7353452db9b0e1f00fded174250c2494ac5d7dd9d18cb019a6183d95c0a2f917

Sharing

Copy URL Twitter E-mail

General

Target
7353452db9b0e1f00fded174250c2494ac5d7dd9d18cb019a6183d95c0a2f917
Size 734KB
Sample260916-m5bg2sam8x
SHA256 7353452db9b0e1f00fded174250c2494ac5d7dd9d18cb019a6183d95c0a2f917
MD5 c16b3fb196fc3a77231d4f23ca405a68
SHA1 4017903a75b43b4bdd5b1986125d42d245813598
SHA512 dcfbb6b2c9ba3a786b3e60df93b3db3676811c6ca325421b9d77e2c49b75b27f683af0bcaf3d33b225a78050c66e6008fc7dfe3ab99dce3d8c77ae5770bd89de
SSDEEP 12288:+jky4q7ZyKpkOHHqhQxs3Tr7Ou6PZyHAGxgm9rkWyKpWjv5P8ER:+Iy3ZyKpghBTt6PUgu1oWqxPj
TLSH
T138F4122863D448E6E17A463CCEA282858A727C352B11A6EFD4C0F57E1E3A7D47C34F19
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7353452db9b0e1f00fded174250c2494ac5d7dd9d18cb019a6183d95c0a2f917

File Explorer

7353452db9b0e1f00fded174250c2494ac5d7dd9d18cb019a6183d95c0a2f917

.exe 734KB

7353452db9b0e1f00fded174250c2494ac5d7dd9d18cb019a6183d95c0a2f917

IMPHASH 51ba43624008af885335f88516ca2ad3
SHA256 7353452db9b0e1f00fded174250c2494ac5d7dd9d18cb019a6183d95c0a2f917
MD5 c16b3fb196fc3a77231d4f23ca405a68
SHA1 4017903a75b43b4bdd5b1986125d42d245813598
SHA512 dcfbb6b2c9ba3a786b3e60df93b3db3676811c6ca325421b9d77e2c49b75b27f683af0bcaf3d33b225a78050c66e6008fc7dfe3ab99dce3d8c77ae5770bd89de
SSDEEP 12288:+jky4q7ZyKpkOHHqhQxs3Tr7Ou6PZyHAGxgm9rkWyKpWjv5P8ER:+Iy3ZyKpghBTt6PUgu1oWqxPj
TLSH
T138F4122863D448E6E17A463CCEA282858A727C352B11A6EFD4C0F57E1E3A7D47C34F19
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

26928

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

msdtcexe.pdb

api-ms-win-core-processenvironment-l1-1-0

ExpandEnvironmentStringsW GetCommandLineA GetCommandLineW

api-ms-win-core-com-l1-1-0

CoTaskMemAlloc StringFromGUID2 CoTaskMemFree CoUninitialize CoCreateInstance CoInitializeEx CoGetObjectContext

msvcrt

malloc _onexit __dllonexit _local_unwind _unlock _lock ?terminate@@YAXXZ free memcpy _fmode _wcmdln __C_specific_handler wcschr _initterm __setusermatherr _cexit _commode _exit exit _CxxThrowException __set_app_type __wgetmainargs _amsg_exit fopen fflush fclose fprintf fwprintf __CxxFrameHandler3 _vsnwprintf _wcsicmp _stricmp wcsrchr _waccess _purecall ??1exception@@UEAA@XZ ??0exception@@QEAA@AEBQEBDH@Z ??0exception@@QEAA@AEBV0@@Z ?what@exception@@UEBAPEBDXZ strchr _wfopen ??1type_info@@UEAA@XZ _XcptFilter _callnewh memset

msdtctm

ord4

ntdll

RtlVirtualUnwind RtlReportException RtlLookupFunctionEntry RtlCaptureContext

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-processthreads-l1-1-0

OpenProcessToken TlsAlloc TlsFree GetExitCodeProcess GetStartupInfoW TlsGetValue CreateProcessW GetCurrentThreadId GetCurrentProcessId TerminateProcess GetCurrentProcess

api-ms-win-core-errorhandling-l1-1-0

SetUnhandledExceptionFilter UnhandledExceptionFilter GetLastError

api-ms-win-core-libraryloader-l1-2-0

LoadStringW LoadLibraryExW FindResourceExW GetModuleFileNameW LockResource FreeLibrary GetProcAddress GetModuleHandleW LoadResource

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-1-0

GetTickCount GetSystemTimeAsFileTime GetSystemWindowsDirectoryA GetLocalTime

api-ms-win-core-registry-l1-1-0

RegQueryValueExA RegCloseKey RegQueryValueExW RegOpenKeyExW RegOpenKeyExA RegSetValueExW

api-ms-win-core-file-l1-1-0

SetFileAttributesW CreateFileW DeleteFileW FindClose CreateDirectoryW GetFullPathNameW FindNextFileW FindFirstFileW

api-ms-win-core-debug-l1-1-0

DebugBreak OutputDebugStringW IsDebuggerPresent

api-ms-win-core-synch-l1-1-0

EnterCriticalSection InitializeCriticalSectionAndSpinCount LeaveCriticalSection CreateEventA ResetEvent DeleteCriticalSection WaitForSingleObject WaitForSingleObjectEx SetEvent

api-ms-win-core-handle-l1-1-0

CloseHandle

api-ms-win-core-psapi-l1-1-0

QueryFullProcessImageNameW

api-ms-win-core-string-l1-1-0

MultiByteToWideChar

api-ms-win-core-version-l1-1-0

VerQueryValueW

api-ms-win-core-localization-l1-2-0

FormatMessageW

api-ms-win-core-heap-l2-1-0

LocalFree LocalAlloc

api-ms-win-security-base-l1-1-0

GetTokenInformation

kernel32

QueueUserWorkItem UnregisterWaitEx

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI

api-ms-win-core-delayload-l1-1-0

DelayLoadFailureHook

Name

.text

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

94KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

589KB

Virtual Size

592KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

7353452db9b0e1f00fded174250c2494ac5d7dd9d18cb019a6183d95c0a2f917

api-ms-win-core-processenvironment-l1-1-0

api-ms-win-core-com-l1-1-0

msvcrt

msdtctm

ntdll

api-ms-win-core-synch-l1-2-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-sysinfo-l1-1-0

api-ms-win-core-registry-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-debug-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-handle-l1-1-0

api-ms-win-core-psapi-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-version-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-heap-l2-1-0

api-ms-win-security-base-l1-1-0

kernel32

api-ms-win-core-delayload-l1-1-1

api-ms-win-core-delayload-l1-1-0

generic