5e1b0b9a1fb172e5b49b497ea82af412b0b6b9f07adaa6f0bc1f239621a409d7

Sharing

Copy URL Twitter E-mail

General

Target
5e1b0b9a1fb172e5b49b497ea82af412b0b6b9f07adaa6f0bc1f239621a409d7
Size 1.7MB
Sample260930-c2gjsa1bjf
SHA256 5e1b0b9a1fb172e5b49b497ea82af412b0b6b9f07adaa6f0bc1f239621a409d7
MD5 e4354770d2dcb1756a08616b393b200c
SHA1 8b8fd5f8d1b64fa97d5fd3c7d2b741f853341427
SHA512 29fb42881455c100df2d3daf5820e7308796701525a62c79db87847de38d7fd6ca2951c57c817cde88044048a244cfe20f54ee375e7b242827835c588a9761d8
SSDEEP 24576:Kv4jNTvSyBTu+cyPcyt74bt/wd5mqie2/nyosHlEAwN26PYNqb:qKFw+Dcyt7Jd5mqie2POHl3K2
TLSH
T182851826776864E9C1BBC07882879F21792170D90B352FF746D1827A2F25EF96E3D324
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5e1b0b9a1fb172e5b49b497ea82af412b0b6b9f07adaa6f0bc1f239621a409d7

File Explorer

5e1b0b9a1fb172e5b49b497ea82af412b0b6b9f07adaa6f0bc1f239621a409d7

.exe 1.7MB

5e1b0b9a1fb172e5b49b497ea82af412b0b6b9f07adaa6f0bc1f239621a409d7

IMPHASH 7c852f6455ccdc5f5ec1c07051a2b24d
SHA256 5e1b0b9a1fb172e5b49b497ea82af412b0b6b9f07adaa6f0bc1f239621a409d7
MD5 e4354770d2dcb1756a08616b393b200c
SHA1 8b8fd5f8d1b64fa97d5fd3c7d2b741f853341427
SHA512 29fb42881455c100df2d3daf5820e7308796701525a62c79db87847de38d7fd6ca2951c57c817cde88044048a244cfe20f54ee375e7b242827835c588a9761d8
SSDEEP 24576:Kv4jNTvSyBTu+cyPcyt74bt/wd5mqie2/nyosHlEAwN26PYNqb:qKFw+Dcyt7Jd5mqie2POHl3K2
TLSH
T182851826776864E9C1BBC07882879F21792170D90B352FF746D1827A2F25EF96E3D324
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1166400

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

build_script_build-225efe4ace6cb985.pdb

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

kernel32

CloseHandle PeekNamedPipe CreateEventA WaitForMultipleObjects WaitForSingleObject OpenSemaphoreA ReleaseSemaphore SetEvent GetProcAddress LoadLibraryA GetNativeSystemInfo CompareStringOrdinal GetLastError FreeEnvironmentStringsW WriteFileEx SleepEx SetLastError GetFullPathNameW GetCurrentThreadId SetFileInformationByHandle CreateFileW SetFileTime GetProcessHeap HeapFree HeapReAlloc QueryPerformanceFrequency QueryPerformanceCounter CreateThread CreateEventW GetCurrentProcessId ReadFileEx ReadFile GetOverlappedResult FlushFileBuffers GetCurrentProcess DuplicateHandle RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind CancelIo GetFileInformationByHandle GetFileInformationByHandleEx GetEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW CompareStringW TerminateProcess GetStdHandle CreateDirectoryW SetFilePointerEx AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW lstrlenW CopyFileExW FindFirstFileExW FindClose CreateHardLinkW ExitProcess GetSystemInfo SwitchToThread WideCharToMultiByte WaitForSingleObjectEx CreateMutexA ReleaseMutex DeleteFileW SetEnvironmentVariableW HeapAlloc MultiByteToWideChar WriteConsoleW GetConsoleMode GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer Sleep GetFileAttributesW GetFileType FormatMessageW GetModuleFileNameW GetModuleHandleA GetTempPathW FindNextFileW LCMapStringW HeapSize GetExitCodeProcess GetModuleHandleW LoadLibraryExW VirtualProtect GetStringTypeW SetStdHandle GetCPInfo GetOEMCP GetACP IsValidCodePage UnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent GetCommandLineA GetModuleHandleExW FreeLibrary WriteFile DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection EncodePointer FlsFree FlsSetValue FlsGetValue FlsAlloc RaiseException RtlPcToFileHeader RtlUnwindEx GetStartupInfoW SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime

advapi32

RegCloseKey RegQueryValueExW RegOpenKeyExW RegEnumKeyExW

ole32

CoInitializeEx CoCreateInstance

oleaut32

SysStringLen SysFreeString

ntdll

NtWriteFile NtReadFile RtlNtStatusToDosError NtOpenFile NtCreateNamedPipeFile

Name

.text

Size

1.2MB

Virtual Size

1.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

437KB

Virtual Size

437KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

90KB

Virtual Size

90KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

5e1b0b9a1fb172e5b49b497ea82af412b0b6b9f07adaa6f0bc1f239621a409d7

bcryptprimitives

api-ms-win-core-synch-l1-2-0

kernel32

advapi32

ole32

oleaut32

ntdll

generic