2abf99bae7e90e45533d6be79a4b930c6aba041bcfbbec1480ea271b2758b004

Sharing

Copy URL Twitter E-mail

General

Target
2abf99bae7e90e45533d6be79a4b930c6aba041bcfbbec1480ea271b2758b004
Size 620KB
Sample260910-m55e5asblf
SHA256 2abf99bae7e90e45533d6be79a4b930c6aba041bcfbbec1480ea271b2758b004
MD5 fae2a7eee17074ca67d419b5ed9d5995
SHA1 dc08d7f965988011b8b1d16364b602e5aae6926d
SHA512 bfb6b90cff3042d619afbf4c95ba7e426c0008c40048cb8c91d233dda4a20947ec662b91b803037f70573e09f75a90d2efd9f527b2ab01dae4731d6ab401f572
SSDEEP 12288:2xsbpK0Os2yUuAlioNMRSn++qL+EaAm+jjGJyU1CxhlVoyB3uq:W0pKjTJqoNn+jL+aUJDY1Og+
TLSH
T17ED42360B23129CAE465553D54E38E42E970BE3E9F6383CF0253437E2578AD9FC52369
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2abf99bae7e90e45533d6be79a4b930c6aba041bcfbbec1480ea271b2758b004

File Explorer

2abf99bae7e90e45533d6be79a4b930c6aba041bcfbbec1480ea271b2758b004

.exe 620KB

2abf99bae7e90e45533d6be79a4b930c6aba041bcfbbec1480ea271b2758b004

IMPHASH 03dc0995a049009733d4ce7f8231048f
SHA256 2abf99bae7e90e45533d6be79a4b930c6aba041bcfbbec1480ea271b2758b004
MD5 fae2a7eee17074ca67d419b5ed9d5995
SHA1 dc08d7f965988011b8b1d16364b602e5aae6926d
SHA512 bfb6b90cff3042d619afbf4c95ba7e426c0008c40048cb8c91d233dda4a20947ec662b91b803037f70573e09f75a90d2efd9f527b2ab01dae4731d6ab401f572
SSDEEP 12288:2xsbpK0Os2yUuAlioNMRSn++qL+EaAm+jjGJyU1CxhlVoyB3uq:W0pKjTJqoNn+jL+aUJDY1Og+
TLSH
T17ED42360B23129CAE465553D54E38E42E970BE3E9F6383CF0253437E2578AD9FC52369
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16112

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Acrobat_SL.pdb

kernel32

CloseHandle GetLastError SetNamedPipeHandleState OpenMutexW Sleep GetTickCount WriteFile CreateProcessA GetModuleFileNameA GetSystemPowerStatus GetStartupInfoW IsDebuggerPresent InitializeSListHead ReadFile GetVolumeInformationW lstrlenW CreateFileW GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetModuleHandleW

user32

FindWindowA

advapi32

RegOpenKeyExW RegCloseKey RegQueryValueExW

msvcp140

?_Incref@facet@locale@std@@UEAAXXZ ?id@?$codecvt@_WDU_Mbstatet@@@std@@2V0locale@2@A ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ??1?$codecvt@_WDU_Mbstatet@@@std@@MEAA@XZ ?_Xlength_error@std@@YAXPEBD@Z ??4?$_Yarn@D@std@@QEAAAEAV01@PEBD@Z ??Bid@locale@std@@QEAA_KXZ ?_New_Locimp@_Locimp@locale@std@@CAPEAV123@AEBV123@@Z ?_Locimp_Addfac@_Locimp@locale@std@@CAXPEAV123@PEAVfacet@23@_K@Z ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?out@?$codecvt@_WDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEB_W1AEAPEB_WPEAD3AEAPEAD@Z ??0?$codecvt@_WDU_Mbstatet@@@std@@QEAA@_K@Z

vcruntime140

_CxxThrowException __std_exception_destroy __std_terminate memset __current_exception_context __current_exception memcpy memmove __C_specific_handler __std_exception_copy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_crt_atexit terminate _cexit _invalid_parameter_noinfo_noreturn _initialize_onexit_table exit _initterm_e _register_onexit_function _initterm _get_narrow_winmain_command_line _initialize_narrow_environment _configure_narrow_argv _register_thread_local_exe_atexit_callback _set_app_type _seh_filter_exe _c_exit _exit

api-ms-win-crt-string-l1-1-0

wcscpy_s

api-ms-win-crt-heap-l1-1-0

free malloc _callnewh _set_new_mode

api-ms-win-crt-filesystem-l1-1-0

_makepath_s _splitpath_s

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s _set_fmode __p__commode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

15KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

589KB

Virtual Size

592KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2abf99bae7e90e45533d6be79a4b930c6aba041bcfbbec1480ea271b2758b004

kernel32

user32

advapi32

msvcp140

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic