b38929617ee49113d9a599fb817674b19464fd028ec2dd27376d76b785e14422

Sharing

Copy URL Twitter E-mail

General

Target
b38929617ee49113d9a599fb817674b19464fd028ec2dd27376d76b785e14422
Size 77KB
Sample260919-pcgjpsfb69
SHA256 b38929617ee49113d9a599fb817674b19464fd028ec2dd27376d76b785e14422
MD5 c989a007d0255e6f4a19a47c08fff2d2
SHA1 3f93eaf7ef8e5b61a5a7796be15b5e605b41f27f
SHA512 c4486a826918ba673c0fd68d3ff0d259faf4d90b5b7ba62421ba9d5f7068faa9529655f0f72c94513777df030d9850d569ef901c549573ccdf5f39a824d5281b
SSDEEP 768:HHRRa2t5SK0HfzWe3nzyy8HRbjdlvwDKaBBX2UMA79m:RRntx0HbWe3n2xbjfvweaB1gd
TLSH
T19673181AB78620FBDD75C17D8B969226F67130A4032256DF5A011EB66F706EC3E3CB42
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b38929617ee49113d9a599fb817674b19464fd028ec2dd27376d76b785e14422

File Explorer

b38929617ee49113d9a599fb817674b19464fd028ec2dd27376d76b785e14422

.exe 77KB

b38929617ee49113d9a599fb817674b19464fd028ec2dd27376d76b785e14422

IMPHASH 307d4f2cf720c383825e87cd8afd1a84
SHA256 b38929617ee49113d9a599fb817674b19464fd028ec2dd27376d76b785e14422
MD5 c989a007d0255e6f4a19a47c08fff2d2
SHA1 3f93eaf7ef8e5b61a5a7796be15b5e605b41f27f
SHA512 c4486a826918ba673c0fd68d3ff0d259faf4d90b5b7ba62421ba9d5f7068faa9529655f0f72c94513777df030d9850d569ef901c549573ccdf5f39a824d5281b
SSDEEP 768:HHRRa2t5SK0HfzWe3nzyy8HRbjdlvwDKaBBX2UMA79m:RRntx0HbWe3n2xbjfvweaB1gd
TLSH
T19673181AB78620FBDD75C17D8B969226F67130A4032256DF5A011EB66F706EC3E3CB42
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

69667

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\VSProject\WindowsUpdateMonitoringService\x64\Debug\WindowsUpdateMonitoringService.pdb

kernel32

CreateThread GetModuleFileNameA WaitForMultipleObjects LoadLibraryA VirtualQuery CreateEventW WaitForSingleObject SetEvent CloseHandle GetProcAddress GetFileAttributesA GetProcessHeap HeapFree HeapAlloc GetLastError GetModuleHandleW GetStartupInfoW SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter WideCharToMultiByte MultiByteToWideChar RaiseException IsDebuggerPresent GetCurrentThreadId FreeLibrary

advapi32

SetServiceStatus RegisterServiceCtrlHandlerExA CloseServiceHandle FreeSid StartServiceCtrlDispatcherA

shlwapi

PathCombineA

vcruntime140d

memcpy __C_specific_handler __C_specific_handler_noexcept __std_type_info_destroy_list __current_exception __current_exception_context __vcrt_GetModuleFileNameW __vcrt_GetModuleHandleW __vcrt_LoadLibraryExW memset

ucrtbased

exit _exit _set_fmode __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _configthreadlocale _set_new_mode __p__commode strcpy_s _splitpath_s _initterm _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit _crt_at_quick_exit terminate _wmakepath_s _wsplitpath_s wcscpy_s rand_s strlen strcmp _wcsicmp _initterm_e free _initialize_narrow_environment _configure_narrow_argv __setusermatherr _set_app_type _seh_filter_exe _CrtDbgReportW _CrtDbgReport _seh_filter_dll __stdio_common_vsprintf_s strcat_s malloc _get_initial_narrow_environment

Name

.textbss

Size

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

44KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

512B

Virtual Size

456B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

715B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

b38929617ee49113d9a599fb817674b19464fd028ec2dd27376d76b785e14422

kernel32

advapi32

shlwapi

vcruntime140d

ucrtbased

generic