f09cb082856284cdb76220e4d809abf42bbb8f2ca34fdeba8b8226bf51e5c807

Sharing

Copy URL Twitter E-mail

General

Target
f09cb082856284cdb76220e4d809abf42bbb8f2ca34fdeba8b8226bf51e5c807
Size 305KB
Sample260916-k33gmsad22
SHA256 f09cb082856284cdb76220e4d809abf42bbb8f2ca34fdeba8b8226bf51e5c807
MD5 c6dd2af208d19a267a3ba0eda3c2b448
SHA1 66be027989aad3a0ab1b2120900a556a32b2c79f
SHA512 6eddea92046e5383438b6e6ec06b318052d536b64cca6f2079a5135f8b6175d28f9f32b5717e80d1e92f98912074edbac5fd3bfd3b71a587926927630b0aaf3f
SSDEEP 3072:J+NDN4iGTmWLKg3Si2zFiZcQgM6R1iQPW1yRpZz/CWaGPss4DXkyoMmE6Xcpa1+n:JkDZ2dyQgT11P5Vgs4l0+ZD
TLSH
T1EF648E1AF7A510F9D5B7C27DCD424906EB72BC4647A0E78F13E04A962F236A09D3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f09cb082856284cdb76220e4d809abf42bbb8f2ca34fdeba8b8226bf51e5c807

File Explorer

f09cb082856284cdb76220e4d809abf42bbb8f2ca34fdeba8b8226bf51e5c807

.exe 305KB

f09cb082856284cdb76220e4d809abf42bbb8f2ca34fdeba8b8226bf51e5c807

IMPHASH ec2939b1d32e7d24db4a8133a6c16d48
SHA256 f09cb082856284cdb76220e4d809abf42bbb8f2ca34fdeba8b8226bf51e5c807
MD5 c6dd2af208d19a267a3ba0eda3c2b448
SHA1 66be027989aad3a0ab1b2120900a556a32b2c79f
SHA512 6eddea92046e5383438b6e6ec06b318052d536b64cca6f2079a5135f8b6175d28f9f32b5717e80d1e92f98912074edbac5fd3bfd3b71a587926927630b0aaf3f
SSDEEP 3072:J+NDN4iGTmWLKg3Si2zFiZcQgM6R1iQPW1yRpZz/CWaGPss4DXkyoMmE6Xcpa1+n:JkDZ2dyQgT11P5Vgs4l0+ZD
TLSH
T1EF648E1AF7A510F9D5B7C27DCD424906EB72BC4647A0E78F13E04A962F236A09D3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

80732

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

htons __WSAFDIsSet accept bind select listen inet_pton getsockname ntohs setsockopt gethostname inet_ntop WSACleanup WSAStartup recv WSAGetLastError closesocket getaddrinfo inet_addr send socket connect freeaddrinfo

advapi32

LookupAccountSidA OpenProcessToken GetTokenInformation GetUserNameA

secur32

QueryContextAttributesA InitializeSecurityContextA EncryptMessage DecryptMessage FreeCredentialsHandle FreeContextBuffer DeleteSecurityContext AcquireCredentialsHandleA

kernel32

SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP CreateFileW IsValidCodePage FindFirstFileExW HeapReAlloc ReadConsoleW MoveFileExW GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapSize WriteConsoleW SetEndOfFile GetACP GetFileType SetFilePointerEx GetFileSizeEx CreateDirectoryW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW Sleep SetConsoleCP SetConsoleOutputCP ReadFile GetModuleFileNameA SetHandleInformation GetStdHandle TerminateProcess CreatePipe WaitForSingleObject OpenProcess CreateToolhelp32Snapshot MultiByteToWideChar ProcessIdToSessionId GetFileAttributesA Process32NextW Process32FirstW CloseHandle GetNativeSystemInfo WideCharToMultiByte CreateProcessA IsWow64Process GetLogicalDrives FindFirstFileW FindNextFileW FindClose FileTimeToSystemTime DeleteFileA SetFileAttributesA RemoveDirectoryA SystemTimeToTzSpecificLocalTime ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId QueryPerformanceCounter QueryPerformanceFrequency WakeAllConditionVariable InitializeCriticalSectionEx GetSystemTimeAsFileTime RtlUnwind GetModuleHandleW GetProcAddress EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead GetCurrentProcess RtlPcToFileHeader RaiseException RtlUnwindEx GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetModuleFileNameW WriteFile HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree VirtualProtect

user32

SetProcessDPIAware

Name

.text

Size

210KB

Virtual Size

209KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

75KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fig

Size

512B

Virtual Size

72B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

f09cb082856284cdb76220e4d809abf42bbb8f2ca34fdeba8b8226bf51e5c807

ws2_32

advapi32

secur32

kernel32

user32

generic