ba27f4b56ddfb847f1fbb41039376cf66e34e06ac3132b403faad090fd2a2d11

Sharing

Copy URL Twitter E-mail

General

Target
ba27f4b56ddfb847f1fbb41039376cf66e34e06ac3132b403faad090fd2a2d11
Size 132KB
Sample261002-d6plmagd39
SHA256 ba27f4b56ddfb847f1fbb41039376cf66e34e06ac3132b403faad090fd2a2d11
MD5 ca4a0bbde30ffba8b2921937845b3a6b
SHA1 f895afab29fe9221bb8f15ab1b91e3ff9cce5b1e
SHA512 d485e568b54a3e2e7291b348e8f2cae1473a0e80b1ef8caaf1bee3c8fce877e7bf89baac55f68be154898dc1a1e8a9745565254a978cac3b1d1accfc580958f8
SSDEEP 3072:KU3C30DVnq04mU65o16eZrBxuhwmlHk3:KU3C30JnqXd168Bx5ml
TLSH
T17ED37C137645A1FDD45AC034826589A7B37270C50F325BFF13A9463C2EAA9F66F3C628
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ba27f4b56ddfb847f1fbb41039376cf66e34e06ac3132b403faad090fd2a2d11

File Explorer

ba27f4b56ddfb847f1fbb41039376cf66e34e06ac3132b403faad090fd2a2d11

.exe 132KB

ba27f4b56ddfb847f1fbb41039376cf66e34e06ac3132b403faad090fd2a2d11

IMPHASH 6a940b8fe4134f44202ffde9492feec8
SHA256 ba27f4b56ddfb847f1fbb41039376cf66e34e06ac3132b403faad090fd2a2d11
MD5 ca4a0bbde30ffba8b2921937845b3a6b
SHA1 f895afab29fe9221bb8f15ab1b91e3ff9cce5b1e
SHA512 d485e568b54a3e2e7291b348e8f2cae1473a0e80b1ef8caaf1bee3c8fce877e7bf89baac55f68be154898dc1a1e8a9745565254a978cac3b1d1accfc580958f8
SSDEEP 3072:KU3C30DVnq04mU65o16eZrBxuhwmlHk3:KU3C30JnqXd168Bx5ml
TLSH
T17ED37C137645A1FDD45AC034826589A7B37270C50F325BFF13A9463C2EAA9F66F3C628
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

88896

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

build_script_build-39d8db5fb53e7e1c.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

kernel32

GetModuleHandleW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead GetLastError CloseHandle WaitForSingleObject SetLastError GetCurrentThreadId GetProcessHeap HeapFree HeapReAlloc QueryPerformanceCounter GetCurrentProcessId GetCurrentProcess RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetStdHandle AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW lstrlenW GetProcAddress WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex HeapAlloc MultiByteToWideChar WriteConsoleW GetConsoleMode GetConsoleOutputCP IsProcessorFeaturePresent FormatMessageW GetModuleHandleA GetSystemTimeAsFileTime

ntdll

NtWriteFile RtlNtStatusToDosError

vcruntime140

memset __current_exception_context memcpy _CxxThrowException __C_specific_handler __current_exception memmove memcmp __CxxFrameHandler3

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment _get_initial_narrow_environment _initterm _configure_narrow_argv exit _exit _set_app_type __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback terminate _seh_filter_exe _initterm_e _initialize_onexit_table _register_onexit_function _crt_atexit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

ba27f4b56ddfb847f1fbb41039376cf66e34e06ac3132b403faad090fd2a2d11

api-ms-win-core-synch-l1-2-0

kernel32

ntdll

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic