77714a501bb4889a696df750e0348ac09375666c8888a5433d25506fba96f5e9

Sharing

Copy URL Twitter E-mail

General

Target
77714a501bb4889a696df750e0348ac09375666c8888a5433d25506fba96f5e9
Size 521KB
Sample260916-kydbyshm41
SHA256 77714a501bb4889a696df750e0348ac09375666c8888a5433d25506fba96f5e9
MD5 ec2d233837e4e81756934c38ef3ee5c2
SHA1 8f8794e297f53e90bda2272d0332506dac192677
SHA512 b9fff405f9cadbfa8ec0032d3bdcaf24553bdbf162ab9e65e290d680114fee8771d30c2ec9b060d9ad3124964d3a6aa5d5bb6df12e04b84a5e07d8f1fa8b1657
SSDEEP 12288:nYl/621ZJcw4pxOT389NB78F8pekcLZU/60:SC21ZJcw4pxa3c7b5cdy60
TLSH
T113B46C47B6A552FCD16AC078834A9673F637B88E062079BF03E487302E65F605F1DB29
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
77714a501bb4889a696df750e0348ac09375666c8888a5433d25506fba96f5e9

File Explorer

77714a501bb4889a696df750e0348ac09375666c8888a5433d25506fba96f5e9

.exe 521KB

77714a501bb4889a696df750e0348ac09375666c8888a5433d25506fba96f5e9

IMPHASH 4a79c195d7340233a5f62ed12eb93ff5
SHA256 77714a501bb4889a696df750e0348ac09375666c8888a5433d25506fba96f5e9
MD5 ec2d233837e4e81756934c38ef3ee5c2
SHA1 8f8794e297f53e90bda2272d0332506dac192677
SHA512 b9fff405f9cadbfa8ec0032d3bdcaf24553bdbf162ab9e65e290d680114fee8771d30c2ec9b060d9ad3124964d3a6aa5d5bb6df12e04b84a5e07d8f1fa8b1657
SSDEEP 12288:nYl/621ZJcw4pxOT389NB78F8pekcLZU/60:SC21ZJcw4pxa3c7b5cdy60
TLSH
T113B46C47B6A552FCD16AC078834A9673F637B88E062079BF03E487302E65F605F1DB29
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

SystemFunction036

bcrypt

BCryptGenRandom

kernel32

AddVectoredExceptionHandler CancelIo CompareStringOrdinal CreateEventW CreateFileMappingA CreateFileW CreateProcessW CreateThread CreateToolhelp32Snapshot CreateWaitableTimerExW FormatMessageW FreeEnvironmentStringsW GetCommandLineW GetCurrentDirectoryW GetCurrentProcess GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetOverlappedResult GetProcAddress GetProcessHeap GetStartupInfoA HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete MapViewOfFile Module32FirstW Module32NextW MultiByteToWideChar ReadFile ReadFileEx RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep SleepEx SwitchToThread TlsAlloc TlsFree TlsGetValue TlsSetValue UnmapViewOfFile WaitForMultipleObjects WaitForSingleObject WriteFileEx CloseHandle DeleteFileW DuplicateHandle FindClose FindFirstFileExW FindNextFileW GetConsoleMode GetConsoleOutputCP GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFullPathNameW GetLastError GetStdHandle GetSystemDirectoryW GetSystemTimePreciseAsFileTime GetWindowsDirectoryW SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetLastError WriteConsoleW DeleteCriticalSection EnterCriticalSection InitializeCriticalSection LeaveCriticalSection RaiseException RtlUnwindEx VirtualProtect VirtualQuery __C_specific_handler

ntdll

NtOpenFile NtReadFile NtWriteFile RtlNtStatusToDosError NtCreateNamedPipeFile

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

msvcrt

__getmainargs __initenv __iob_func __set_app_type __setusermatherr _acmdln _amsg_exit _cexit _commode _fmode _fpreset _initterm _onexit abort calloc exit fprintf free fwrite malloc memcmp memcpy memmove memset signal strlen strncmp vfprintf

Name

.text

Size

402KB

Virtual Size

401KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

74KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

544B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

77714a501bb4889a696df750e0348ac09375666c8888a5433d25506fba96f5e9

advapi32

bcrypt

kernel32

ntdll

api-ms-win-core-synch-l1-2-0

bcryptprimitives

msvcrt

generic