b27fb566d5159bf897c6ed92a57827f0e0cbb01065ba3fb49bb69f59cabbda30

General

Target
b27fb566d5159bf897c6ed92a57827f0e0cbb01065ba3fb49bb69f59cabbda30
Size 735KB
Sample260916-nq59jsap91
SHA256 b27fb566d5159bf897c6ed92a57827f0e0cbb01065ba3fb49bb69f59cabbda30
MD5 d170fbe6d5ebe2c3ae9a0eb1e8641352
SHA1 0bfe668f86076a6c00d56ab19e0699166fc080f6
SHA512 334eae1d493cbcfeca78ab4dde847ae620044464abd5952dc66cada3ae8413b2e9c71254098bc7fae5b8de66c06bc348f1fcd487743fbe12f9914c6cf83990b9
SSDEEP 12288:FBGiqBnwT+9mCgKnOVW1vAKfzZEdNzyig9j/PaTZcSZUAPp:FBGiB+ctydvAKfzZia/2ZRTP
TLSH
T1E1F4F18A348C14FAEAB3C636E0907F0346B5F8560B502ADB17584E897E97BC15E3F617
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b27fb566d5159bf897c6ed92a57827f0e0cbb01065ba3fb49bb69f59cabbda30

File Explorer

b27fb566d5159bf897c6ed92a57827f0e0cbb01065ba3fb49bb69f59cabbda30

.exe 735KB

b27fb566d5159bf897c6ed92a57827f0e0cbb01065ba3fb49bb69f59cabbda30

IMPHASH a85bd5f78e416792f0b924eda56bfeaa
SHA256 b27fb566d5159bf897c6ed92a57827f0e0cbb01065ba3fb49bb69f59cabbda30
MD5 d170fbe6d5ebe2c3ae9a0eb1e8641352
SHA1 0bfe668f86076a6c00d56ab19e0699166fc080f6
SHA512 334eae1d493cbcfeca78ab4dde847ae620044464abd5952dc66cada3ae8413b2e9c71254098bc7fae5b8de66c06bc348f1fcd487743fbe12f9914c6cf83990b9
SSDEEP 12288:FBGiqBnwT+9mCgKnOVW1vAKfzZEdNzyig9j/PaTZcSZUAPp:FBGiB+ctydvAKfzZia/2ZRTP
TLSH
T1E1F4F18A348C14FAEAB3C636E0907F0346B5F8560B502ADB17584E897E97BC15E3F617
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

53600

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

eunsaintly.pdb

kernel32

GetProcAddress GetSystemInfo GetCurrentThread GetCurrentProcessId GetFileAttributesW GetDriveTypeW GetCurrentThreadId LoadLibraryA GetModuleHandleA QueryPerformanceCounter GetSystemTimeAsFileTime GetTickCount64 QueryPerformanceFrequency GetFileInformationByHandle GetFileInformationByHandleEx GetACP CloseHandle GetVersion GetTickCount SetFilePointerEx GetProcessHeap HeapAlloc SetLastError WriteConsoleW GetOEMCP GetLastError WaitForSingleObject GetActiveProcessorGroupCount GetCurrentProcess IsProcessorFeaturePresent GetMaximumProcessorCount GetActiveProcessorCount MultiByteToWideChar HeapReAlloc GetModuleHandleW GetCommandLineW GetEnvironmentStringsW GetCommandLineA GetStdHandle GetConsoleOutputCP GetConsoleMode GetCurrentProcessorNumber HeapFree GetFullPathNameW CreateFileW SetFileTime FlushFileBuffers HeapSize SetFileInformationByHandle LCMapStringW CompareStringW InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW RtlUnwindEx FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException RtlPcToFileHeader GetModuleFileNameW ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetCPInfo WideCharToMultiByte FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW VirtualProtect LoadLibraryExW WriteFile

user32

GetSysColor GetSystemMetrics GetForegroundWindow GetFocus GetShellWindow

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

ntdll

RtlNtStatusToDosError NtReadFile NtWriteFile

Sharing

General

Malware Config

Signatures

File Explorer

b27fb566d5159bf897c6ed92a57827f0e0cbb01065ba3fb49bb69f59cabbda30

kernel32

user32

api-ms-win-core-synch-l1-2-0

ntdll

generic