892ed6423d7648d9fea785f6995ba736c9629eb78ee1c5ac3353b3faeb1948e6

Sharing

Copy URL Twitter E-mail

General

Target
892ed6423d7648d9fea785f6995ba736c9629eb78ee1c5ac3353b3faeb1948e6
Size 1.5MB
Sample260916-rc7f8s1eph
SHA256 892ed6423d7648d9fea785f6995ba736c9629eb78ee1c5ac3353b3faeb1948e6
MD5 ffc37e48c1d5e284eb44cf449cfd4096
SHA1 a69be1b133bb128fb5c8c8a1d45863d1dfdfba20
SHA512 e98b977fac138f2b074ee0ebad6b8bbc1d8508b900f21749b08773691945ff23f634f2f699b8acb4db1d2606da5ad42e4d017d080b66400cd2822303cdb7c747
SSDEEP 12288:HQVNwL45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkt:HQg0Yz7KEMdX6keYnAcerk
TLSH
T1D6752308475A41D1F86A42BFFE714601C276B9C63B0493DF8B0CE7829BBF7A2552974A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
892ed6423d7648d9fea785f6995ba736c9629eb78ee1c5ac3353b3faeb1948e6

File Explorer

892ed6423d7648d9fea785f6995ba736c9629eb78ee1c5ac3353b3faeb1948e6

.exe 1.5MB

892ed6423d7648d9fea785f6995ba736c9629eb78ee1c5ac3353b3faeb1948e6

IMPHASH 322f1c1ff4870ee88af8af80b98138a2
SHA256 892ed6423d7648d9fea785f6995ba736c9629eb78ee1c5ac3353b3faeb1948e6
MD5 ffc37e48c1d5e284eb44cf449cfd4096
SHA1 a69be1b133bb128fb5c8c8a1d45863d1dfdfba20
SHA512 e98b977fac138f2b074ee0ebad6b8bbc1d8508b900f21749b08773691945ff23f634f2f699b8acb4db1d2606da5ad42e4d017d080b66400cd2822303cdb7c747
SSDEEP 12288:HQVNwL45Oz7KjwMdXrcxyXSA/cbnTc+ADcce1YGRkt:HQg0Yz7KEMdX6keYnAcerk
TLSH
T1D6752308475A41D1F86A42BFFE714601C276B9C63B0493DF8B0CE7829BBF7A2552974A
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

23856

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

aspnet_state.pdb

mswsock

GetAcceptExSockaddrs AcceptEx

ole32

CoUninitialize CoInitializeEx

ws2_32

ntohs bind WSAGetOverlappedResult WSAStartup closesocket WSARecv WSASend WSAAddressToStringA htons listen htonl WSACleanup select recv WSASocketW WSAGetLastError inet_ntoa setsockopt

mscoree

ClrCreateManagedInstance

webengine4

GetXSPHeap LoadLibraryUsingFullPath AttachHandleToThreadPool XspLogEvent InitializeLibrary PrintResourceString PerfCounterInitialize AspnetLoadResourceDLL

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey StartServiceCtrlDispatcherW SetServiceStatus RegisterServiceCtrlHandlerW

kernel32

InitializeSListHead GetCurrentProcessId QueryPerformanceCounter GetProcessAffinityMask GetCurrentProcess TerminateProcess GetCurrentThreadId RtlCaptureContext GetVersionExW GetSystemDirectoryW HeapReAlloc WideCharToMultiByte FileTimeToSystemTime lstrlenW GetSystemTimeAsFileTime FileTimeToLocalFileTime LoadLibraryW RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetModuleHandleW MultiByteToWideChar HeapCreate HeapDestroy HeapAlloc HeapFree FreeLibrary GetProcAddress SetEvent WaitForSingleObject GetSystemInfo CloseHandle CreateEventW SetWaitableTimer Sleep CreateThread FormatMessageW CreateWaitableTimerW SetConsoleCtrlHandler GetLastError SwitchToThread

vcruntime140_clr0400

strchr _purecall memset __C_specific_handler memcpy strstr

ucrtbase_clr0400

_configure_wide_argv _initialize_wide_environment _get_initial_wide_environment _initterm _initterm_e exit _exit _set_fmode __p___argc __p___wargv _cexit _c_exit _register_thread_local_exe_atexit_callback _configthreadlocale _set_new_mode _initialize_onexit_table _register_onexit_function _crt_atexit terminate _set_app_type _itoa_s wcsncpy_s wcscpy_s __stdio_common_vswprintf strtol _seh_filter_exe strncmp __p__commode __setusermatherr

Name

.text

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.5MB

Virtual Size

1.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

892ed6423d7648d9fea785f6995ba736c9629eb78ee1c5ac3353b3faeb1948e6

mswsock

ole32

ws2_32

mscoree

webengine4

advapi32

kernel32

vcruntime140_clr0400

ucrtbase_clr0400

generic