d0d48408392107672b9565b0a41c2973a6dec583efb90c88692b6a6fffd2a5dd

Sharing

Copy URL Twitter E-mail

General

Target
d0d48408392107672b9565b0a41c2973a6dec583efb90c88692b6a6fffd2a5dd
Size 132KB
Sample261001-yn1ldsbb33
SHA256 d0d48408392107672b9565b0a41c2973a6dec583efb90c88692b6a6fffd2a5dd
MD5 5f4b8e5f95c79ada73c0d0dd5a546889
SHA1 db40e80c6f0c05be34c3701bb8f719a8608ce612
SHA512 4505b20aa66df85884083be43dbede5c7a12d98b3edd13af1e1a17f0a7f8615a4067f61c146fa9767627e7de21386c1a6343d89e009f393de0ef065c78992603
SSDEEP 3072:aU3C30DVnq04mU65o16eZrBx5hwmlHk3:aU3C30JnqXd168Bx0ml
TLSH
T1CDD37C137645A1FDD45AC034826589A7B37270C50F325BFF13A9463C2EAA9F66F3C628
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d0d48408392107672b9565b0a41c2973a6dec583efb90c88692b6a6fffd2a5dd

File Explorer

d0d48408392107672b9565b0a41c2973a6dec583efb90c88692b6a6fffd2a5dd

.exe 132KB

d0d48408392107672b9565b0a41c2973a6dec583efb90c88692b6a6fffd2a5dd

IMPHASH 6a940b8fe4134f44202ffde9492feec8
SHA256 d0d48408392107672b9565b0a41c2973a6dec583efb90c88692b6a6fffd2a5dd
MD5 5f4b8e5f95c79ada73c0d0dd5a546889
SHA1 db40e80c6f0c05be34c3701bb8f719a8608ce612
SHA512 4505b20aa66df85884083be43dbede5c7a12d98b3edd13af1e1a17f0a7f8615a4067f61c146fa9767627e7de21386c1a6343d89e009f393de0ef065c78992603
SSDEEP 3072:aU3C30DVnq04mU65o16eZrBx5hwmlHk3:aU3C30JnqXd168Bx0ml
TLSH
T1CDD37C137645A1FDD45AC034826589A7B37270C50F325BFF13A9463C2EAA9F66F3C628
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

88896

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

build_script_build-39d8db5fb53e7e1c.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

kernel32

GetModuleHandleW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead GetLastError CloseHandle WaitForSingleObject SetLastError GetCurrentThreadId GetProcessHeap HeapFree HeapReAlloc QueryPerformanceCounter GetCurrentProcessId GetCurrentProcess RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetStdHandle AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW lstrlenW GetProcAddress WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex HeapAlloc MultiByteToWideChar WriteConsoleW GetConsoleMode GetConsoleOutputCP IsProcessorFeaturePresent FormatMessageW GetModuleHandleA GetSystemTimeAsFileTime

ntdll

NtWriteFile RtlNtStatusToDosError

vcruntime140

memset __current_exception_context memcpy _CxxThrowException __C_specific_handler __current_exception memmove memcmp __CxxFrameHandler3

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment _get_initial_narrow_environment _initterm _configure_narrow_argv exit _exit _set_app_type __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback terminate _seh_filter_exe _initterm_e _initialize_onexit_table _register_onexit_function _crt_atexit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

d0d48408392107672b9565b0a41c2973a6dec583efb90c88692b6a6fffd2a5dd

api-ms-win-core-synch-l1-2-0

kernel32

ntdll

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic