5b7a331e833332db014c2a510f075bb7179d011c45a1c61b7411c386b43c6a49

Sharing

Copy URL Twitter E-mail

General

Target
5b7a331e833332db014c2a510f075bb7179d011c45a1c61b7411c386b43c6a49
Size 252KB
Sample261001-yl61dsbb23
SHA256 5b7a331e833332db014c2a510f075bb7179d011c45a1c61b7411c386b43c6a49
MD5 ac454396fe574f889d739e5f9e08197e
SHA1 9377c0deb77e897957a90a673f48bc35ca4e8f22
SHA512 cce98c14247aee5a8bc81163590a49c72d73da580ef0cb699084990144a378db9f1b04fbd72b4ecce36eca0f71e4a75aae99025ee6f1b366fa32c885a0c7807d
SSDEEP 3072:CC8e6B6NE/BX3O5k6IFBEWubCf09mTOErReV4e3nxFNdn1Nh+w0cN:Cncqh3Kk69WubCf0QT544e3xFNdnvb0
TLSH
T1D2444A157A555DF8D45BC03582468AB3AA3274CB0B32EAFF0295423D2F6AEF56E3C314
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5b7a331e833332db014c2a510f075bb7179d011c45a1c61b7411c386b43c6a49

File Explorer

5b7a331e833332db014c2a510f075bb7179d011c45a1c61b7411c386b43c6a49

.exe 252KB

5b7a331e833332db014c2a510f075bb7179d011c45a1c61b7411c386b43c6a49

IMPHASH d258e17d8e9ca22a186910f2727d58c0
SHA256 5b7a331e833332db014c2a510f075bb7179d011c45a1c61b7411c386b43c6a49
MD5 ac454396fe574f889d739e5f9e08197e
SHA1 9377c0deb77e897957a90a673f48bc35ca4e8f22
SHA512 cce98c14247aee5a8bc81163590a49c72d73da580ef0cb699084990144a378db9f1b04fbd72b4ecce36eca0f71e4a75aae99025ee6f1b366fa32c885a0c7807d
SSDEEP 3072:CC8e6B6NE/BX3O5k6IFBEWubCf09mTOErReV4e3nxFNdn1Nh+w0cN:Cncqh3Kk69WubCf0QT544e3xFNdnvb0
TLSH
T1D2444A157A555DF8D45BC03582468AB3AA3274CB0B32EAFF0295423D2F6AEF56E3C314
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

179712

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

build_script_build-90bb1fd7cebfceb6.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

kernel32

GetModuleHandleW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead CloseHandle CompareStringOrdinal GetLastError FreeEnvironmentStringsW WaitForSingleObject WriteFileEx SleepEx SetLastError GetFullPathNameW GetCurrentThreadId SetFileInformationByHandle CreateFileW SetFileTime GetProcessHeap HeapFree HeapReAlloc QueryPerformanceCounter CreateThread CreateEventW GetCurrentProcessId ReadFileEx ReadFile GetOverlappedResult GetCurrentProcess DuplicateHandle RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind CancelIo GetEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetExitCodeProcess GetStdHandle AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW lstrlenW GetProcAddress WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex HeapAlloc GetModuleFileNameW MultiByteToWideChar WriteConsoleW GetConsoleMode GetConsoleOutputCP GetFileAttributesW IsProcessorFeaturePresent FormatMessageW WaitForMultipleObjects GetModuleHandleA GetSystemTimeAsFileTime

ntdll

NtWriteFile NtCreateNamedPipeFile NtOpenFile NtReadFile RtlNtStatusToDosError

vcruntime140

memmove __current_exception_context memcmp _CxxThrowException __C_specific_handler __current_exception memset memcpy __CxxFrameHandler3

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment _get_initial_narrow_environment _initterm _configure_narrow_argv exit _exit _set_app_type __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback terminate _seh_filter_exe _initterm_e _initialize_onexit_table _register_onexit_function _crt_atexit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

5b7a331e833332db014c2a510f075bb7179d011c45a1c61b7411c386b43c6a49

api-ms-win-core-synch-l1-2-0

kernel32

ntdll

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic