2d0cbfeb83f9a6e24c58f2c0eba8e2e15bd7e2c9d2563ed1afc48523beafa57a

Sharing

Copy URL Twitter E-mail

General

Target
2d0cbfeb83f9a6e24c58f2c0eba8e2e15bd7e2c9d2563ed1afc48523beafa57a
Size 422KB
Sample260922-nrpcessta1
SHA256 2d0cbfeb83f9a6e24c58f2c0eba8e2e15bd7e2c9d2563ed1afc48523beafa57a
MD5 0984fd301e6abbaa0c03d60a059d6c8f
SHA1 da6c58f49d17c376cf52fe7e3365aa09218eb90e
SHA512 088de27765f5667c713275e0aa5fa87e3c4ca0115b0aa78a84ad7af8660a54b678301dc27053d9bcdd65db433a85d6322c37cf10c3f83239a6f6ed92137767d4
SSDEEP 6144:dWSOKMZAO9lgYYcZ+Y0iAZfWGP+AzxavkGocsFVcKIgI5IN:dWHpn9lb0iSf9c/AVcKIu
TLSH
T1D0944A12BA0B59BCD407C475C3168A631A3178CB0B66B9EF5094A5343FADBF56F3A318
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2d0cbfeb83f9a6e24c58f2c0eba8e2e15bd7e2c9d2563ed1afc48523beafa57a

File Explorer

2d0cbfeb83f9a6e24c58f2c0eba8e2e15bd7e2c9d2563ed1afc48523beafa57a

.exe 422KB

2d0cbfeb83f9a6e24c58f2c0eba8e2e15bd7e2c9d2563ed1afc48523beafa57a

IMPHASH 4f52f5d16c9e805106e63936b7dbca4f
SHA256 2d0cbfeb83f9a6e24c58f2c0eba8e2e15bd7e2c9d2563ed1afc48523beafa57a
MD5 0984fd301e6abbaa0c03d60a059d6c8f
SHA1 da6c58f49d17c376cf52fe7e3365aa09218eb90e
SHA512 088de27765f5667c713275e0aa5fa87e3c4ca0115b0aa78a84ad7af8660a54b678301dc27053d9bcdd65db433a85d6322c37cf10c3f83239a6f6ed92137767d4
SSDEEP 6144:dWSOKMZAO9lgYYcZ+Y0iAZfWGP+AzxavkGocsFVcKIgI5IN:dWHpn9lb0iSf9c/AVcKIu
TLSH
T1D0944A12BA0B59BCD407C475C3168A631A3178CB0B66B9EF5094A5343FADBF56F3A318
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

300560

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dsh_sidecar.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

kernel32

ExitProcess WaitForSingleObject GetConsoleOutputCP CreateWaitableTimerExW GetStdHandle ReleaseMutex CreateMutexA GetCurrentProcessId WaitForSingleObjectEx GetCurrentProcess GetEnvironmentVariableW SetLastError GetCurrentThreadId SetWaitableTimer Sleep WriteConsoleW GetLastError GetCurrentThread FreeConsole AllocConsole SetConsoleCtrlHandler GetConsoleWindow GetCurrentDirectoryW SetHandleInformation GenerateConsoleCtrlEvent TerminateJobObject GetEnvironmentStringsW FreeEnvironmentStringsW CreateProcessW CloseHandle ReadConsoleW CreateJobObjectW SetInformationJobObject AssignProcessToJobObject CreateThread TerminateProcess GetExitCodeProcess SwitchToThread GetConsoleMode SetThreadStackGuarantee CreatePipe GetModuleHandleA InitializeSListHead GetSystemTimeAsFileTime SetFilePointerEx GetFileInformationByHandleEx GetFileInformationByHandle SetUnhandledExceptionFilter QueryPerformanceCounter FormatMessageW GetModuleHandleW QueryPerformanceFrequency HeapAlloc MultiByteToWideChar WideCharToMultiByte RtlVirtualUnwind lstrlenW GetProcAddress LoadLibraryA RtlLookupFunctionEntry RtlCaptureContext AddVectoredExceptionHandler HeapReAlloc HeapFree GetProcessHeap

user32

ShowWindow

ntdll

NtWriteFile NtReadFile RtlNtStatusToDosError

ws2_32

WSASocketW recv WSACleanup WSAStartup ioctlsocket getsockopt send setsockopt connect closesocket WSAGetLastError select

vcruntime140

memmove __current_exception_context __current_exception __C_specific_handler _CxxThrowException memcmp memset memcpy __CxxFrameHandler3

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv __p___argc _register_onexit_function exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _crt_atexit terminate _set_app_type _seh_filter_exe _exit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

2d0cbfeb83f9a6e24c58f2c0eba8e2e15bd7e2c9d2563ed1afc48523beafa57a

api-ms-win-core-synch-l1-2-0

kernel32

user32

ntdll

ws2_32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic