8913e99e4ccb046e17c6e3e3719efca4a9a73aca9e7500dae1d85f0f13c8ca9e

Sharing

Copy URL Twitter E-mail

General

Target
8913e99e4ccb046e17c6e3e3719efca4a9a73aca9e7500dae1d85f0f13c8ca9e
Size 463KB
Sample260930-ml5lsazfle
SHA256 8913e99e4ccb046e17c6e3e3719efca4a9a73aca9e7500dae1d85f0f13c8ca9e
MD5 e1d7e31fa7e6e3dd146423de3abb253e
SHA1 75b0452f56b2d341d84b0700a9267384ad96e023
SHA512 d5e38a7f1684bc2affb38b3b854a1712dd3eb381f891517ca30d886d5da612145d53b0d7fe505bd80f52370eb6185b9ac84c42345aebb4ef8f1bb8e45b29286b
SSDEEP 12288:yeq98eSx5cA1zXpDm649VCClXyctmS5V2NDhuFxk5:69Fka8Xpe9VCClXyctmS5V2N9uFxk5
TLSH
T191A48CD5779009F9D177C23CC9920A16E6B27826076097CF03B496BA1F237E29E3EB15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8913e99e4ccb046e17c6e3e3719efca4a9a73aca9e7500dae1d85f0f13c8ca9e

File Explorer

8913e99e4ccb046e17c6e3e3719efca4a9a73aca9e7500dae1d85f0f13c8ca9e

.exe 463KB

8913e99e4ccb046e17c6e3e3719efca4a9a73aca9e7500dae1d85f0f13c8ca9e

IMPHASH 4a0b5554336bb25859f80d3a22155af1
SHA256 8913e99e4ccb046e17c6e3e3719efca4a9a73aca9e7500dae1d85f0f13c8ca9e
MD5 e1d7e31fa7e6e3dd146423de3abb253e
SHA1 75b0452f56b2d341d84b0700a9267384ad96e023
SHA512 d5e38a7f1684bc2affb38b3b854a1712dd3eb381f891517ca30d886d5da612145d53b0d7fe505bd80f52370eb6185b9ac84c42345aebb4ef8f1bb8e45b29286b
SSDEEP 12288:yeq98eSx5cA1zXpDm649VCClXyctmS5V2NDhuFxk5:69Fka8Xpe9VCClXyctmS5V2N9uFxk5
TLSH
T191A48CD5779009F9D177C23CC9920A16E6B27826076097CF03B496BA1F237E29E3EB15
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

93332

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\docker\Documents\workspace\build-v2\common\hrkill\bin\usysdiag-helper-x64.pdb

kernel32

GetCommandLineW WaitForSingleObject CreateThread ExitProcess SetProcessWorkingSetSize TlsSetValue HeapFree SetLastError InitializeCriticalSectionAndSpinCount GetQueuedCompletionStatus LocalAlloc GetCurrentThreadId HeapSize PostQueuedCompletionStatus GetExitCodeThread GetLastError SetEvent TlsAlloc HeapReAlloc RaiseException ResetEvent HeapAlloc DecodePointer HeapDestroy GetProcessHeap TlsGetValue CreateToolhelp32Snapshot CreateEventA CreateIoCompletionPort VirtualQuery WriteConsoleW SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers SetStdHandle OutputDebugStringA SetConsoleCtrlHandler SetEnvironmentVariableW SetEnvironmentVariableA FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo Module32First Module32Next VirtualQueryEx OpenThread TerminateThread TerminateProcess FreeLibrary GetCurrentDirectoryW CreateFileA GetCurrentDirectoryA SetFilePointer WriteFile SearchPathW ReadFile ExpandEnvironmentStringsA DeviceIoControl IsBadReadPtr SearchPathA GetSystemInfo LoadLibraryA CreateFileW GetVersion GetProcAddress GetModuleHandleA GetTickCount WideCharToMultiByte DeleteCriticalSection LocalFree GetWindowsDirectoryW CloseHandle Sleep MultiByteToWideChar OpenProcess InitializeCriticalSection LeaveCriticalSection GetOEMCP IsValidCodePage FindNextFileW FindNextFileA FindFirstFileExW FindFirstFileExA FindClose EnumSystemLocalesW GetUserDefaultLCID GetCurrentProcess GetLongPathNameW EnterCriticalSection VirtualAlloc VirtualFree VirtualProtect GetFileAttributesA TlsFree RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent WaitForSingleObjectEx CreateEventW GetModuleHandleW IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringW RtlPcToFileHeader EncodePointer RtlUnwindEx LoadLibraryExW InterlockedPushEntrySList InterlockedFlushSList GetCommandLineA ExitThread ResumeThread FreeLibraryAndExitThread GetModuleHandleExW GetModuleFileNameA GetModuleFileNameW GetStdHandle GetACP GetStringTypeW GetCurrentThread GetFileType GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale ReadConsoleW

user32

EnumDesktopWindows GetParent GetWindowRect UnregisterClassA OpenDesktopA EnumWindowStationsA GetWindowThreadProcessId IsWindowVisible CloseWindowStation EnumDesktopsA CloseDesktop OpenWindowStationA

advapi32

RegSetValueExA RegOpenKeyW ConvertSidToStringSidW OpenProcessToken RegCloseKey RegEnumKeyExA RegQueryValueExW RegSaveKeyA AdjustTokenPrivileges LookupPrivilegeValueA GetSidSubAuthorityCount GetSidSubAuthority GetUserNameW LookupAccountNameW GetSidIdentifierAuthority BuildExplicitAccessWithNameA SetSecurityDescriptorDacl SetEntriesInAclA GetSecurityDescriptorDacl RegGetKeySecurity RegDeleteKeyA RegQueryValueExA RegDeleteKeyW RegCreateKeyExA RegEnumKeyExW RegSetKeySecurity RegSetValueExW RegLoadKeyA InitializeSecurityDescriptor RegOpenKeyExA RegOpenKeyExW RegEnumValueA RegDeleteValueA GetTokenInformation

shell32

CommandLineToArgvW SHGetSpecialFolderPathA

ole32

CoInitialize CoUninitialize CoCreateInstance

oleaut32

SysFreeString

crypt32

CryptQueryObject CertCloseStore CryptMsgGetParam CertFindCertificateInStore CertGetNameStringW CertFreeCertificateContext CryptMsgClose

Name

.text

Size

323KB

Virtual Size

322KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

107KB

Virtual Size

106KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

484B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

8913e99e4ccb046e17c6e3e3719efca4a9a73aca9e7500dae1d85f0f13c8ca9e

kernel32

user32

advapi32

shell32

ole32

oleaut32

crypt32

generic