7781dc9ff1b80df459bc03a8f5d70733e9b26cc85d35a96c7120915230f6d4c3

Sharing

Copy URL Twitter E-mail

General

Target
7781dc9ff1b80df459bc03a8f5d70733e9b26cc85d35a96c7120915230f6d4c3
Size 342KB
Sample260916-np4dkaxwe1
SHA256 7781dc9ff1b80df459bc03a8f5d70733e9b26cc85d35a96c7120915230f6d4c3
MD5 25c7b494c5e44e84510d876f254789ee
SHA1 b4b91cb82f7230ab198d4280c584c91d34cf3385
SHA512 017e7a298c75f577cf15dc04c42be1cd191caf24403c624353e60ffe1745b04c578d49083a423a5a27382c4982129d39ba1e481c17c18515296aba825911289d
SSDEEP 6144:5m6+Y3ihuzk48MlaCgCtazr6JNm8ewRd9cADvWvm3FH/gwJ38T0bOghpd+dZEtm:0uzk4ralzr6NVd9cAQaFH/DBOgPdEwm
TLSH
T1BD742361BF25A1F2CFD985FB6A3857544CD73CE11B4229E79DB1828919B5CC086B00EF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7781dc9ff1b80df459bc03a8f5d70733e9b26cc85d35a96c7120915230f6d4c3

File Explorer

7781dc9ff1b80df459bc03a8f5d70733e9b26cc85d35a96c7120915230f6d4c3

.exe 342KB

7781dc9ff1b80df459bc03a8f5d70733e9b26cc85d35a96c7120915230f6d4c3

IMPHASH 20c3dae8b5858a3256f3a0cb80094852
SHA256 7781dc9ff1b80df459bc03a8f5d70733e9b26cc85d35a96c7120915230f6d4c3
MD5 25c7b494c5e44e84510d876f254789ee
SHA1 b4b91cb82f7230ab198d4280c584c91d34cf3385
SHA512 017e7a298c75f577cf15dc04c42be1cd191caf24403c624353e60ffe1745b04c578d49083a423a5a27382c4982129d39ba1e481c17c18515296aba825911289d
SSDEEP 6144:5m6+Y3ihuzk48MlaCgCtazr6JNm8ewRd9cADvWvm3FH/gwJ38T0bOghpd+dZEtm:0uzk4ralzr6NVd9cAQaFH/DBOgPdEwm
TLSH
T1BD742361BF25A1F2CFD985FB6A3857544CD73CE11B4229E79DB1828919B5CC086B00EF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10645

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Dropbox\My Projects\C++ Projects\Ronkor\Release\Ronkor.pdb

kernel32

GetDriveTypeW CreateProcessW GetLogicalDriveStringsW WriteFile ReadFile CreateFileW FlushFileBuffers GetLastError SetFilePointer FindClose LocalAlloc FindNextFileW LocalFree ExpandEnvironmentStringsW CreateThread DecodePointer IsDebuggerPresent FindFirstFileW CreateMutexW GetFileSize GetEnvironmentVariableW GetCurrentDirectoryW ExitProcess IsProcessorFeaturePresent GetTickCount64 GetSystemTimeAsFileTime GetCurrentThreadId QueryPerformanceCounter EncodePointer

user32

wsprintfW

advapi32

RegCloseKey CryptGenRandom RegCreateKeyW CryptAcquireContextW RegSetValueExW

shell32

ShellExecuteW

ntdll

NtClose RtlAdjustPrivilege NtDelayExecution

urlmon

URLDownloadToFileW URLOpenBlockingStreamW

msvcp110

?_Xlength_error@std@@YAXPBD@Z ?_Winerror_map@std@@YAPBDH@Z ?_Syserror_map@std@@YAPBDH@Z ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPBD@Z

msvcr110

memcpy __CxxFrameHandler3 _CxxThrowException memmove wcsstr _purecall ??3@YAXPAX@Z ??2@YAPAXI@Z _lock _unlock _calloc_crt __dllonexit _onexit _crt_debugger_hook __crtUnhandledException __crtTerminateProcess ??1type_info@@UAE@XZ _XcptFilter __crtGetShowWindowMode _amsg_exit __wgetmainargs __set_app_type exit _exit _cexit _configthreadlocale __setusermatherr _initterm_e _initterm _wcmdln _fmode _commode _except_handler4_common ?terminate@@YAXXZ __crtSetUnhandledExceptionFilter _invoke_watson _controlfp_s memset

Name

�ocx�

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

rda3N

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

�l�p��

Size

512B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

(��1��

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

p��{��

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

�\?�TPs

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

7781dc9ff1b80df459bc03a8f5d70733e9b26cc85d35a96c7120915230f6d4c3

kernel32

user32

advapi32

shell32

ntdll

urlmon

msvcp110

msvcr110

generic