83d874507817a85f88d73e54fb3052e354df7bcb759b77ad53d14bb1c7b37bf8

Sharing

Copy URL Twitter E-mail

General

Target
83d874507817a85f88d73e54fb3052e354df7bcb759b77ad53d14bb1c7b37bf8
Size 9.3MB
Sample260910-31d1daxfla
SHA256 83d874507817a85f88d73e54fb3052e354df7bcb759b77ad53d14bb1c7b37bf8
MD5 8a4c03cda09991000fb461b3e0f5293e
SHA1 7ad8a0adc468c6d5a0a32c0132870fe758fd1930
SHA512 1b740d20ded71769ffae9024d3b971781d253ab7f112d993a09f32800a87a612dc1627b43c8ec5d1531070d5e35d580a781ef5c751c89d376462584083782604
SSDEEP 98304:BnrqUNAgF1LWRCr+Qv4hT7wC1Q3B31IBh+EXVVMvZ9rsooOiZFQn+S:FMgDLZu1Ql1IBjUvkvdj2
TLSH
T13FA66B03F69580E9C0ADC1B8832B9637FB76BC894524B26B5BE44F212F26F506F1C759
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
83d874507817a85f88d73e54fb3052e354df7bcb759b77ad53d14bb1c7b37bf8

File Explorer

83d874507817a85f88d73e54fb3052e354df7bcb759b77ad53d14bb1c7b37bf8

.exe 9.3MB

83d874507817a85f88d73e54fb3052e354df7bcb759b77ad53d14bb1c7b37bf8

IMPHASH 1e95cb1cbd6d6de4f43dac82a0101a71
SHA256 83d874507817a85f88d73e54fb3052e354df7bcb759b77ad53d14bb1c7b37bf8
MD5 8a4c03cda09991000fb461b3e0f5293e
SHA1 7ad8a0adc468c6d5a0a32c0132870fe758fd1930
SHA512 1b740d20ded71769ffae9024d3b971781d253ab7f112d993a09f32800a87a612dc1627b43c8ec5d1531070d5e35d580a781ef5c751c89d376462584083782604
SSDEEP 98304:BnrqUNAgF1LWRCr+Qv4hT7wC1Q3B31IBh+EXVVMvZ9rsooOiZFQn+S:FMgDLZu1Ql1IBjUvkvdj2
TLSH
T13FA66B03F69580E9C0ADC1B8832B9637FB76BC894524B26B5BE44F212F26F506F1C759
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6971196

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

analytics_client.pdb

kernel32

LocalFree GetProcessTimes VirtualQueryEx UnhandledExceptionFilter GetProcAddress LoadLibraryExA GetProcessIoCounters GetSystemTimes GetCurrentThreadId K32GetPerformanceInfo FreeConsole CreateFileW LockFileEx GetFileInformationByHandle GlobalMemoryStatusEx DeleteCriticalSection GetSystemTimePreciseAsFileTime TryEnterCriticalSection lstrlenW ExitProcess GetExitCodeProcess WaitForMultipleObjects DeviceIoControl FindClose UnlockFileEx SetFilePointer SetEndOfFile LeaveCriticalSection SleepEx CreateThread DuplicateHandle GetQueuedCompletionStatusEx CreateProcessW GetWindowsDirectoryW CreateIoCompletionPort SetFileCompletionNotificationModes GetSystemDirectoryW SetHandleInformation FormatMessageW QueryPerformanceFrequency ReadDirectoryChangesW CancelIo GetModuleHandleA EnterCriticalSection InitializeCriticalSection SetWaitableTimer CreateWaitableTimerExW RaiseException OutputDebugStringA CreateMutexW HeapValidate HeapSize OutputDebugStringW FlushViewOfFile HeapCompact HeapDestroy GetSystemTimeAsFileTime GetSystemTime FormatMessageA GetTickCount HeapCreate GetModuleHandleW ReleaseMutex CreateMutexA GetCurrentProcessId GetStdHandle GetConsoleMode GetConsoleOutputCP SetLastError MultiByteToWideChar WriteConsoleW LoadLibraryA WideCharToMultiByte GetModuleFileNameW GetFileInformationByHandleEx RtlVirtualUnwind GetFullPathNameW SetFileInformationByHandle GetFinalPathNameByHandleW SetFilePointerEx FindNextFileW CreateDirectoryW FindFirstFileExW RtlLookupFunctionEntry RtlCaptureContext QueryPerformanceCounter Sleep CompareStringOrdinal GetFileAttributesW ReleaseSemaphore ReadFileEx WriteFileEx GetOverlappedResult ReadFile DeleteFileW PostQueuedCompletionStatus FreeLibrary OpenProcess WaitForSingleObjectEx SetUnhandledExceptionFilter MoveFileExW SetFileTime GetDiskFreeSpaceW WriteFile AreFileApisANSI FlushFileBuffers GetFileSize UnlockFile LoadLibraryW DeleteFileA CreateFileA GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA GetTempPathW GetFullPathNameA LockFile ReadProcessMemory GetSystemInfo VirtualProtect MapViewOfFile UnmapViewOfFile SetEnvironmentVariableW GetCommandLineW CreateFileMappingW CreateEventW GetTickCount64 GetCurrentProcess TerminateProcess IsProcessorFeaturePresent InitializeSListHead CreateSemaphoreW WaitForSingleObject LocalAlloc GetCurrentDirectoryW GetEnvironmentVariableW GetEnvironmentStringsW FreeEnvironmentStringsW SwitchToThread SystemTimeToFileTime HeapReAlloc GetCurrentThread SetThreadStackGuarantee AddVectoredExceptionHandler GetLastError HeapAlloc CloseHandle HeapFree GetProcessHeap IsDebuggerPresent GetTimeZoneInformationForYear

advapi32

SystemFunction036 RegCloseKey RegSetValueExW RegCreateKeyExW RegQueryValueExW SetServiceStatus RegisterServiceCtrlHandlerExW StartServiceW CreateServiceW ChangeServiceConfig2W OpenSCManagerW OpenServiceW DeleteService OpenProcessToken GetTokenInformation StartServiceCtrlDispatcherW ControlService CloseServiceHandle RegOpenKeyExW GetLengthSid CopySid IsValidSid

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

pdh

PdhCloseQuery PdhCollectQueryData PdhOpenQueryA PdhRemoveCounter PdhGetFormattedCounterValue PdhAddEnglishCounterW

shell32

CommandLineToArgvW SHGetKnownFolderPath

ntdll

NtCreateNamedPipeFile NtWriteFile NtReadFile RtlNtStatusToDosError NtCreateFile NtQueryInformationProcess NtOpenFile NtCancelIoFileEx RtlGetVersion NtDeviceIoControlFile NtQuerySystemInformation

psapi

GetProcessMemoryInfo GetModuleFileNameExW

powrprof

CallNtPowerInformation

oleaut32

SysFreeString SysStringLen GetErrorInfo

ole32

CoTaskMemFree

crypt32

CertFreeCertificateChain CertDuplicateStore CertDuplicateCertificateContext CertVerifyCertificateChainPolicy CertAddCertificateContextToStore CertCloseStore CertGetCertificateChain CertFreeCertificateContext CertEnumCertificatesInStore CertOpenStore CertDuplicateCertificateChain

ws2_32

accept ioctlsocket WSAGetLastError getpeername WSAIoctl socket connect listen WSASocketW setsockopt getaddrinfo freeaddrinfo WSAStartup bind WSACleanup recv send WSASend getsockopt shutdown closesocket getsockname

bcryptprimitives

ProcessPrng

bcrypt

BCryptGenRandom

secur32

FreeContextBuffer QueryContextAttributesW ApplyControlToken EncryptMessage DeleteSecurityContext AcceptSecurityContext AcquireCredentialsHandleA DecryptMessage FreeCredentialsHandle InitializeSecurityContextW

vcruntime140

__C_specific_handler strrchr strchr memchr __current_exception_context __current_exception memmove __CxxFrameHandler3 memset memcpy memcmp

api-ms-win-crt-math-l1-1-0

trunc fmax log2 exp __setusermatherr _dclass fabs roundf log pow ceil

api-ms-win-crt-string-l1-1-0

strlen wcslen strspn strncmp strcspn strcmp

api-ms-win-crt-heap-l1-1-0

_set_new_mode free malloc _msize realloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-runtime-l1-1-0

exit _exit __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _set_app_type _seh_filter_exe _initialize_onexit_table _register_onexit_function _endthreadex _crt_atexit _beginthreadex terminate _initterm_e

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

83d874507817a85f88d73e54fb3052e354df7bcb759b77ad53d14bb1c7b37bf8

kernel32

advapi32

api-ms-win-core-synch-l1-2-0

pdh

shell32

ntdll

psapi

powrprof

oleaut32

ole32

crypt32

ws2_32

bcryptprimitives

bcrypt

secur32

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic