3cf0fe161427e042b7072770b80281fbd6c163d7d54907b4bafb6f60828c9a89

Sharing

Copy URL Twitter E-mail

General

Target
3cf0fe161427e042b7072770b80281fbd6c163d7d54907b4bafb6f60828c9a89
Size 467KB
Sample260916-3khzdsfe44
SHA256 3cf0fe161427e042b7072770b80281fbd6c163d7d54907b4bafb6f60828c9a89
MD5 5f9c78fd82137dbce0bdd37576aa30d5
SHA1 f19a197663c0e3c6065da668121427ce82ed91ed
SHA512 3353e7a51fbceebb72f9915fc00d0eb3789354e73ce5178f87f01cf7e2cdebbe25aacefe30a2376357d41aef4c3e41258056a33e2cc6d415d2c08f295b03f3c0
SSDEEP 3072:N3s3MjFyLsIvyllzDLZcRFe4AJR4LgANkc/WCymUMTX8OqzSwBbrn:5syFyoZL3iayOCXTsOLubrn
TLSH
T169A4A49072E45C93F626833858E3E2313739BA511767CB1BC204993D1E3B7D36ED6A4A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3cf0fe161427e042b7072770b80281fbd6c163d7d54907b4bafb6f60828c9a89

File Explorer

3cf0fe161427e042b7072770b80281fbd6c163d7d54907b4bafb6f60828c9a89

.exe 467KB

3cf0fe161427e042b7072770b80281fbd6c163d7d54907b4bafb6f60828c9a89

IMPHASH 87627dacc88ad1993e2fd59e62f2e225
SHA256 3cf0fe161427e042b7072770b80281fbd6c163d7d54907b4bafb6f60828c9a89
MD5 5f9c78fd82137dbce0bdd37576aa30d5
SHA1 f19a197663c0e3c6065da668121427ce82ed91ed
SHA512 3353e7a51fbceebb72f9915fc00d0eb3789354e73ce5178f87f01cf7e2cdebbe25aacefe30a2376357d41aef4c3e41258056a33e2cc6d415d2c08f295b03f3c0
SSDEEP 3072:N3s3MjFyLsIvyllzDLZcRFe4AJR4LgANkc/WCymUMTX8OqzSwBbrn:5syFyoZL3iayOCXTsOLubrn
TLSH
T169A4A49072E45C93F626833858E3E2313739BA511767CB1BC204993D1E3B7D36ED6A4A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

17984

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

ConvertSidToStringSidW GetTokenInformation GetUserNameW OpenProcessToken RegCloseKey RegCreateKeyExW RegCreateKeyW RegDeleteValueW RegEnumValueW RegOpenKeyExW RegOpenKeyW RegQueryInfoKeyW RegQueryValueExW RegSetValueExW

kernel32

CreateToolhelp32Snapshot DelayLoadFailureHook GetComputerNameW GetPrivateProfileSectionW GetProcAddress HeapAlloc HeapReAlloc IsBadStringPtrA IsBadStringPtrW Process32FirstW Process32NextW ResolveDelayLoadedAPI

kernelbase

CloseHandle CreateEventW CreateFileW CreateProcessW DeleteFileW ExitProcess FindClose FindFirstFileW FindNextFileW GetCommandLineW GetExitCodeProcess GetModuleHandleW GetSystemDirectoryW GetSystemFirmwareTable GetSystemWow64Directory2W GetTickCount GetWindowsDirectoryW InitializeProcThreadAttributeList IsWow64Process LocalFree MapViewOfFile MoveFileExW MultiByteToWideChar OpenProcess ReadFile RemoveDirectoryW ResetEvent SetComputerNameExA SetCurrentDirectoryW SetEvent Sleep TerminateProcess UnmapViewOfFile UpdateProcThreadAttribute VerFindFileW WaitForMultipleObjects WaitForSingleObject Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection lstrcmpiW

ntdll

NtClose NtCreateDirectoryObject NtCreateEvent NtCreateSection NtCreateSymbolicLinkObject NtOpenFile NtOpenSection NtPowerInformation NtQuerySystemInformation NtQuerySystemInformationEx RtlGetSystemTimePrecise RtlGetVersion RtlImageDirectoryEntryToData RtlInitUnicodeString _vsnprintf

rpcrt4

RpcStringFreeW UuidCreate UuidToStringW

ucrtbase

__acrt_iob_func __p___argc __p___argv __stdio_common_vsprintf __stdio_common_vswprintf _chsize _close _configure_narrow_argv _crt_atexit _errno _fstat64i32 _get_initial_narrow_environment _initialize_narrow_environment _initterm _initterm_e _lseek _read _set_app_type _strdup _stricmp _wcsicmp _wgetenv _wopen _write exit free fwrite getenv malloc memmove memset qsort realloc strchr strcmp strcspn strerror strlen strncmp strtoul wcscat wcschr wcscmp wcscpy wcslen wcsncmp

ws2_32

gethostname freeaddrinfo getaddrinfo

Name

.text

Size

40KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

76KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

4KB

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

4KB

Virtual Size

756B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

4KB

Virtual Size

732B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

4KB

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

32KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

160B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

3cf0fe161427e042b7072770b80281fbd6c163d7d54907b4bafb6f60828c9a89

advapi32

kernel32

kernelbase

ntdll

rpcrt4

ucrtbase

ws2_32

generic