fad44477994a900b017b82bed47b126fd4bd425c633f5730d082587e6679dcdc

Sharing

Copy URL Twitter E-mail

General

Target
fad44477994a900b017b82bed47b126fd4bd425c633f5730d082587e6679dcdc
Size 1.0MB
Sample260916-mq3b8aae94
SHA256 fad44477994a900b017b82bed47b126fd4bd425c633f5730d082587e6679dcdc
MD5 3eab0fa4b0f635192bb21d5d7123f3e4
SHA1 807866253456aff7d8aa67df69b3f9dd26a3df75
SHA512 9bb3c4a79919ac26b58e3b901123040bbbdb9a5d55c79328481d4405bc937e844a5e3517d52f90a0326aa942618c1225cc3d5fe3e2953f12074671205d748143
SSDEEP 24576:eAQ0spy9CexydbBZaYo/j0almfvIHTgOb8dZ98uMOuGn/sSy6jGMnOgzip:00QyGPSjyEskwPn/3ggzY
TLSH
T10A25234B75E43EE8C4014BBCB7C68275D15E5A660F32C8108C435966FEB11DAEED827E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fad44477994a900b017b82bed47b126fd4bd425c633f5730d082587e6679dcdc

File Explorer

fad44477994a900b017b82bed47b126fd4bd425c633f5730d082587e6679dcdc

.dll 1.0MB

fad44477994a900b017b82bed47b126fd4bd425c633f5730d082587e6679dcdc

IMPHASH 5e14e88b34e53538d859edbe62ffea42
SHA256 fad44477994a900b017b82bed47b126fd4bd425c633f5730d082587e6679dcdc
MD5 3eab0fa4b0f635192bb21d5d7123f3e4
SHA1 807866253456aff7d8aa67df69b3f9dd26a3df75
SHA512 9bb3c4a79919ac26b58e3b901123040bbbdb9a5d55c79328481d4405bc937e844a5e3517d52f90a0326aa942618c1225cc3d5fe3e2953f12074671205d748143
SSDEEP 24576:eAQ0spy9CexydbBZaYo/j0almfvIHTgOb8dZ98uMOuGn/sSy6jGMnOgzip:00QyGPSjyEskwPn/3ggzY
TLSH
T10A25234B75E43EE8C4014BBCB7C68275D15E5A660F32C8108C435966FEB11DAEED827E
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

929138

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

advapi32

CryptAcquireContextA CryptCreateHash CryptDestroyHash CryptDestroyKey CryptHashData CryptImportKey CryptReleaseContext CryptVerifySignatureA RegCloseKey RegCreateKeyExW RegDeleteValueW RegOpenKeyExW RegQueryValueExW RegSetValueExW

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDestroyHash BCryptFinishHash BCryptGenRandom BCryptGetProperty BCryptHashData BCryptOpenAlgorithmProvider

crypt32

CryptBinaryToStringA CryptProtectData CryptStringToBinaryA CryptUnprotectData

kernel32

BaseGetNamedObjectDirectory CreateThread DeleteCriticalSection EncodePointer EnterCriticalSection ExitThread FormatMessageW GetCurrentProcessId GetEnvironmentVariableW GetLastError GetModuleFileNameW GetModuleHandleExW GetProcAddress GetProcessHeap GetSystemInfo GetSystemTimeAsFileTime GetThreadPriority GetTickCount GlobalFree HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSection LeaveCriticalSection LocalAlloc LocalFree MultiByteToWideChar QueryPerformanceFrequency QueryUnbiasedInterruptTime SetConsoleCtrlHandler SetLastError SetThreadPriority SwitchToThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue VirtualProtect VirtualQuery WideCharToMultiByte

api-ms-win-crt-convert-l1-1-0

strtod

api-ms-win-crt-environment-l1-1-0

__p__environ __p__wenviron

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-private-l1-1-0

strchr strstr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv __p___wargv _configure_narrow_argv _configure_wide_argv _crt_atexit _execute_onexit_table _exit _initialize_narrow_environment _initialize_onexit_table _initialize_wide_environment _initterm abort

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __stdio_common_vfprintf __stdio_common_vfwprintf __stdio_common_vsprintf fflush fwrite

api-ms-win-crt-string-l1-1-0

isspace strcmp strlen strncmp tolower wcslen

api-ms-win-crt-time-l1-1-0

__daylight __timezone __tzname _tzset

ntdll

NtClose NtCreateSection NtDelayExecution NtDuplicateObject NtMapViewOfSection NtRaiseHardError NtReleaseKeyedEvent NtUnmapViewOfSection NtWaitForKeyedEvent NtWaitForSingleObject RtlDllShutdownInProgress RtlNtStatusToDosError

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpCrackUrl WinHttpGetIEProxyConfigForCurrentUser WinHttpGetProxyForUrl WinHttpOpen WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpReadData WinHttpReceiveResponse WinHttpSendRequest WinHttpSetOption

x64-ucrt-ruby320

Sleep rb_block_call rb_block_given_p rb_cObject rb_class_new_instance rb_const_defined rb_const_get rb_debug_rstring_null_ptr rb_define_module rb_define_singleton_method rb_eArgError rb_funcallv rb_global_variable rb_hash_aset rb_hash_new rb_id2sym rb_intern2 rb_obj_as_string rb_raise rb_require rb_respond_to rb_str_export_to_enc rb_utf8_encoding rb_utf8_str_new rb_yield ruby_snprintf

Name

.text

Size

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

496B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

608B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

Virtual Size

118B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.\Tw

Size

Virtual Size

724KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.(Ky

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.w_"

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

36B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

fad44477994a900b017b82bed47b126fd4bd425c633f5730d082587e6679dcdc

advapi32

bcrypt

crypt32

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-time-l1-1-0

ntdll

winhttp

x64-ucrt-ruby320

generic