ee79657ac364a9e6b8ea4001cc8ef67686c800d122aec05839d9d01a1254df08

Sharing

Copy URL Twitter E-mail

General

Target
ee79657ac364a9e6b8ea4001cc8ef67686c800d122aec05839d9d01a1254df08
Size 3.5MB
Sample260922-p3febswbnf
SHA256 ee79657ac364a9e6b8ea4001cc8ef67686c800d122aec05839d9d01a1254df08
MD5 57da35f678c7c6dab44110df0b52617a
SHA1 dfb0575fd5eef70c4c259c502ab83435dd8106aa
SHA512 87b8954bae78202319b18bc94fca62ee73fad782a874b207905dd0139d2fc45629a27839c9e02aae8042fa7cfbd47b76aef314ade0246f1d05f661bb49b02353
SSDEEP 49152:P/eGoOH6RgK+p8kThlmpEMYP9Vi5lqW6AD0pYnCAHcIUq5E:XlPed6+Zr5
TLSH
T1C806F717E6B651E9C4BAC07882976B27BC71349947389BE34680866B1F31FF4AD3E344
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ee79657ac364a9e6b8ea4001cc8ef67686c800d122aec05839d9d01a1254df08

File Explorer

ee79657ac364a9e6b8ea4001cc8ef67686c800d122aec05839d9d01a1254df08

.exe 3.5MB

ee79657ac364a9e6b8ea4001cc8ef67686c800d122aec05839d9d01a1254df08

IMPHASH 7a2871b9e1e552be01fb9f1d1cdadb40
SHA256 ee79657ac364a9e6b8ea4001cc8ef67686c800d122aec05839d9d01a1254df08
MD5 57da35f678c7c6dab44110df0b52617a
SHA1 dfb0575fd5eef70c4c259c502ab83435dd8106aa
SHA512 87b8954bae78202319b18bc94fca62ee73fad782a874b207905dd0139d2fc45629a27839c9e02aae8042fa7cfbd47b76aef314ade0246f1d05f661bb49b02353
SSDEEP 49152:P/eGoOH6RgK+p8kThlmpEMYP9Vi5lqW6AD0pYnCAHcIUq5E:XlPed6+Zr5
TLSH
T1C806F717E6B651E9C4BAC07882976B27BC71349947389BE34680866B1F31FF4AD3E344
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2941424

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

cockpit_sync_harness.pdb

bcryptprimitives

ProcessPrng

kernel32

DeleteFileA WaitForSingleObjectEx LoadLibraryA CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA Sleep MultiByteToWideChar HeapSize HeapValidate UnmapViewOfFile GetFileAttributesW CreateFileW CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile OutputDebugStringA GetDiskFreeSpaceW WriteFile GetFullPathNameW HeapCreate ReadFile AreFileApisANSI RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection HeapReAlloc GetCurrentThreadId GetSystemInfo LoadLibraryW HeapCompact SetLastError HeapDestroy UnlockFile SetFileInformationByHandle SetFileTime QueryPerformanceFrequency LocalFree LockFileEx GetFileSize GetCurrentProcessId SystemTimeToFileTime WideCharToMultiByte GetSystemTimeAsFileTime GetSystemTime FormatMessageA CreateFileMappingW MapViewOfFile QueryPerformanceCounter GetTickCount FlushFileBuffers FormatMessageW GetLastError GetCurrentProcess RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind HeapAlloc GetSystemTimePreciseAsFileTime HeapFree GetFileInformationByHandle GetFileInformationByHandleEx GetProcessHeap InitializeSListHead GetStdHandle WaitForSingleObject CreateDirectoryW AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW lstrlenW CopyFileExW FindFirstFileExW FindClose CreateMutexA ReleaseMutex GetFinalPathNameByHandleW FreeLibrary SetEnvironmentVariableW GetModuleFileNameW WriteConsoleW GetConsoleMode GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer GetModuleHandleW GetProcAddress LoadLibraryExA GetModuleHandleA MoveFileExW FindNextFileW CloseHandle SetUnhandledExceptionFilter DeleteFileW DeleteCriticalSection

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

oleaut32

SysStringLen SysFreeString

ntdll

NtReadFile RtlNtStatusToDosError NtWriteFile

vcruntime140

__CxxFrameHandler3 __current_exception memcpy memset _CxxThrowException __C_specific_handler strrchr memmove memcmp memchr strchr __current_exception_context

api-ms-win-crt-string-l1-1-0

strlen strncmp strcspn strcmp strspn

api-ms-win-crt-heap-l1-1-0

malloc _msize free _set_new_mode realloc

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

_localtime64_s

api-ms-win-crt-math-l1-1-0

log fabs __setusermatherr _dclass

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv _register_onexit_function terminate _seh_filter_exe _set_app_type _exit exit _initterm_e _initterm _get_initial_narrow_environment _beginthreadex _endthreadex _configure_narrow_argv __p___argc _crt_atexit _initialize_narrow_environment

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

ee79657ac364a9e6b8ea4001cc8ef67686c800d122aec05839d9d01a1254df08

bcryptprimitives

kernel32

api-ms-win-core-synch-l1-2-0

oleaut32

ntdll

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic