24e56d84cd74e509f315b1a52b714a2863d18affd99b38680a04325bb9f1d27c

Sharing

Copy URL Twitter E-mail

General

Target
24e56d84cd74e509f315b1a52b714a2863d18affd99b38680a04325bb9f1d27c
Size 525KB
Sample260916-2a1wsagk5s
SHA256 24e56d84cd74e509f315b1a52b714a2863d18affd99b38680a04325bb9f1d27c
MD5 aad314e52dc76ac316ae1fa194a71bb1
SHA1 cd3043e963a0b7f90365a44b6482b8a1d7e936ac
SHA512 7edd957f381329af87cfd395bb3f8306096633b28df5ef5603214047417f97288811f5f258e2a41819569f07874db79e29df48fb17a44e39c225ed0de987ee9b
SSDEEP 12288:99fvuLnLMWDX+9j7Zk+ttk78imIH/+mOLOapnBtjetD:9hvuLTDX+9BO7L/C3jeF
TLSH
T1D6B4C052F98074FBE88F04B0203D93795A3E95140B24CDE7E7D79E559E783E20A325BA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
24e56d84cd74e509f315b1a52b714a2863d18affd99b38680a04325bb9f1d27c

File Explorer

24e56d84cd74e509f315b1a52b714a2863d18affd99b38680a04325bb9f1d27c

.dll 525KB

24e56d84cd74e509f315b1a52b714a2863d18affd99b38680a04325bb9f1d27c

IMPHASH 9425457ac4332333d010e1c57099ff18
SHA256 24e56d84cd74e509f315b1a52b714a2863d18affd99b38680a04325bb9f1d27c
MD5 aad314e52dc76ac316ae1fa194a71bb1
SHA1 cd3043e963a0b7f90365a44b6482b8a1d7e936ac
SHA512 7edd957f381329af87cfd395bb3f8306096633b28df5ef5603214047417f97288811f5f258e2a41819569f07874db79e29df48fb17a44e39c225ed0de987ee9b
SSDEEP 12288:99fvuLnLMWDX+9j7Zk+ttk78imIH/+mOLOapnBtjetD:9hvuLTDX+9BO7L/C3jeF
TLSH
T1D6B4C052F98074FBE88F04B0203D93795A3E95140B24CDE7E7D79E559E783E20A325BA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

262350

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

secondstage.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

ntdll

NtReadVirtualMemory NtReadFile NtCreateNamedPipeFile NtOpenFile NtWriteFile RtlCaptureContext NtOpenProcess RtlUnwind NtQueryObject NtQueryInformationProcess NtMapViewOfSection NtCreateSection RtlNtStatusToDosError

bcrypt

BCryptGenRandom

advapi32

SystemFunction036 CloseServiceHandle StartServiceA OpenServiceA EnumServicesStatusA OpenSCManagerA LookupAccountSidA RegEnumKeyExW RegCloseKey RegQueryValueExW RegOpenKeyExW GetTokenInformation AdjustTokenPrivileges LookupPrivilegeValueA OpenProcessToken

kernel32

LCMapStringW GetFileType GetStringTypeW HeapSize SetStdHandle FlushFileBuffers WriteFile SetFilePointerEx GetEnvironmentVariableW GetCurrentProcess CloseHandle GetSystemTime SystemTimeToFileTime FileTimeToSystemTime GetSystemWow64DirectoryW GetModuleHandleExW GetModuleFileNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW LoadLibraryA GetProcAddress GetModuleHandleA GetCommandLineW VirtualProtect GetModuleFileNameA CreateFileA GetFileSize ReadFile CreateFileMappingW MapViewOfFile UnmapViewOfFile SetFileAttributesW CreateMutexA GetLastError GetFileInformationByHandle GetFileInformationByHandleEx WaitForSingleObject OpenProcess TerminateProcess CreateThread HeapCreate HeapAlloc Process32First Process32Next DuplicateHandle CreateTimerQueue CreateEventW SetEvent DeleteTimerQueue GetProcessHeap HeapFree HeapReAlloc GetCurrentThreadId SetLastError GetCurrentDirectoryW GetCurrentThread ReleaseMutex WaitForSingleObjectEx lstrlenW GetCurrentProcessId WideCharToMultiByte GetStdHandle GetConsoleMode GetConsoleOutputCP MultiByteToWideChar WriteConsoleW GetFullPathNameW CreateFileW SetFileInformationByHandle GetModuleHandleW FormatMessageW SetHandleInformation SetThreadStackGuarantee SleepEx ReadFileEx WriteFileEx QueryPerformanceCounter QueryPerformanceFrequency CreateWaitableTimerExW SetWaitableTimer Sleep ExitProcess CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetEnvironmentStringsW FreeEnvironmentStringsW GetFileAttributesW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose DecodePointer RaiseException LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount DeleteCriticalSection LeaveCriticalSection GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent InterlockedFlushSList EncodePointer EnterCriticalSection

ole32

CoUninitialize CoInitializeEx CoCreateInstance

oleaut32

SysAllocString SysFreeString

user32

EnumDisplayDevicesW

ws2_32

WSAStartup getaddrinfo closesocket freeaddrinfo WSASocketW connect WSACleanup WSAGetLastError

Sharing

General

Malware Config

Signatures

File Explorer

24e56d84cd74e509f315b1a52b714a2863d18affd99b38680a04325bb9f1d27c

api-ms-win-core-synch-l1-2-0

ntdll

bcrypt

advapi32

kernel32

ole32

oleaut32

user32

ws2_32

generic