a3745aa81c7ff7bb1f1a4ee46a0b3959a67a605f2a05a8559209b16ec4992565

Sharing

Copy URL Twitter E-mail

General

Target
a3745aa81c7ff7bb1f1a4ee46a0b3959a67a605f2a05a8559209b16ec4992565
Size 954KB
Sample260929-s2nabsvble
SHA256 a3745aa81c7ff7bb1f1a4ee46a0b3959a67a605f2a05a8559209b16ec4992565
MD5 91da8db8a29b107cae3a394bc0bbba52
SHA1 f56fe4c0c0fc7efd2eb66773a6f956617da3929a
SHA512 b98935d077ec6e6fcfd19c14fdf471f20080e0e762ce7c2d59045b0c00f1b581b1260516d860d6ecff2f55fbf1e6e76b9316b1d338bea3e5f802b230f4697ff4
SSDEEP 24576:RcCTp9Qn8Ehj5tH0AoHaAR8wh6QMUkl8zD6:RcCTYnJhw9628wYgkln
TLSH
T15925AE86E5914DBFC046C3B1C36A68BEF17BBF964D30991B6F467A205F32A04D939B10
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a3745aa81c7ff7bb1f1a4ee46a0b3959a67a605f2a05a8559209b16ec4992565

File Explorer

a3745aa81c7ff7bb1f1a4ee46a0b3959a67a605f2a05a8559209b16ec4992565

.dll 954KB

a3745aa81c7ff7bb1f1a4ee46a0b3959a67a605f2a05a8559209b16ec4992565

IMPHASH 55bd7b0597c7cdba2eb9f88f343c7822
SHA256 a3745aa81c7ff7bb1f1a4ee46a0b3959a67a605f2a05a8559209b16ec4992565
MD5 91da8db8a29b107cae3a394bc0bbba52
SHA1 f56fe4c0c0fc7efd2eb66773a6f956617da3929a
SHA512 b98935d077ec6e6fcfd19c14fdf471f20080e0e762ce7c2d59045b0c00f1b581b1260516d860d6ecff2f55fbf1e6e76b9316b1d338bea3e5f802b230f4697ff4
SSDEEP 24576:RcCTp9Qn8Ehj5tH0AoHaAR8wh6QMUkl8zD6:RcCTYnJhw9628wYgkln
TLSH
T15925AE86E5914DBFC046C3B1C36A68BEF17BBF964D30991B6F467A205F32A04D939B10
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

149476

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

bcryptprimitives

ProcessPrng

kernel32

Thread32Next SuspendThread RtlCaptureContext VirtualAlloc WaitForMultipleObjects CreateProcessW GetCurrentThread VirtualQuery VirtualProtect CreateThread CreateEventW SetEvent SetThreadContext OpenEventW GetModuleHandleA GetProcessHeap HeapFree LoadLibraryA GetModuleHandleW FormatMessageW FlsAlloc GetModuleHandleExW FlsFree FlsSetValue IsThreadAFiber HeapReAlloc HeapAlloc ExitProcess SwitchToThread CreateWaitableTimerExW SetWaitableTimer Sleep LoadLibraryExA HeapCreate GetThreadContext ResumeThread GetSystemInfo VirtualFree GetSystemTimeAsFileTime WaitForSingleObject OpenThread OpenProcess RtlLookupFunctionEntry GetCurrentProcess RtlVirtualUnwind GetProcAddress LoadLibraryW GetModuleFileNameW IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent Thread32First FindNextFileW CopyFileExW QueryDosDeviceW GetLogicalDrives GetFinalPathNameByHandleW GetTempPathW WriteConsoleW InitializeSListHead GetConsoleOutputCP GetConsoleMode GetCurrentThreadId GetStdHandle GetFileInformationByHandleEx GetCurrentProcessId FindFirstFileExW SetFileInformationByHandle SetFileTime GetFullPathNameW GetFileInformationByHandle FindClose CloseHandle GetLastError SetLastError FlushInstructionCache CreateToolhelp32Snapshot TerminateProcess QueryPerformanceCounter CreateDirectoryW MultiByteToWideChar CreateFileW GetCurrentDirectoryW GetEnvironmentVariableW QueryPerformanceFrequency

ntdll

RtlNtStatusToDosError NtWriteFile NtReadFile NtTerminateProcess NtOpenFile

oleaut32

SysFreeString SysStringLen

user32

MessageBoxW

advapi32

CreateServiceW StartServiceW OpenProcessToken OpenSCManagerW CloseServiceHandle OpenServiceW DeleteService ControlService GetTokenInformation

shell32

ShellExecuteW

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

vcruntime140

memcmp memset memcpy memmove __std_type_info_destroy_list __C_specific_handler

api-ms-win-crt-string-l1-1-0

strlen wcslen

api-ms-win-crt-math-l1-1-0

ceil log10

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _execute_onexit_table _seh_filter_dll _initialize_onexit_table _initialize_narrow_environment _crt_atexit _initterm_e _cexit _initterm _configure_narrow_argv

Name

.text

Size

148KB

Virtual Size

147KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

31KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.*03

Size

764KB

Virtual Size

764KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

632B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

a3745aa81c7ff7bb1f1a4ee46a0b3959a67a605f2a05a8559209b16ec4992565

bcryptprimitives

kernel32

ntdll

oleaut32

user32

advapi32

shell32

api-ms-win-core-synch-l1-2-0

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

generic