d1ce3fe00cd981ed83647b10af21b8d5456e039aa4dda24adf0f7df44c952168

General

Target
d1ce3fe00cd981ed83647b10af21b8d5456e039aa4dda24adf0f7df44c952168
Size 260KB
Sample260919-ws68maab85
SHA256 d1ce3fe00cd981ed83647b10af21b8d5456e039aa4dda24adf0f7df44c952168
MD5 450d96423b6fbb4c8ecfd1fd4ecfaceb
SHA1 5549987280755b2dce36d79211616957376a3af3
SHA512 dcf25e2b790b45f2bce323ef2cc4d97f513ef451764be514c62166ecf9e7fa9a8d7ab6b0eb7a1d4c749ec3f1731863fda04fbd4aee760bb57f123473d8ab1b05
SSDEEP 6144:CxBKKh0B7jTGsI0DsmYSkjdbq5TSMhP/+:Hv7I8smYSrh3+
TLSH
T1CB447D16B6955CF8EC77C03C82564A52B93278850B21DBFF03A4433A2F67AE59E3D760
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d1ce3fe00cd981ed83647b10af21b8d5456e039aa4dda24adf0f7df44c952168

File Explorer

d1ce3fe00cd981ed83647b10af21b8d5456e039aa4dda24adf0f7df44c952168

.exe 260KB

d1ce3fe00cd981ed83647b10af21b8d5456e039aa4dda24adf0f7df44c952168

IMPHASH 573a5c12ce59f0cafb2d304b2429e0e9
SHA256 d1ce3fe00cd981ed83647b10af21b8d5456e039aa4dda24adf0f7df44c952168
MD5 450d96423b6fbb4c8ecfd1fd4ecfaceb
SHA1 5549987280755b2dce36d79211616957376a3af3
SHA512 dcf25e2b790b45f2bce323ef2cc4d97f513ef451764be514c62166ecf9e7fa9a8d7ab6b0eb7a1d4c749ec3f1731863fda04fbd4aee760bb57f123473d8ab1b05
SSDEEP 6144:CxBKKh0B7jTGsI0DsmYSkjdbq5TSMhP/+:Hv7I8smYSrh3+
TLSH
T1CB447D16B6955CF8EC77C03C82564A52B93278850B21DBFF03A4433A2F67AE59E3D760
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

114720

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

build_script_build-3948676e3f3412ef.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

kernel32

GetFileType HeapSize LCMapStringW CompareStringW GetLastError WaitForSingleObject CloseHandle FreeEnvironmentStringsW SetLastError GetCurrentThreadId CreateFileW GetProcessHeap HeapFree HeapReAlloc QueryPerformanceCounter GetCurrentProcessId FlushFileBuffers GetCurrentProcess RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetEnvironmentStringsW TerminateProcess GetStdHandle SetFilePointerEx AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW lstrlenW FindFirstFileExW FindClose ExitProcess GetProcAddress WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex SetEnvironmentVariableW HeapAlloc MultiByteToWideChar WriteConsoleW GetConsoleMode GetConsoleOutputCP GetModuleHandleW FormatMessageW GetModuleFileNameW GetModuleHandleA FindNextFileW LoadLibraryExW VirtualProtect GetStringTypeW SetStdHandle GetCPInfo GetOEMCP GetACP IsValidCodePage UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetCommandLineA GetModuleHandleExW FreeLibrary WriteFile DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection EncodePointer FlsFree FlsSetValue FlsGetValue FlsAlloc RaiseException RtlPcToFileHeader RtlUnwindEx GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter

ntdll

NtWriteFile RtlNtStatusToDosError

Name

.text

Size

169KB

Virtual Size

168KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

75KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

d1ce3fe00cd981ed83647b10af21b8d5456e039aa4dda24adf0f7df44c952168

api-ms-win-core-synch-l1-2-0

kernel32

ntdll

generic