c397547925992dcb973ac7f4eb8f345db79c542e6bbfb66fb4f6fb793c8807fc

Sharing

Copy URL Twitter E-mail

General

Target
c397547925992dcb973ac7f4eb8f345db79c542e6bbfb66fb4f6fb793c8807fc
Size 6.7MB
Sample260928-e679eawvcy
SHA256 c397547925992dcb973ac7f4eb8f345db79c542e6bbfb66fb4f6fb793c8807fc
MD5 820dd047e035e495ecf3ee9d4b98eb2c
SHA1 2f5c7fa4a6f9e4fb1d8e9ccf1659d1ed17431153
SHA512 9b1ec628809df7cb5dde558186c453749fe13a2fafc001915c97ee907897fcfc8fbb6141201388892b9bd2969ce2679ffbadf3ef3d3d41e09cb05e99adc1991e
SSDEEP 98304:4BsNjH4tRGYoAnn/oF0mITF2rVvv75aQFzyjWwCRfoqng:4ydWvLgKmq2rZQSzyjWjNo
TLSH
T1B46602BBDA0C055BC48DC4B1C23139B71E9EB4D66A15A2EF11CF1F296E25F631A3C219
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c397547925992dcb973ac7f4eb8f345db79c542e6bbfb66fb4f6fb793c8807fc

File Explorer

c397547925992dcb973ac7f4eb8f345db79c542e6bbfb66fb4f6fb793c8807fc

.exe 6.7MB

c397547925992dcb973ac7f4eb8f345db79c542e6bbfb66fb4f6fb793c8807fc

IMPHASH 5b3446c7352aaa4facfe03b96d2a531a
SHA256 c397547925992dcb973ac7f4eb8f345db79c542e6bbfb66fb4f6fb793c8807fc
MD5 820dd047e035e495ecf3ee9d4b98eb2c
SHA1 2f5c7fa4a6f9e4fb1d8e9ccf1659d1ed17431153
SHA512 9b1ec628809df7cb5dde558186c453749fe13a2fafc001915c97ee907897fcfc8fbb6141201388892b9bd2969ce2679ffbadf3ef3d3d41e09cb05e99adc1991e
SSDEEP 98304:4BsNjH4tRGYoAnn/oF0mITF2rVvv75aQFzyjWwCRfoqng:4ydWvLgKmq2rZQSzyjWjNo
TLSH
T1B46602BBDA0C055BC48DC4B1C23139B71E9EB4D66A15A2EF11CF1F296E25F631A3C219
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

410732

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetCurrentThread RtlCaptureContext HeapAlloc GetProcessHeap HeapFree AcquireSRWLockExclusive WaitForSingleObjectEx LoadLibraryA GetCurrentProcessId CreateMutexA CloseHandle RtlLookupFunctionEntry GetProcAddress FreeLibrary GetModuleHandleA TryAcquireSRWLockExclusive GetStdHandle GetConsoleMode WaitForSingleObject SetFilePointerEx MultiByteToWideChar WriteConsoleW SetLastError GetCurrentDirectoryW GetEnvironmentVariableW GetModuleHandleW FormatMessageW SetEnvironmentVariableW GetModuleFileNameW GetCommandLineW ReleaseMutex GetFileSizeEx GetFullPathNameW GetFinalPathNameByHandleW CreateDirectoryW FindFirstFileW FindClose GetFileInformationByHandle GetFileInformationByHandleEx ReadConsoleW GetCurrentProcess ExitProcess QueryPerformanceCounter QueryPerformanceFrequency AcquireSRWLockShared ReleaseSRWLockShared GetConsoleOutputCP FlushFileBuffers LoadLibraryExA HeapSize SetThreadErrorMode SetCurrentDirectoryW LoadLibraryExW SwitchToThread ReleaseSRWLockExclusive LCMapStringW CompareStringW HeapReAlloc AddVectoredExceptionHandler GetLastError WideCharToMultiByte CreateThread SetThreadStackGuarantee CreateFileW GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent RtlUnwindEx RtlPcToFileHeader RaiseException EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree WriteFile TerminateProcess GetModuleHandleExW GetCommandLineA FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle GetFileType GetStringTypeW

ntdll

NtReadFile RtlNtStatusToDosError NtWriteFile

advapi32

SystemFunction036 CloseServiceHandle OpenSCManagerW OpenServiceW

oleaut32

SysStringLen SysFreeString GetErrorInfo

bcrypt

BCryptGenRandom

user32

MessageBoxA

userenv

GetUserProfileDirectoryW

shell32

SHGetKnownFolderPath

Name

.text

Size

488KB

Virtual Size

488KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

175KB

Virtual Size

175KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

25KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

6.0MB

Virtual Size

6.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

c397547925992dcb973ac7f4eb8f345db79c542e6bbfb66fb4f6fb793c8807fc

kernel32

ntdll

advapi32

oleaut32

bcrypt

user32

userenv

shell32

generic