1f6f422b22161e4ff11863e544f3a95f011e8155b0a468b6b7cded3d3dd24f08

Sharing

Copy URL Twitter E-mail

General

Target
1f6f422b22161e4ff11863e544f3a95f011e8155b0a468b6b7cded3d3dd24f08
Size 1.6MB
Sample260916-1f4desfr2t
SHA256 1f6f422b22161e4ff11863e544f3a95f011e8155b0a468b6b7cded3d3dd24f08
MD5 e84b7ea5a93defb273534441cad23e25
SHA1 a91c02f8ae258970ef45822a9e87e44e34795fd5
SHA512 776d3d4d0115ad06031f92238aa0c9afd0b5de788a58864f4d6c651edf9dff13c5e9efa70a95b906ac988329c0b6c1fd8d0bb7067d88f2515efb12acef422703
SSDEEP 49152:6a081yqN54j49LEMjG6ZU6CENlc7dpJLrQWd:6MN54ILEMjG69CEN6rV
TLSH
T13375F19263A408F6D1974038DD43CA22F6767448233463DF46E4DAE52F63EF6AA3E315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1f6f422b22161e4ff11863e544f3a95f011e8155b0a468b6b7cded3d3dd24f08

File Explorer

1f6f422b22161e4ff11863e544f3a95f011e8155b0a468b6b7cded3d3dd24f08

.exe 1.6MB

1f6f422b22161e4ff11863e544f3a95f011e8155b0a468b6b7cded3d3dd24f08

IMPHASH cfc72b54eec6e472e94998c57ae60121
SHA256 1f6f422b22161e4ff11863e544f3a95f011e8155b0a468b6b7cded3d3dd24f08
MD5 e84b7ea5a93defb273534441cad23e25
SHA1 a91c02f8ae258970ef45822a9e87e44e34795fd5
SHA512 776d3d4d0115ad06031f92238aa0c9afd0b5de788a58864f4d6c651edf9dff13c5e9efa70a95b906ac988329c0b6c1fd8d0bb7067d88f2515efb12acef422703
SSDEEP 49152:6a081yqN54j49LEMjG6ZU6CENlc7dpJLrQWd:6MN54ILEMjG69CEN6rV
TLSH
T13375F19263A408F6D1974038DD43CA22F6767448233463DF46E4DAE52F63EF6AA3E315
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

285520

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\BWA\BonjourWin_x64-94\srcroot\mDNSWindows\SystemService\x64\Release\mDNSResponder.pdb

ws2_32

closesocket WSAStringToAddressA WSAGetLastError recv listen accept inet_addr WSACreateEvent WSAEventSelect WSACloseEvent WSAEnumNetworkEvents WSAStartup WSACleanup WSAAddressToStringA htons connect ioctlsocket getsockname WSARecvFrom socket setsockopt WSAIoctl bind sendto send htonl

iphlpapi

GetIpForwardTable GetAdaptersInfo GetNetworkParams GetPerAdapterInfo GetBestInterface CreateIpForwardEntry DeleteIpForwardEntry GetIpAddrTable

netapi32

NetGetJoinInformation NetShareEnum NetApiBufferFree

powrprof

SetSuspendState

kernel32

GetLastError GetComputerNameExA WideCharToMultiByte SetEvent WaitForMultipleObjects CreateEventW GetProcAddress LoadLibraryW SetWaitableTimer CloseHandle DeviceIoControl CreateFileA GetComputerNameExW GetTickCount GlobalAlloc GlobalFree Sleep WaitForSingleObject GetVersionExW CreateWaitableTimerW OpenThread GetCurrentThreadId ResetEvent TerminateThread MultiByteToWideChar GetModuleFileNameW CancelWaitableTimer GetSystemPowerStatus GetFullPathNameW SetConsoleCtrlHandler GetModuleHandleW HeapSetInformation SetLastError FormatMessageA FlsAlloc ExitProcess WriteFile GetStdHandle GetVersion FreeLibrary HeapCreate GetConsoleCP GetConsoleMode FlushFileBuffers RtlUnwindEx CreateFileW InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetHandleCount GetFileType GetStartupInfoW LCMapStringW FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetCurrentProcessId GetStringTypeW WriteConsoleW SetFilePointer SetStdHandle HeapSize QueueUserAPC FlsFree FlsSetValue FlsGetValue IsValidCodePage GetOEMCP GetACP GetCPInfo RtlCaptureContext GetSystemTimeAsFileTime HeapAlloc HeapFree EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection HeapReAlloc ExitThread CreateThread ResumeThread GetCommandLineW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry

user32

LoadStringW

advapi32

LsaNtStatusToWinError RegisterServiceCtrlHandlerExW DeregisterEventSource StartServiceCtrlDispatcherW SetServiceStatus QueryServiceStatus ControlService DeleteService CreateServiceW StartServiceW RegNotifyChangeKeyValue RegisterEventSourceW ReportEventA LockServiceDatabase OpenServiceW ChangeServiceConfig2W UnlockServiceDatabase OpenSCManagerW EnumServicesStatusW CloseServiceHandle LsaOpenPolicy LsaRetrievePrivateData LsaFreeMemory LsaClose RegOpenKeyExW RegCreateKeyA RegQueryInfoKeyW RegEnumKeyExA RegOpenKeyExA RegQueryValueExA RegQueryValueExW RegCreateKeyW RegSetValueExW RegCloseKey

ole32

CoInitializeEx CoUninitialize CoCreateInstance

oleaut32

SysFreeString SysStringLen SysAllocString

Name

.text

Size

314KB

Virtual Size

313KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

103KB

Virtual Size

103KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

201KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

1f6f422b22161e4ff11863e544f3a95f011e8155b0a468b6b7cded3d3dd24f08

ws2_32

iphlpapi

netapi32

powrprof

kernel32

user32

advapi32

ole32

oleaut32

generic