9ff46535914668ea8c1443d1119a8610a8ee065db22f0355cd0b5cd803ef612c

Sharing

Copy URL Twitter E-mail

General

Target
9ff46535914668ea8c1443d1119a8610a8ee065db22f0355cd0b5cd803ef612c
Size 13.2MB
Sample260919-wrrrjswset
SHA256 9ff46535914668ea8c1443d1119a8610a8ee065db22f0355cd0b5cd803ef612c
MD5 ba02fa15f644efe9bd16ccefbcd78fce
SHA1 504f382150fab37bc1e9c6b309359a6f4f84634a
SHA512 997a0d8ea99cf2f8865c57473854b330bc7f1f9bd3f550ec9350b4a6ff204c4c48366b09deb6b4c9c50e5b012b28bbb9ce0cbc40d412f86c56ba7a574f014d4b
SSDEEP 393216:Hn/D+HUbA8mPR7l086JagRHS596kqenNY1:HnaH2kNl0DJamHSP6kqg21
TLSH
T140D623E92484977DC481C638F14516FAF0C478580DFA9A17BFC31A06BB31CA9D8B6BB5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9ff46535914668ea8c1443d1119a8610a8ee065db22f0355cd0b5cd803ef612c

File Explorer

9ff46535914668ea8c1443d1119a8610a8ee065db22f0355cd0b5cd803ef612c

.exe 13.2MB

9ff46535914668ea8c1443d1119a8610a8ee065db22f0355cd0b5cd803ef612c

IMPHASH b3c8ad603dff2a6095a52d0c98aa539a
SHA256 9ff46535914668ea8c1443d1119a8610a8ee065db22f0355cd0b5cd803ef612c
MD5 ba02fa15f644efe9bd16ccefbcd78fce
SHA1 504f382150fab37bc1e9c6b309359a6f4f84634a
SHA512 997a0d8ea99cf2f8865c57473854b330bc7f1f9bd3f550ec9350b4a6ff204c4c48366b09deb6b4c9c50e5b012b28bbb9ce0cbc40d412f86c56ba7a574f014d4b
SSDEEP 393216:Hn/D+HUbA8mPR7l086JagRHS596kqenNY1:HnaH2kNl0DJamHSP6kqg21
TLSH
T140D623E92484977DC481C638F14516FAF0C478580DFA9A17BFC31A06BB31CA9D8B6BB5
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

25158894

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

comctl32

_TrackMouseEvent

gdiplus

GdipFree

ws2_32

shutdown

kernel32

PostQueuedCompletionStatus

user32

SetWindowPos

ole32

DoDragDrop

oleaut32

VariantChangeType

mswsock

GetAcceptExSockaddrs

advapi32

RegOpenKeyExA

shell32

SHBrowseForFolderW

gdi32

RectInRegion

api-ms-win-power-base-l1-1-0

PowerRegisterSuspendResumeNotification

comdlg32

GetSaveFileNameW

msvcp140

?imbue@?$basic_streambuf@_WU?$char_traits@_W@std@@@std@@MEAAXAEBVlocale@2@@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

strrchr

api-ms-win-crt-heap-l1-1-0

free

api-ms-win-crt-stdio-l1-1-0

fread

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment

api-ms-win-crt-convert-l1-1-0

strtod

api-ms-win-crt-string-l1-1-0

toupper

api-ms-win-crt-filesystem-l1-1-0

_wchdir

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-utility-l1-1-0

rand

api-ms-win-crt-time-l1-1-0

_ftime64

api-ms-win-crt-locale-l1-1-0

setlocale

api-ms-win-crt-environment-l1-1-0

_wputenv

api-ms-win-crt-process-l1-1-0

_wexecvp

Name

.text

Size

Virtual Size

2.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

Virtual Size

560KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

119KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

Virtual Size

114KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.umn

Size

Virtual Size

8.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.xKQ

Size

1024B

Virtual Size

528B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.1Nn

Size

13.2MB

Virtual Size

13.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

9ff46535914668ea8c1443d1119a8610a8ee065db22f0355cd0b5cd803ef612c

comctl32

gdiplus

ws2_32

kernel32

user32

ole32

oleaut32

mswsock

advapi32

shell32

gdi32

api-ms-win-power-base-l1-1-0

comdlg32

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-process-l1-1-0

generic