d32a70f11700c67761612f553df9238b1ba6a8092e02c1feb21f2eb2ded23355

Sharing

Copy URL Twitter E-mail

General

Target
d32a70f11700c67761612f553df9238b1ba6a8092e02c1feb21f2eb2ded23355
Size 1.5MB
Sample260928-c2f81starf
SHA256 d32a70f11700c67761612f553df9238b1ba6a8092e02c1feb21f2eb2ded23355
MD5 97a65fd651f1b682aa2515c9ee669ffb
SHA1 a450bed711a9d5ec0b47fd3646dd9c26529365e9
SHA512 e9e40817260523b40a27dc482dbb2706ff56f504ab2687d5ff3484177c4d87bf5ddb9de50fbebaa81ee677a617bd76f83f95d8594f6ea430ee66612bfe08a4dd
SSDEEP 24576:YbdsD6BtX6HFB0N+iwvOhn2ook+uGpfyt0dOm9wVIH06iy9FM:YbW6yHFNiwi2ooB9pfyC+IU6is
TLSH
T138658D43F651C0ECC599C078C7579636FA22BC8D0920B6EB27D09B252E36F916F1DB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d32a70f11700c67761612f553df9238b1ba6a8092e02c1feb21f2eb2ded23355

File Explorer

d32a70f11700c67761612f553df9238b1ba6a8092e02c1feb21f2eb2ded23355

.exe 1.5MB

d32a70f11700c67761612f553df9238b1ba6a8092e02c1feb21f2eb2ded23355

IMPHASH f3f8290a4bde0b069478fe3f12bdab0e
SHA256 d32a70f11700c67761612f553df9238b1ba6a8092e02c1feb21f2eb2ded23355
MD5 97a65fd651f1b682aa2515c9ee669ffb
SHA1 a450bed711a9d5ec0b47fd3646dd9c26529365e9
SHA512 e9e40817260523b40a27dc482dbb2706ff56f504ab2687d5ff3484177c4d87bf5ddb9de50fbebaa81ee677a617bd76f83f95d8594f6ea430ee66612bfe08a4dd
SSDEEP 24576:YbdsD6BtX6HFB0N+iwvOhn2ook+uGpfyt0dOm9wVIH06iy9FM:YbW6yHFNiwi2ooB9pfyC+IU6is
TLSH
T138658D43F651C0ECC599C078C7579636FA22BC8D0920B6EB27D09B252E36F916F1DB1A
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

SystemFunction036

bcrypt

BCryptGenRandom

kernel32

AddVectoredExceptionHandler CloseHandle CreateFileMappingA CreateFileW CreatePipe CreateToolhelp32Snapshot CreateWaitableTimerExW DuplicateHandle ExitProcess FlsAlloc FlsFree FlsSetValue FormatMessageW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentVariableW GetFileInformationByHandle GetFileInformationByHandleEx GetFullPathNameW GetLastError GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetProcAddress GetProcessHeap GetStdHandle GetSystemTimePreciseAsFileTime HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete IsDebuggerPresent IsThreadAFiber MapViewOfFile Module32FirstW Module32NextW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency ReadFile RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetFileInformationByHandle SetFileTime SetHandleInformation SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter SetWaitableTimer Sleep TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnmapViewOfFile WaitForSingleObject WriteConsoleW DeleteCriticalSection EnterCriticalSection InitializeCriticalSection LeaveCriticalSection RaiseException RtlUnwindEx VirtualProtect VirtualQuery __C_specific_handler

ntdll

NtReadFile NtWriteFile RtlNtStatusToDosError

ws2_32

WSACleanup WSADuplicateSocketW WSAGetLastError WSARecv WSASend WSASocketW WSAStartup closesocket connect freeaddrinfo getaddrinfo getpeername getsockname getsockopt ioctlsocket recv select send setsockopt

api-ms-win-crt-environment-l1-1-0

__p__environ

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-private-l1-1-0

memcmp memcpy memmove

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv _cexit _configure_narrow_argv _crt_atexit _exit _fpreset _initialize_narrow_environment _set_app_type _initterm _initterm_e _set_invalid_parameter_handler abort exit signal

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf fflush setvbuf

api-ms-win-crt-string-l1-1-0

memset strlen strncmp

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

Name

.text

Size

929KB

Virtual Size

928KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

484KB

Virtual Size

484KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

25KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

35KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

512B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

d32a70f11700c67761612f553df9238b1ba6a8092e02c1feb21f2eb2ded23355

advapi32

bcrypt

kernel32

ntdll

ws2_32

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-core-synch-l1-2-0

bcryptprimitives

generic