532f7b6c71ef27e023c52db88b568dbc9f496e53bee59be99ef0dc89b499c2f9

Sharing

Copy URL Twitter E-mail

General

Target
532f7b6c71ef27e023c52db88b568dbc9f496e53bee59be99ef0dc89b499c2f9
Size 1.6MB
Sample260916-npgjsstx3n
SHA256 532f7b6c71ef27e023c52db88b568dbc9f496e53bee59be99ef0dc89b499c2f9
MD5 0991dd43be534786ae44fe3afe0bee98
SHA1 0aa00b79038c2434d7249219a5d5eb91ae298eb4
SHA512 587d55ada5e363b1ff008c73f4fd9b1b0f4655c85c3b83e5d2fad91071fb2216ffffcb407ac4284336e9912cbb9efd2f70e51b9a75d55781954541311be9f6ed
SSDEEP 12288:cvWEknaNKMtAy/HTMBFqXcLmUmpiiXhk3Haznw6laMHgPRNipXtrovJ2duR2N:gWEknmcLJmpu3KXd2vJ2w
TLSH
T1C375D756EBB2B1C2E57AC1396445202FFD7235A84B74C7DB82808B0E5722FD0AE3E755
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
532f7b6c71ef27e023c52db88b568dbc9f496e53bee59be99ef0dc89b499c2f9

File Explorer

532f7b6c71ef27e023c52db88b568dbc9f496e53bee59be99ef0dc89b499c2f9

.exe 1.6MB

532f7b6c71ef27e023c52db88b568dbc9f496e53bee59be99ef0dc89b499c2f9

IMPHASH 514226b0f7f3f4beb74d9dddd3656682
SHA256 532f7b6c71ef27e023c52db88b568dbc9f496e53bee59be99ef0dc89b499c2f9
MD5 0991dd43be534786ae44fe3afe0bee98
SHA1 0aa00b79038c2434d7249219a5d5eb91ae298eb4
SHA512 587d55ada5e363b1ff008c73f4fd9b1b0f4655c85c3b83e5d2fad91071fb2216ffffcb407ac4284336e9912cbb9efd2f70e51b9a75d55781954541311be9f6ed
SSDEEP 12288:cvWEknaNKMtAy/HTMBFqXcLmUmpiiXhk3Haznw6laMHgPRNipXtrovJ2duR2N:gWEknmcLJmpu3KXd2vJ2w
TLSH
T1C375D756EBB2B1C2E57AC1396445202FFD7235A84B74C7DB82808B0E5722FD0AE3E755
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12131

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetCurrentProcess CreateProcessA WaitForSingleObject GetModuleHandleA GetProcAddress CreateFileW ReadConsoleW ReadFile CloseHandle SetFilePointerEx GetFileSizeEx GetConsoleMode GetConsoleOutputCP FlushFileBuffers HeapQueryInformation HeapReAlloc GetStringTypeW GetCurrentThreadId IsDebuggerPresent RaiseException MultiByteToWideChar WideCharToMultiByte UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead GetStartupInfoW GetModuleHandleW RtlUnwindEx GetModuleFileNameW LoadLibraryExW InterlockedPushEntrySList InterlockedFlushSList SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer RtlPcToFileHeader GetModuleHandleExW GetStdHandle WriteFile ExitProcess GetCommandLineA GetCommandLineW HeapSize HeapValidate GetSystemInfo GetCurrentThread GetTempPathW FlsAlloc FlsGetValue FlsSetValue FlsFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType OutputDebugStringW WriteConsoleW SetConsoleCtrlHandler FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle RtlUnwind

ntdll

RtlLookupFunctionEntry RtlCaptureContext NtResumeThread NtSetContextThread RtlVirtualUnwind NtFlushInstructionCache NtWriteVirtualMemory NtProtectVirtualMemory NtAllocateVirtualMemory NtGetContextThread

Name

.text

Size

928KB

Virtual Size

928KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

202KB

Virtual Size

201KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

368KB

Virtual Size

376KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

37KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rdata2

Size

105KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

532f7b6c71ef27e023c52db88b568dbc9f496e53bee59be99ef0dc89b499c2f9

kernel32

ntdll

generic