ae903031ec8697509ee6df4dec7ee2e500fbfe35fa62a5661674aabd9831f0f5

Sharing

Copy URL Twitter E-mail

General

Target
ae903031ec8697509ee6df4dec7ee2e500fbfe35fa62a5661674aabd9831f0f5
Size 1.7MB
Sample261001-npf82attav
SHA256 ae903031ec8697509ee6df4dec7ee2e500fbfe35fa62a5661674aabd9831f0f5
MD5 f58f5dec71d70292cf06cdad4913d230
SHA1 abe0ddb0e2ad9de54ab2e02159d983cf8f625652
SHA512 b5657dd7c8d2ad640b44f5785a6d9c3b2e8c36818c03682eb6c40f6411ccf54c4e6a732d1588f38a44e1d42dbd2c12f7f83f75bf21ca338576a33225b0e04806
SSDEEP 24576:h08+Jg3Un6t1XBZAWSgKHaFtn2x9GXJp+j8qfVJ7oobznsh:h08Kvn6tKR6WGyj8qX7o
TLSH
T10385F816B66965D9C17BC07892878F72B93030CE0B396AFB45D182792F64EF86E3C714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ae903031ec8697509ee6df4dec7ee2e500fbfe35fa62a5661674aabd9831f0f5

File Explorer

ae903031ec8697509ee6df4dec7ee2e500fbfe35fa62a5661674aabd9831f0f5

.exe 1.7MB

ae903031ec8697509ee6df4dec7ee2e500fbfe35fa62a5661674aabd9831f0f5

IMPHASH 4416466598fb3a97e080a2b4bc064c17
SHA256 ae903031ec8697509ee6df4dec7ee2e500fbfe35fa62a5661674aabd9831f0f5
MD5 f58f5dec71d70292cf06cdad4913d230
SHA1 abe0ddb0e2ad9de54ab2e02159d983cf8f625652
SHA512 b5657dd7c8d2ad640b44f5785a6d9c3b2e8c36818c03682eb6c40f6411ccf54c4e6a732d1588f38a44e1d42dbd2c12f7f83f75bf21ca338576a33225b0e04806
SSDEEP 24576:h08+Jg3Un6t1XBZAWSgKHaFtn2x9GXJp+j8qfVJ7oobznsh:h08Kvn6tKR6WGyj8qX7o
TLSH
T10385F816B66965D9C17BC07892878F72B93030CE0B396AFB45D182792F64EF86E3C714
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1270432

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

rg_core-f2c29458c1b8c10f.pdb

ntdll

NtWriteFile NtCreateNamedPipeFile NtSetInformationProcess NtQueryInformationProcess RtlNtStatusToDosError NtOpenFile NtReadFile

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

bcryptprimitives

ProcessPrng

kernel32

IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime CloseHandle OpenProcess GetProcessTimes GetPriorityClass SetPriorityClass IsProcessCritical WaitForSingleObject GetProcessInformation SetProcessInformation QueryFullProcessImageNameW GetSystemInfo GlobalMemoryStatusEx ProcessIdToSessionId CreateToolhelp32Snapshot FreeLibrary Process32NextW Process32FirstW GetCurrentProcess GetProcAddress LoadLibraryExW GetStdHandle SetConsoleTextAttribute GetConsoleScreenBufferInfo LoadLibraryExA CreateEventW GetProcessHeap HeapFree HeapAlloc GetLastError FormatMessageW CompareStringOrdinal FreeEnvironmentStringsW WriteFileEx SleepEx SetLastError GetFullPathNameW GetCurrentThreadId SetFileInformationByHandle CreateFileW SetFileTime HeapReAlloc QueryPerformanceFrequency QueryPerformanceCounter CreateThread GetCurrentProcessId ReadFileEx ReadFile GetOverlappedResult DuplicateHandle RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetSystemTimePreciseAsFileTime CancelIo GetFileInformationByHandle GetFileInformationByHandleEx GetEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetExitCodeProcess GetProcessId TerminateProcess SetFilePointerEx AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW lstrlenW FindFirstFileExW FindClose ExitProcess SwitchToThread WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex GetModuleFileNameW MultiByteToWideChar WriteConsoleW GetConsoleMode GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer Sleep GetFileAttributesW GetFileType GetModuleHandleW WaitForMultipleObjects GetModuleHandleA

advapi32

OpenProcessToken GetLengthSid GetTokenInformation RegGetValueW

user32

GetWindowThreadProcessId GetForegroundWindow

psapi

GetProcessMemoryInfo

gdi32

CreateCompatibleDC DeleteDC

oleaut32

SysStringLen SysFreeString

userenv

GetUserProfileDirectoryW

vcruntime140

__CxxFrameHandler3 __current_exception_context memmove __current_exception __C_specific_handler _CxxThrowException memcmp memset memcpy

api-ms-win-crt-math-l1-1-0

fmod floor __setusermatherr

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

api-ms-win-crt-runtime-l1-1-0

_initterm_e _initialize_narrow_environment exit _exit terminate _configure_narrow_argv _crt_atexit _initterm _set_app_type _register_onexit_function _register_thread_local_exe_atexit_callback __p___argc _initialize_onexit_table __p___argv _seh_filter_exe _get_initial_narrow_environment _cexit _c_exit

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

ae903031ec8697509ee6df4dec7ee2e500fbfe35fa62a5661674aabd9831f0f5

ntdll

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

advapi32

user32

psapi

gdi32

oleaut32

userenv

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic