cd5e149137d946b740d73e3d9ba1371d4b4f659223d09793b252c8fbb37927c8

Sharing

Copy URL Twitter E-mail

General

Target
cd5e149137d946b740d73e3d9ba1371d4b4f659223d09793b252c8fbb37927c8
Size 1.1MB
Sample261001-ypltmastev
SHA256 cd5e149137d946b740d73e3d9ba1371d4b4f659223d09793b252c8fbb37927c8
MD5 1a9c4388bf5c90ad4088618bae3d5025
SHA1 6b325044bfa02cbf8ed8935de1d9ab13701312f2
SHA512 aec8770b9bad91e8ae74385facb976654fab4bd81b5921a7bd055e9dfd31a24d180fbaebf2198e545f94d8f4a8cfbaaedf4a43141458d6156b565f518c79483e
SSDEEP 24576:evbIcEaIWgrB2XXTHjx0J64x4P4nxgboU4O/zZ55/:evbArB2XXTHjx044x4gSbo0zZ55
TLSH
T154450716666865E9C17BC0B8C2939F62B93130C90B396FF745D1827A2F25DF96E3C324
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cd5e149137d946b740d73e3d9ba1371d4b4f659223d09793b252c8fbb37927c8

File Explorer

cd5e149137d946b740d73e3d9ba1371d4b4f659223d09793b252c8fbb37927c8

.exe 1.1MB

cd5e149137d946b740d73e3d9ba1371d4b4f659223d09793b252c8fbb37927c8

IMPHASH 074d5d2bba1cd3f32caeb2429adb9e8b
SHA256 cd5e149137d946b740d73e3d9ba1371d4b4f659223d09793b252c8fbb37927c8
MD5 1a9c4388bf5c90ad4088618bae3d5025
SHA1 6b325044bfa02cbf8ed8935de1d9ab13701312f2
SHA512 aec8770b9bad91e8ae74385facb976654fab4bd81b5921a7bd055e9dfd31a24d180fbaebf2198e545f94d8f4a8cfbaaedf4a43141458d6156b565f518c79483e
SSDEEP 24576:evbIcEaIWgrB2XXTHjx0J64x4P4nxgboU4O/zZ55/:evbArB2XXTHjx044x4gSbo0zZ55
TLSH
T154450716666865E9C17BC0B8C2939F62B93130C90B396FF745D1827A2F25DF96E3C324
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

856968

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

build_script_build-4b327d44a574fa16.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

bcryptprimitives

ProcessPrng

kernel32

InitializeSListHead CloseHandle GetProcAddress LoadLibraryA GetNativeSystemInfo CompareStringOrdinal GetLastError FreeEnvironmentStringsW WaitForSingleObject WriteFileEx SleepEx SetLastError GetFullPathNameW GetCurrentThreadId SetFileInformationByHandle CreateFileW SetFileTime GetProcessHeap HeapFree HeapReAlloc QueryPerformanceCounter CreateThread CreateEventW GetCurrentProcessId ReadFileEx ReadFile GetOverlappedResult FlushFileBuffers GetCurrentProcess DuplicateHandle RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind CancelIo GetFileInformationByHandle GetFileInformationByHandleEx GetEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetExitCodeProcess GetStdHandle IsDebuggerPresent CreateDirectoryW SetFilePointerEx AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW lstrlenW CopyFileExW FindFirstFileExW FindClose CreateHardLinkW ExitProcess WideCharToMultiByte WaitForSingleObjectEx CreateMutexA ReleaseMutex DeleteFileW HeapAlloc GetModuleFileNameW MultiByteToWideChar WriteConsoleW GetConsoleMode GetConsoleOutputCP GetFileAttributesW GetModuleHandleW FormatMessageW WaitForMultipleObjects GetModuleHandleA GetTempPathW IsProcessorFeaturePresent GetSystemTimeAsFileTime UnhandledExceptionFilter SetUnhandledExceptionFilter FindNextFileW

advapi32

RegCloseKey RegQueryValueExW RegOpenKeyExW RegEnumKeyExW

ole32

CoInitializeEx CoCreateInstance

oleaut32

SysStringLen SysFreeString

ntdll

NtWriteFile NtOpenFile NtReadFile NtCreateNamedPipeFile RtlNtStatusToDosError

vcruntime140

memmove __current_exception_context __current_exception __C_specific_handler __CxxFrameHandler3 memcpy memcmp _CxxThrowException memset

api-ms-win-crt-runtime-l1-1-0

_set_app_type _configure_narrow_argv _initialize_narrow_environment _seh_filter_exe terminate _initterm _initterm_e exit _exit __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _crt_atexit _get_initial_narrow_environment _initialize_onexit_table _register_onexit_function

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

cd5e149137d946b740d73e3d9ba1371d4b4f659223d09793b252c8fbb37927c8

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

advapi32

ole32

oleaut32

ntdll

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic