1aabe00bc635571ebc9b9c41dcba119a9d49f80c70b9f9e8d26f9fb9743a6304

Sharing

Copy URL Twitter E-mail

General

Target
1aabe00bc635571ebc9b9c41dcba119a9d49f80c70b9f9e8d26f9fb9743a6304
Size 737KB
Sample260910-3ya6pshr5v
SHA256 1aabe00bc635571ebc9b9c41dcba119a9d49f80c70b9f9e8d26f9fb9743a6304
MD5 2af55e53f0619d0464df703b261f9f33
SHA1 d19ee507f24c8ce649c0946cdc0b663b2742c9ae
SHA512 d3627f0a892570f35b04a163c93418ad8d1223efb2036b0bf6b27c98844bdb8b93ef996de59f8976a1df9b3de911f59e8e096a55e04861e0981f636ce51d7397
SSDEEP 12288:32cV/KnYxigd+RhFTRtysRJo1/Rv3qsk22xIqn8V:mY/wYwgMRtyBV9V+8
TLSH
T13DF42A47FA6685E8D56AC03C8B5AA136F63278D9473066EB23941B2D3F53FD06E2D340
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1aabe00bc635571ebc9b9c41dcba119a9d49f80c70b9f9e8d26f9fb9743a6304

File Explorer

1aabe00bc635571ebc9b9c41dcba119a9d49f80c70b9f9e8d26f9fb9743a6304

.exe 737KB

1aabe00bc635571ebc9b9c41dcba119a9d49f80c70b9f9e8d26f9fb9743a6304

IMPHASH 814dcbbe8310950c83d3b5258f29f3c8
SHA256 1aabe00bc635571ebc9b9c41dcba119a9d49f80c70b9f9e8d26f9fb9743a6304
MD5 2af55e53f0619d0464df703b261f9f33
SHA1 d19ee507f24c8ce649c0946cdc0b663b2742c9ae
SHA512 d3627f0a892570f35b04a163c93418ad8d1223efb2036b0bf6b27c98844bdb8b93ef996de59f8976a1df9b3de911f59e8e096a55e04861e0981f636ce51d7397
SSDEEP 12288:32cV/KnYxigd+RhFTRtysRJo1/Rv3qsk22xIqn8V:mY/wYwgMRtyBV9V+8
TLSH
T13DF42A47FA6685E8D56AC03C8B5AA136F63278D9473066EB23941B2D3F53FD06E2D340
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

472236

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

none.pdb

kernel32

CreateThread ReadFileEx SleepEx WriteFileEx FormatMessageW QueryPerformanceFrequency QueryPerformanceCounter GetCurrentThreadId VirtualAlloc GlobalMemoryStatusEx RtlVirtualUnwind CreateEventW GetOverlappedResult ReadFile CancelIo CreateProcessW CreateWaitableTimerExW SetWaitableTimer Sleep ReleaseMutex VirtualQueryEx SetThreadAffinityMask GetCurrentThread GetSystemInfo CreateMutexA GetCurrentProcessId CreateToolhelp32Snapshot Process32FirstW Process32NextW OpenProcess GetProcessTimes GetSystemTimes GetProcessIoCounters WaitForSingleObjectEx CopyFileExW ReadProcessMemory GetTempPathW GetFileAttributesW RtlLookupFunctionEntry GetSystemDirectoryW CreateDirectoryW HeapAlloc FindClose FindFirstFileExW GetFileInformationByHandleEx K32GetPerformanceInfo GetFileInformationByHandle GetFullPathNameW FreeLibrary GetModuleHandleA LoadLibraryA SetFileInformationByHandle MoveFileExW SetLastError DuplicateHandle CreateFileW LocalFree DeleteFileW GetModuleFileNameW RtlCaptureContext ExitProcess CreateProcessA LoadLibraryExW SetThreadStackGuarantee HeapReAlloc GetCommandLineW GetConsoleMode GetConsoleOutputCP GetStdHandle EncodePointer MultiByteToWideChar WriteConsoleW GetCurrentDirectoryW WideCharToMultiByte lstrlenW GetEnvironmentVariableW CompareStringOrdinal GetSystemTimePreciseAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW AddVectoredExceptionHandler GetExitCodeProcess WaitForSingleObject DeleteCriticalSection WaitForMultipleObjects VirtualFree GetLargePageMinimum RtlUnwindEx CloseHandle HeapFree GetProcessHeap VirtualProtect InitializeCriticalSectionAndSpinCount RaiseException TlsAlloc RtlPcToFileHeader SetProcessInformation TlsGetValue SwitchToThread TlsSetValue GetProcAddress GetModuleHandleW GetCurrentProcess SetHandleInformation GetWindowsDirectoryW GetLastError TlsFree UnhandledExceptionFilter InitializeSListHead IsDebuggerPresent SetUnhandledExceptionFilter IsProcessorFeaturePresent TerminateProcess GetSystemTimeAsFileTime

crypt32

CertOpenStore CertCreateCertificateContext CertVerifyCertificateChainPolicy CertDuplicateCertificateChain CertAddCertificateContextToStore CertEnumCertificatesInStore CertDuplicateStore CryptStringToBinaryA CertFreeCertificateChain CertFreeCertificateContext CertCloseStore CertGetCertificateChain CertDuplicateCertificateContext

secur32

DeleteSecurityContext QueryContextAttributesW FreeContextBuffer AcceptSecurityContext FreeCredentialsHandle AcquireCredentialsHandleA DecryptMessage EncryptMessage InitializeSecurityContextW

advapi32

QueryServiceStatusEx RegSetValueExW CopySid AdjustTokenPrivileges LookupPrivilegeValueA RegCreateKeyExW RegCloseKey StartServiceCtrlDispatcherW RegQueryValueExW GetTokenInformation OpenSCManagerW RegOpenKeyExW RegisterServiceCtrlHandlerExW OpenProcessToken GetLengthSid IsValidSid OpenServiceW QueryServiceConfigW SetServiceStatus DeleteService ControlService ChangeServiceConfig2W CreateServiceW StartServiceW CloseServiceHandle

bcryptprimitives

ProcessPrng

ntdll

NtWriteFile RtlNtStatusToDosError NtReadFile NtOpenFile NtCreateNamedPipeFile RtlGetVersion NtQueryInformationProcess

ws2_32

WSAGetLastError getaddrinfo freeaddrinfo WSASocketW connect closesocket WSAStartup WSACleanup recv WSASend getsockname getpeername WSARecv setsockopt send

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

shell32

ShellExecuteW CommandLineToArgvW

pdh

PdhRemoveCounter PdhAddEnglishCounterW PdhGetFormattedCounterValue PdhOpenQueryA PdhEnumObjectsA PdhCloseQuery PdhCollectQueryData

psapi

GetModuleFileNameExW GetProcessMemoryInfo

oleaut32

GetErrorInfo

powrprof

CallNtPowerInformation

api-ms-win-crt-math-l1-1-0

roundf __setusermatherr

api-ms-win-crt-convert-l1-1-0

_wtoi64

api-ms-win-crt-string-l1-1-0

strlen strcmp wcsncmp strcpy_s wcslen

api-ms-win-crt-runtime-l1-1-0

abort _register_onexit_function __p___argc _exit _crt_atexit terminate _initialize_onexit_table exit _invoke_watson _register_thread_local_exe_atexit_callback _c_exit _seh_filter_exe _set_app_type _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm __p___argv _cexit _initterm_e

api-ms-win-crt-heap-l1-1-0

_aligned_malloc calloc _callnewh malloc _set_new_mode _aligned_free free

api-ms-win-crt-utility-l1-1-0

_rotr64 _rotl64

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

491KB

Virtual Size

491KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

216KB

Virtual Size

216KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RANDOMX

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

1aabe00bc635571ebc9b9c41dcba119a9d49f80c70b9f9e8d26f9fb9743a6304

kernel32

crypt32

secur32

advapi32

bcryptprimitives

ntdll

ws2_32

api-ms-win-core-synch-l1-2-0

shell32

pdh

psapi

oleaut32

powrprof

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic