b7c06c88175fce429e187cee4c497526217cdafa6e80e56bf246f1973d288faa

General

Target
b7c06c88175fce429e187cee4c497526217cdafa6e80e56bf246f1973d288faa
Size 290KB
Sample260930-b5bx2asvct
SHA256 b7c06c88175fce429e187cee4c497526217cdafa6e80e56bf246f1973d288faa
MD5 6b1188c6e93191f343fc81cf5d165d5c
SHA1 b1a397812e634281668a7be6bef576afe068964a
SHA512 ddc2866a3357f333d49b4555283dec040f29363228ea4f4c3779c173761eac2126a2428ad5f4b6d851a94cc06777e24bb2760f143c662790947e9c2da7e9b3a1
SSDEEP 6144:weSaML0+O9NTSTQPgv4cLCWBzI9vdu3rGt:wesOC4gvx6vd
TLSH
T1AB547C1AF69061F9E86BC03C82564A51B93274890B21DBFF03A443393F67AF58E7D764
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b7c06c88175fce429e187cee4c497526217cdafa6e80e56bf246f1973d288faa

File Explorer

b7c06c88175fce429e187cee4c497526217cdafa6e80e56bf246f1973d288faa

.exe 290KB

b7c06c88175fce429e187cee4c497526217cdafa6e80e56bf246f1973d288faa

IMPHASH 573a5c12ce59f0cafb2d304b2429e0e9
SHA256 b7c06c88175fce429e187cee4c497526217cdafa6e80e56bf246f1973d288faa
MD5 6b1188c6e93191f343fc81cf5d165d5c
SHA1 b1a397812e634281668a7be6bef576afe068964a
SHA512 ddc2866a3357f333d49b4555283dec040f29363228ea4f4c3779c173761eac2126a2428ad5f4b6d851a94cc06777e24bb2760f143c662790947e9c2da7e9b3a1
SSDEEP 6144:weSaML0+O9NTSTQPgv4cLCWBzI9vdu3rGt:wesOC4gvx6vd
TLSH
T1AB547C1AF69061F9E86BC03C82564A51B93274890B21DBFF03A443393F67AF58E7D764
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

123168

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

build_script_build-e5c6694de753c14a.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

kernel32

GetFileType HeapSize LCMapStringW CompareStringW GetLastError WaitForSingleObject CloseHandle FreeEnvironmentStringsW SetLastError GetCurrentThreadId CreateFileW GetProcessHeap HeapFree HeapReAlloc QueryPerformanceCounter GetCurrentProcessId FlushFileBuffers GetCurrentProcess RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetEnvironmentStringsW TerminateProcess GetStdHandle SetFilePointerEx AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW lstrlenW FindFirstFileExW FindClose ExitProcess GetProcAddress WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex SetEnvironmentVariableW HeapAlloc MultiByteToWideChar WriteConsoleW GetConsoleMode GetConsoleOutputCP GetModuleHandleW FormatMessageW GetModuleFileNameW GetModuleHandleA FindNextFileW LoadLibraryExW VirtualProtect GetStringTypeW SetStdHandle GetCPInfo GetOEMCP GetACP IsValidCodePage UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetCommandLineA GetModuleHandleExW FreeLibrary WriteFile DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection EncodePointer FlsFree FlsSetValue FlsGetValue FlsAlloc RaiseException RtlPcToFileHeader RtlUnwindEx GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter

ntdll

NtWriteFile RtlNtStatusToDosError

Name

.text

Size

177KB

Virtual Size

177KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

96KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

b7c06c88175fce429e187cee4c497526217cdafa6e80e56bf246f1973d288faa

api-ms-win-core-synch-l1-2-0

kernel32

ntdll

generic