2d306858dd47311410085a246843ab3586d896d18887c62be6ffd648a71dccdf

Sharing

Copy URL Twitter E-mail

General

Target
2d306858dd47311410085a246843ab3586d896d18887c62be6ffd648a71dccdf
Size 3.5MB
Sample261002-d4tgss1fkd
SHA256 2d306858dd47311410085a246843ab3586d896d18887c62be6ffd648a71dccdf
MD5 04be9eb5208884fd15fd0701ec6cd558
SHA1 068490ccfdad6b977f46f7dc755011b205a95482
SHA512 0bded8346de824b20275920bba692e54e30346ed000577e546d11b5f7a6d5711bd7928b29b67a2c2c7f9eaf2a623d4f42657e440ff877f57581c19dd47080b5f
SSDEEP 49152:5xHRio1vgVhHKkbFkt/t/LmOHa2wQyd9O2Dw1HGavT5qd75UcD:/ovl45qd75UcD
TLSH
T1C306C41AA669A0DDC17BC078D2878F62B93170CA0B393AF744D182792F64EF96D3C754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2d306858dd47311410085a246843ab3586d896d18887c62be6ffd648a71dccdf

File Explorer

2d306858dd47311410085a246843ab3586d896d18887c62be6ffd648a71dccdf

.exe 3.5MB

2d306858dd47311410085a246843ab3586d896d18887c62be6ffd648a71dccdf

IMPHASH 23e76cd53c8b1b01f36642515ce99bde
SHA256 2d306858dd47311410085a246843ab3586d896d18887c62be6ffd648a71dccdf
MD5 04be9eb5208884fd15fd0701ec6cd558
SHA1 068490ccfdad6b977f46f7dc755011b205a95482
SHA512 0bded8346de824b20275920bba692e54e30346ed000577e546d11b5f7a6d5711bd7928b29b67a2c2c7f9eaf2a623d4f42657e440ff877f57581c19dd47080b5f
SSDEEP 49152:5xHRio1vgVhHKkbFkt/t/LmOHa2wQyd9O2Dw1HGavT5qd75UcD:/ovl45qd75UcD
TLSH
T1C306C41AA669A0DDC17BC078D2878F62B93170CA0B393AF744D182792F64EF96D3C754
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2676124

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

rg_core-91addf1cfea2fded.pdb

ntdll

NtSetInformationProcess NtQueryInformationProcess NtReadFile NtCreateNamedPipeFile RtlNtStatusToDosError NtOpenFile NtWriteFile

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

bcryptprimitives

ProcessPrng

kernel32

IsProcessorFeaturePresent GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter CreateFileW GetDriveTypeW GetVolumePathNameW GetDiskFreeSpaceExW GetFinalPathNameByHandleW GetFileInformationByHandle GetVolumeNameForVolumeMountPointW OpenProcess GetProcessId IsWow64Process GetProcessTimes GetPriorityClass SetPriorityClass IsProcessCritical WaitForSingleObject GetProcessInformation SetProcessInformation QueryFullProcessImageNameW GetSystemInfo GetNativeSystemInfo GetWindowsDirectoryW GlobalMemoryStatusEx GetLogicalDriveStringsW Process32NextW Process32FirstW CreateToolhelp32Snapshot CloseHandle FreeLibrary ReadProcessMemory ProcessIdToSessionId GetCurrentProcess GetProcAddress LoadLibraryExW GetModuleHandleW GetStdHandle SetConsoleTextAttribute GetConsoleScreenBufferInfo LoadLibraryExA CreateEventW GetProcessHeap HeapFree HeapAlloc GetLastError FormatMessageW CompareStringOrdinal FreeEnvironmentStringsW WriteFileEx SleepEx SetLastError GetFullPathNameW GetCurrentThreadId SetFileInformationByHandle SetFileTime HeapReAlloc QueryPerformanceFrequency QueryPerformanceCounter CreateThread GetCurrentProcessId ReadFileEx ReadFile GetOverlappedResult DuplicateHandle RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetSystemTimePreciseAsFileTime CancelIo GetFileInformationByHandleEx GetEnvironmentStringsW GetSystemDirectoryW CreateProcessW GetExitCodeProcess TerminateProcess CreateDirectoryW SetFilePointerEx AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW lstrlenW RemoveDirectoryW FindFirstFileExW FindClose ExitProcess SwitchToThread WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex DeleteFileW GetModuleFileNameW MultiByteToWideChar WriteConsoleW GetConsoleMode GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer Sleep GetFileAttributesW GetFileType WaitForMultipleObjects GetModuleHandleA GetTempPathW

advapi32

OpenProcessToken RegCloseKey RegGetValueW RegOpenKeyExW RegQueryValueExW GetLengthSid GetTokenInformation

ole32

CoInitializeEx CoUninitialize CoCreateInstance CoSetProxyBlanket

user32

GetWindowThreadProcessId GetForegroundWindow

psapi

GetPerformanceInfo EmptyWorkingSet EnumPageFilesW GetProcessMemoryInfo

gdi32

DeleteDC CreateCompatibleDC

propsys

VariantToBoolean

oleaut32

SysAllocStringLen VariantClear SysStringLen GetErrorInfo SysFreeString

userenv

GetUserProfileDirectoryW

vcruntime140

__current_exception_context __current_exception memcmp _CxxThrowException memset __CxxFrameHandler3 __C_specific_handler memcpy memmove

api-ms-win-crt-math-l1-1-0

floor __setusermatherr fmod

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

api-ms-win-crt-runtime-l1-1-0

_c_exit _cexit __p___argv __p___argc terminate _exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _crt_atexit _set_app_type _seh_filter_exe _register_thread_local_exe_atexit_callback _initialize_onexit_table exit _register_onexit_function

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

2d306858dd47311410085a246843ab3586d896d18887c62be6ffd648a71dccdf

ntdll

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

advapi32

ole32

user32

psapi

gdi32

propsys

oleaut32

userenv

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic