83fdd48e754cbf43acc90719950130ef80e0a210ecca15fffc854baf35a94300

Sharing

Copy URL Twitter E-mail

General

Target
83fdd48e754cbf43acc90719950130ef80e0a210ecca15fffc854baf35a94300
Size 5.8MB
Sample260916-qljwvsvx7q
SHA256 83fdd48e754cbf43acc90719950130ef80e0a210ecca15fffc854baf35a94300
MD5 389c107a029624b1b8514422e9eabbd1
SHA1 6f738283dde4e1d9b5953318676a28524d08f33d
SHA512 99b994eb2a43083e3a62ee0acaa0b52116aa1e4e81f53f85ad452f24c28009422c594f489102924cbdbbec8089c8609ce7dee3bef8d0a51e0b10d365ad880c6c
SSDEEP 49152:AGtlqzIU6iKIVwASOO49pUpIF9Dv7LX+nGyQ9T+2jVsdsghjnWmTz7uk2k1Bguzx:9+q0XlBhs6sTTg/Efqo4w
TLSH
T1AA56F757FAB221E4C8BAC13986523232BD71B86947349BD35A4496274F33BF0AE3D744
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
83fdd48e754cbf43acc90719950130ef80e0a210ecca15fffc854baf35a94300

File Explorer

83fdd48e754cbf43acc90719950130ef80e0a210ecca15fffc854baf35a94300

.exe 5.8MB

83fdd48e754cbf43acc90719950130ef80e0a210ecca15fffc854baf35a94300

IMPHASH bc0d8d83f3937125a12fbbe02e37cf9b
SHA256 83fdd48e754cbf43acc90719950130ef80e0a210ecca15fffc854baf35a94300
MD5 389c107a029624b1b8514422e9eabbd1
SHA1 6f738283dde4e1d9b5953318676a28524d08f33d
SHA512 99b994eb2a43083e3a62ee0acaa0b52116aa1e4e81f53f85ad452f24c28009422c594f489102924cbdbbec8089c8609ce7dee3bef8d0a51e0b10d365ad880c6c
SSDEEP 49152:AGtlqzIU6iKIVwASOO49pUpIF9Dv7LX+nGyQ9T+2jVsdsghjnWmTz7uk2k1Bguzx:9+q0XlBhs6sTTg/Efqo4w
TLSH
T1AA56F757FAB221E4C8BAC13986523232BD71B86947349BD35A4496274F33BF0AE3D744
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4227312

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\anils\openssl3\openssl\openssl-3.0.10\apps\openssl.pdb

ws2_32

gethostbyname gethostbyaddr inet_ntoa inet_addr htons getservbyname WSASetLastError sendto send recvfrom getsockopt recv setsockopt WSAGetLastError __WSAFDIsSet shutdown select ntohs ioctlsocket getsockname WSAStartup WSACleanup accept bind closesocket connect listen socket getservbyport htonl

advapi32

CryptCreateHash RegisterEventSourceW ReportEventW CryptAcquireContextW CryptReleaseContext CryptDestroyKey CryptSetHashParam CryptGetProvParam CryptEnumProvidersW CryptSignHashW CryptDestroyHash DeregisterEventSource CryptDecrypt CryptExportKey CryptGetUserKey

crypt32

CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CertDuplicateCertificateContext CertFreeCertificateContext CertGetCertificateContextProperty CertOpenStore

user32

GetUserObjectInformationW MessageBoxW GetProcessWindowStation

bcrypt

BCryptGenRandom

kernel32

TlsAlloc GetCurrentThreadId AcquireSRWLockShared TlsGetValue ReleaseSRWLockShared ReleaseSRWLockExclusive InitializeSRWLock TlsSetValue TlsFree VirtualFree FindClose GetACP QueryPerformanceCounter GetSystemTimeAsFileTime RtlVirtualUnwind LoadLibraryW RtlCaptureContext RtlLookupFunctionEntry UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess InitializeSListHead IsDebuggerPresent AcquireSRWLockExclusive IsProcessorFeaturePresent ReadConsoleW ReadConsoleA SetConsoleMode GetConsoleMode ConvertThreadToFiberEx ConvertFiberToThread Sleep CloseHandle GetLastError PeekNamedPipe ExitProcess CreateThread TerminateThread GetFileAttributesW MultiByteToWideChar GetStdHandle DeleteFileW ReadFile WriteFile GetProcessTimes GetCurrentProcessId OpenProcess GetSystemTime MoveFileW SystemTimeToFileTime PeekConsoleInputW GetCommandLineW GetEnvironmentVariableW FindFirstFileW FindNextFileW WideCharToMultiByte GetConsoleOutputCP SetConsoleOutputCP SetLastError GetFileType GetModuleHandleW GetProcAddress GetSystemDirectoryA FreeLibrary LoadLibraryA FormatMessageA SwitchToFiber DeleteFiber CreateFiberEx

vcruntime140

__current_exception_context __C_specific_handler wcsstr memchr memmove strrchr memset memcmp strstr strchr memcpy __current_exception

api-ms-win-crt-convert-l1-1-0

strtoul strtol atol atoi

api-ms-win-crt-stdio-l1-1-0

_close _open ferror fread fseek ftell fwrite setvbuf _setmode __stdio_common_vfprintf __stdio_common_vswprintf setbuf fputs _set_fmode _fileno feof fgets __stdio_common_vsprintf_s fclose clearerr __acrt_iob_func fopen __stdio_common_vsscanf _wfopen __p__commode fputc fflush __stdio_common_vsprintf _kbhit

api-ms-win-crt-runtime-l1-1-0

_errno _register_onexit_function _initialize_onexit_table _crt_atexit _set_app_type _configure_narrow_argv _initialize_narrow_environment signal _get_initial_narrow_environment _initterm _initterm_e raise terminate _exit strerror strerror_s exit __p___argc __p___argv _cexit _register_thread_local_exe_atexit_callback _c_exit perror _getpid _seh_filter_exe

api-ms-win-crt-string-l1-1-0

wcscmp isxdigit strcmp strcat strncpy_s strcat_s strcpy_s strspn strcspn wcslen wcscpy toupper tolower strlen strncat isspace strncpy isdigit isprint strncmp strcpy islower

api-ms-win-crt-filesystem-l1-1-0

_chmod _stat64i32 _access _fstat64i32 _unlink

api-ms-win-crt-utility-l1-1-0

_lrotr _lrotl qsort

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-time-l1-1-0

_gmtime64_s _time64

api-ms-win-crt-math-l1-1-0

__setusermatherr _fdopen

api-ms-win-crt-heap-l1-1-0

malloc free _set_new_mode realloc calloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Name

.text

Size

4.0MB

Virtual Size

4.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

988KB

Virtual Size

988KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

59KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

114KB

Virtual Size

113KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

960B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

620KB

Virtual Size

624KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

83fdd48e754cbf43acc90719950130ef80e0a210ecca15fffc854baf35a94300

ws2_32

advapi32

crypt32

user32

bcrypt

kernel32

vcruntime140

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic