEAA@AEBQEBD@Z __C_specific_handler _fmode _commode ?terminate@@YAXXZ _lock _unlock __dllonexit _onexit ??1type_info@@UEAA@XZ _purecall _vsnwprintf malloc memcpy _initterm __CxxFrameHandler3 free memmove _wcsicmp ??3@YAXPEAX@Z ??0exception@@QEAA@AEBQEBDH@Z memset

ntdll

RtlLookupFunctionEntry RtlCaptureContext RtlVirtualUnwind

userenv

ExpandEnvironmentStringsForUserW

diagtrack

RunDll32Main

Name

.text

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

35KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

1654f77db19a67e57421a3c293fa9ebe3a82b4baca8d82f487fea8f37076f565

advapi32

kernel32

msvcrt

ntdll

userenv

diagtrack

generic