2c5616074118bc491dbb6bd33f1f9b44b214aa271665e86aa174bafc98d2628d

General

Target
2c5616074118bc491dbb6bd33f1f9b44b214aa271665e86aa174bafc98d2628d
Size 1.2MB
Sample260916-3el4vsgn7x
SHA256 2c5616074118bc491dbb6bd33f1f9b44b214aa271665e86aa174bafc98d2628d
MD5 a953390a4f92a8dde5c394ce0c24e97b
SHA1 ef21d289f39d316cf6594c80d476b2109daf5a3c
SHA512 528694b5dcb0481d027e933ca28f7a0d522292fb1d87bfa244576e308cdb408c7cb3c9876cb366dffca2ff0a04718c94d70d2dcd320d0a2d8f41f7ecd31ccbfa
SSDEEP 12288:GA3dmTaMd3SMKEYAcIWEXEqXQdQWRr9vES+wq7PXyajgiW:GKmeMd3Swt8EjXQdl9vjq7no
TLSH
T1AE452387A31184F2D3B113F2847285BB65352BC2AB46B0FB26F477295439AD30B7ED52
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2c5616074118bc491dbb6bd33f1f9b44b214aa271665e86aa174bafc98d2628d

File Explorer

2c5616074118bc491dbb6bd33f1f9b44b214aa271665e86aa174bafc98d2628d

.exe 1.2MB

2c5616074118bc491dbb6bd33f1f9b44b214aa271665e86aa174bafc98d2628d

IMPHASH cf79fce90fced31836373f3e48251a5d
SHA256 2c5616074118bc491dbb6bd33f1f9b44b214aa271665e86aa174bafc98d2628d
MD5 a953390a4f92a8dde5c394ce0c24e97b
SHA1 ef21d289f39d316cf6594c80d476b2109daf5a3c
SHA512 528694b5dcb0481d027e933ca28f7a0d522292fb1d87bfa244576e308cdb408c7cb3c9876cb366dffca2ff0a04718c94d70d2dcd320d0a2d8f41f7ecd31ccbfa
SSDEEP 12288:GA3dmTaMd3SMKEYAcIWEXEqXQdQWRr9vES+wq7PXyajgiW:GKmeMd3Swt8EjXQdl9vjq7no
TLSH
T1AE452387A31184F2D3B113F2847285BB65352BC2AB46B0FB26F477295439AD30B7ED52
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

10

Entry point

5344

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dllhost.pdb

api-ms-win-crt-runtime-l1-1-0

_c_exit _register_thread_local_exe_atexit_callback _initterm_e _initterm

api-ms-win-crt-private-l1-1-0

_o__cexit _o__configthreadlocale _o__configure_wide_argv _o__crt_atexit _o__exit _o__get_wide_winmain_command_line _o__initialize_onexit_table _o__initialize_wide_environment _o__register_onexit_function _o__seh_filter_exe _o__set_app_type _o__set_fmode _o__set_new_mode _o__wcsicmp _o_exit _o_terminate __C_specific_handler _o___p__commode

api-ms-win-crt-string-l1-1-0

memset

ntdll

RtlLookupFunctionEntry RtlVirtualUnwind RtlCaptureContext

api-ms-win-core-com-private-l1-1-0

CoRegisterSurrogateEx

api-ms-win-core-processthreads-l1-1-0

GetStartupInfoW GetCurrentThreadId GetCurrentProcessId GetCurrentProcess TerminateProcess

api-ms-win-core-com-l1-1-0

CoUninitialize IIDFromString CoInitializeEx

api-ms-win-core-heap-l1-1-0

HeapSetInformation

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter SetUnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW

Name

.text

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

512B

Virtual Size

420B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

1000B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

2c5616074118bc491dbb6bd33f1f9b44b214aa271665e86aa174bafc98d2628d

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

ntdll

api-ms-win-core-com-private-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-libraryloader-l1-2-0

generic