d6010cf33ac1bf4ec63b179268fe96ce9177b9b5109b1ef687a203767a6fe9f5

Sharing

Copy URL Twitter E-mail

General

Target
d6010cf33ac1bf4ec63b179268fe96ce9177b9b5109b1ef687a203767a6fe9f5
Size 51KB
Sample260930-c4brba1bnf
SHA256 d6010cf33ac1bf4ec63b179268fe96ce9177b9b5109b1ef687a203767a6fe9f5
MD5 dd8672b0b67577b6755f5d38418b2db6
SHA1 65ba868dd746ee7b22f6dc70185d3d3beebfff43
SHA512 414238d77060c1d932c88c3788695be8d481eade2736411b1f56cb9460c1778f06dedac8895075407a53c4c45b4af8d5c585d81bda6710d52ffb7a7dd8e60bb1
SSDEEP 768:ohDyxGu27ELUEzfuX+iubnlA9XRpLmHxLnzqpqnMfqas2+MNeeDFctAV2dMfmsiP:ohDyxGl6ufWlA9nmHxTupqMTFlk4slP
TLSH
T1BD334B0EB39764FCC62FC17489EA5772EAB1B86511306F3E6350EB311E20E607E39A55
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d6010cf33ac1bf4ec63b179268fe96ce9177b9b5109b1ef687a203767a6fe9f5

File Explorer

d6010cf33ac1bf4ec63b179268fe96ce9177b9b5109b1ef687a203767a6fe9f5

.exe 51KB

d6010cf33ac1bf4ec63b179268fe96ce9177b9b5109b1ef687a203767a6fe9f5

IMPHASH 0dd73624dde26a1485129a95404bdc62
SHA256 d6010cf33ac1bf4ec63b179268fe96ce9177b9b5109b1ef687a203767a6fe9f5
MD5 dd8672b0b67577b6755f5d38418b2db6
SHA1 65ba868dd746ee7b22f6dc70185d3d3beebfff43
SHA512 414238d77060c1d932c88c3788695be8d481eade2736411b1f56cb9460c1778f06dedac8895075407a53c4c45b4af8d5c585d81bda6710d52ffb7a7dd8e60bb1
SSDEEP 768:ohDyxGu27ELUEzfuX+iubnlA9XRpLmHxLnzqpqnMfqas2+MNeeDFctAV2dMfmsiP:ohDyxGl6ufWlA9nmHxTupqMTFlk4slP
TLSH
T1BD334B0EB39764FCC62FC17489EA5772EAB1B86511306F3E6350EB311E20E607E39A55
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

GetUserNameA

bcrypt

BCryptDecrypt BCryptEncrypt BCryptGenerateSymmetricKey BCryptOpenAlgorithmProvider BCryptSetProperty

kernel32

CloseHandle CreateFileA CreatePipe CreateProcessA CreateRemoteThread CreateThread DeleteCriticalSection EnterCriticalSection GetComputerNameA GetCurrentProcessId GetExitCodeProcess GetFileSize GetLastError GetModuleFileNameA GetSystemTimeAsFileTime GetTickCount64 InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection MultiByteToWideChar OpenProcess PeekNamedPipe ReadFile SetHandleInformation SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue VirtualAllocEx VirtualFreeEx VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte WriteFile WriteProcessMemory

msvcrt

__C_specific_handler ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _cexit _commode _errno _exit _fmode _initterm _strtoui64 _time64 abort atexit atoi calloc exit fprintf fputc free localeconv malloc memcmp memcpy rand signal srand strchr strcmp strcpy strerror strlen strncmp strrchr strstr strtoul vfprintf wcslen

ws2_32

WSAStartup closesocket connect freeaddrinfo getaddrinfo recv select send setsockopt socket

Name

.text

Size

38KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

688B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

512B

Virtual Size

100B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

d6010cf33ac1bf4ec63b179268fe96ce9177b9b5109b1ef687a203767a6fe9f5

advapi32

bcrypt

kernel32

msvcrt

ws2_32

generic