6892aa727d515ba278c7524a7bf07ff7d7135b1665ed8e92afd060364de3a8fc

General

Target
6892aa727d515ba278c7524a7bf07ff7d7135b1665ed8e92afd060364de3a8fc
Size 1.2MB
Sample260916-kr39ssxgla
SHA256 6892aa727d515ba278c7524a7bf07ff7d7135b1665ed8e92afd060364de3a8fc
MD5 324c504ebb4efff0ca8782f7188bf1b0
SHA1 a719c1269d3a9fda185271eedd70d8efc0c2147e
SHA512 931d0ab6a6aa306487e65c2cfd253c82fb7acdb9b83164b827b8c7c054618c4c167d64ce9a4596482ef238e678e45e15421e748d950f8340959aa1963708190c
SSDEEP 12288:6N8cS7wBMf6NcUOnFs3JXVU8VRW5o7iZbw0xAIZSs1LWXyyTnLT95Q:6ycBMf6NcUIsZWZZp9YyyTLnQ
TLSH
T19555238D145D02BBE6879375C59484B4C0F1AFA0ABD805CFCFB574A7B8B4C4AAD3C968
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6892aa727d515ba278c7524a7bf07ff7d7135b1665ed8e92afd060364de3a8fc

File Explorer

6892aa727d515ba278c7524a7bf07ff7d7135b1665ed8e92afd060364de3a8fc

.exe 1.2MB

6892aa727d515ba278c7524a7bf07ff7d7135b1665ed8e92afd060364de3a8fc

IMPHASH cf79fce90fced31836373f3e48251a5d
SHA256 6892aa727d515ba278c7524a7bf07ff7d7135b1665ed8e92afd060364de3a8fc
MD5 324c504ebb4efff0ca8782f7188bf1b0
SHA1 a719c1269d3a9fda185271eedd70d8efc0c2147e
SHA512 931d0ab6a6aa306487e65c2cfd253c82fb7acdb9b83164b827b8c7c054618c4c167d64ce9a4596482ef238e678e45e15421e748d950f8340959aa1963708190c
SSDEEP 12288:6N8cS7wBMf6NcUOnFs3JXVU8VRW5o7iZbw0xAIZSs1LWXyyTnLT95Q:6ycBMf6NcUIsZWZZp9YyyTLnQ
TLSH
T19555238D145D02BBE6879375C59484B4C0F1AFA0ABD805CFCFB574A7B8B4C4AAD3C968
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

10

Entry point

5344

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dllhost.pdb

api-ms-win-crt-runtime-l1-1-0

_c_exit _register_thread_local_exe_atexit_callback _initterm_e _initterm

api-ms-win-crt-private-l1-1-0

_o__cexit _o__configthreadlocale _o__configure_wide_argv _o__crt_atexit _o__exit _o__get_wide_winmain_command_line _o__initialize_onexit_table _o__initialize_wide_environment _o__register_onexit_function _o__seh_filter_exe _o__set_app_type _o__set_fmode _o__set_new_mode _o__wcsicmp _o_exit _o_terminate __C_specific_handler _o___p__commode

api-ms-win-crt-string-l1-1-0

memset

ntdll

RtlLookupFunctionEntry RtlVirtualUnwind RtlCaptureContext

api-ms-win-core-com-private-l1-1-0

CoRegisterSurrogateEx

api-ms-win-core-processthreads-l1-1-0

GetStartupInfoW GetCurrentThreadId GetCurrentProcessId GetCurrentProcess TerminateProcess

api-ms-win-core-com-l1-1-0

CoUninitialize IIDFromString CoInitializeEx

api-ms-win-core-heap-l1-1-0

HeapSetInformation

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetSystemTimeAsFileTime

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-debug-l1-1-0

IsDebuggerPresent

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter SetUnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleW

Name

.text

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

512B

Virtual Size

420B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

1000B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.2MB

Virtual Size

1.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

6892aa727d515ba278c7524a7bf07ff7d7135b1665ed8e92afd060364de3a8fc

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

ntdll

api-ms-win-core-com-private-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-com-l1-1-0

api-ms-win-core-heap-l1-1-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-libraryloader-l1-2-0

generic