0876f1a55e8a599579fdaf4aa9e9e653d813e1633536040dc0d5690547cd3d0e

Sharing

Copy URL Twitter E-mail

General

Target
0876f1a55e8a599579fdaf4aa9e9e653d813e1633536040dc0d5690547cd3d0e
Size 257KB
Sample260916-kqaabsxfrd
SHA256 0876f1a55e8a599579fdaf4aa9e9e653d813e1633536040dc0d5690547cd3d0e
MD5 0fb84ad612bddbb3d9984df3615107fe
SHA1 d1333b86c60027ffb14f54b3399a66637216e2d6
SHA512 ce5861a611490d541f9b83b113a1228f9a396eda14715f5006a94edc0ed87bf4852e57d78de246cb7407e92d368512d0b87df54146ca5b717f18002386873220
SSDEEP 3072:81VX7hMINeeookccoeqmXEyJmUiH2r/u6/2wliDNo3gH9vhK7Ly:sVXNVkv1E6H2AliUy
TLSH
T120446C19B7E50CF9ED77C13DC9924946EBB2BC4A47A0E68F03A04A960F236D05E3E751
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0876f1a55e8a599579fdaf4aa9e9e653d813e1633536040dc0d5690547cd3d0e

File Explorer

0876f1a55e8a599579fdaf4aa9e9e653d813e1633536040dc0d5690547cd3d0e

.exe 257KB

0876f1a55e8a599579fdaf4aa9e9e653d813e1633536040dc0d5690547cd3d0e

IMPHASH 28adb763f0f5896783b21b09e7e864b8
SHA256 0876f1a55e8a599579fdaf4aa9e9e653d813e1633536040dc0d5690547cd3d0e
MD5 0fb84ad612bddbb3d9984df3615107fe
SHA1 d1333b86c60027ffb14f54b3399a66637216e2d6
SHA512 ce5861a611490d541f9b83b113a1228f9a396eda14715f5006a94edc0ed87bf4852e57d78de246cb7407e92d368512d0b87df54146ca5b717f18002386873220
SSDEEP 3072:81VX7hMINeeookccoeqmXEyJmUiH2r/u6/2wliDNo3gH9vhK7Ly:sVXNVkv1E6H2AliUy
TLSH
T120446C19B7E50CF9ED77C13DC9924946EBB2BC4A47A0E68F03A04A960F236D05E3E751
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

54788

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

htons gethostname inet_ntop WSACleanup WSAStartup recv WSAGetLastError closesocket getaddrinfo inet_addr send socket connect freeaddrinfo

advapi32

RevertToSelf RegCloseKey RegQueryValueExA CreateProcessWithTokenW SetThreadToken RegOpenKeyExA RegEnumValueA GetUserNameA GetTokenInformation

secur32

QueryContextAttributesA InitializeSecurityContextA EncryptMessage DecryptMessage FreeCredentialsHandle FreeContextBuffer DeleteSecurityContext AcquireCredentialsHandleA

kernel32

FreeEnvironmentStringsW GetCommandLineW GetProcessHeap SetStdHandle FlushFileBuffers GetConsoleOutputCP GetConsoleMode HeapSize CreateFileW WriteConsoleW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose SetFilePointerEx Sleep SetConsoleCP SetConsoleOutputCP GetModuleFileNameA GetStdHandle TerminateProcess WaitForSingleObject OpenProcess MultiByteToWideChar CloseHandle GetNativeSystemInfo WideCharToMultiByte CreateProcessA WriteProcessMemory VirtualProtect VirtualFree VirtualAlloc ResumeThread GetModuleHandleA LoadLibraryA CreateThread VirtualProtectEx GetProcAddress VirtualAllocEx CreateRemoteThread VirtualFreeEx GetTickCount GetFileType HeapReAlloc ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId QueryPerformanceCounter QueryPerformanceFrequency SleepConditionVariableSRW WakeAllConditionVariable InitializeCriticalSectionEx GetSystemTimeAsFileTime GetModuleHandleW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetModuleFileNameW WriteFile HeapAlloc HeapFree FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW

user32

SetProcessDPIAware

Name

.text

Size

165KB

Virtual Size

165KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

73KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fig

Size

512B

Virtual Size

72B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

0876f1a55e8a599579fdaf4aa9e9e653d813e1633536040dc0d5690547cd3d0e

ws2_32

advapi32

secur32

kernel32

user32

generic