afc8d7b2780c4db420d3145653ae2ea9a91683c37c9f21b3015ead8b2c781f0f

Sharing

Copy URL Twitter E-mail

General

Target
afc8d7b2780c4db420d3145653ae2ea9a91683c37c9f21b3015ead8b2c781f0f
Size 3.4MB
Sample261002-e6542svejc
SHA256 afc8d7b2780c4db420d3145653ae2ea9a91683c37c9f21b3015ead8b2c781f0f
MD5 53344342b7e849d77068116f09a57d56
SHA1 3f3f2c9d54c946fba6467a94c841a2d855d6268b
SHA512 9b743f26c3c0db887490a63926c4a881c631bb4e628f2848085d63f00655ad76f6b93c73c76bf4f1686eb84f18b289714fe28c3f1618ac25998d489c386bca04
SSDEEP 49152:tuaBesWZ4eT1mO4HBaAqj3/GlVzfOp0uL5lKeZ7RQeZXXoT:EggAqfKeZ7RgT
TLSH
T196F5C52AB66964D9C17BC0B8D2878F62B92070DD0B392BF345D182792F64EF96D3C714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
afc8d7b2780c4db420d3145653ae2ea9a91683c37c9f21b3015ead8b2c781f0f

File Explorer

afc8d7b2780c4db420d3145653ae2ea9a91683c37c9f21b3015ead8b2c781f0f

.exe 3.4MB

afc8d7b2780c4db420d3145653ae2ea9a91683c37c9f21b3015ead8b2c781f0f

IMPHASH 70c5f2a8fc8ab6d344604191dfdd229d
SHA256 afc8d7b2780c4db420d3145653ae2ea9a91683c37c9f21b3015ead8b2c781f0f
MD5 53344342b7e849d77068116f09a57d56
SHA1 3f3f2c9d54c946fba6467a94c841a2d855d6268b
SHA512 9b743f26c3c0db887490a63926c4a881c631bb4e628f2848085d63f00655ad76f6b93c73c76bf4f1686eb84f18b289714fe28c3f1618ac25998d489c386bca04
SSDEEP 49152:tuaBesWZ4eT1mO4HBaAqj3/GlVzfOp0uL5lKeZ7RQeZXXoT:EggAqfKeZ7RgT
TLSH
T196F5C52AB66964D9C17BC0B8D2878F62B92070DD0B392BF345D182792F64EF96D3C714
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2606988

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

rg_core-91addf1cfea2fded.pdb

ntdll

NtReadFile RtlNtStatusToDosError NtQueryInformationProcess NtCreateNamedPipeFile NtWriteFile NtSetInformationProcess NtOpenFile

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

bcryptprimitives

ProcessPrng

kernel32

IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime GetSystemInfo GetNativeSystemInfo GetWindowsDirectoryW GlobalMemoryStatusEx GetLogicalDriveStringsW CreateToolhelp32Snapshot CreateFileW GetDriveTypeW GetVolumePathNameW GetDiskFreeSpaceExW GetFinalPathNameByHandleW GetFileInformationByHandle GetVolumeNameForVolumeMountPointW Process32NextW Process32FirstW OpenProcess GetProcessId IsWow64Process GetProcessTimes GetPriorityClass SetPriorityClass IsProcessCritical WaitForSingleObject GetProcessInformation SetProcessInformation QueryFullProcessImageNameW ReadProcessMemory GetCurrentProcess CloseHandle FreeLibrary ProcessIdToSessionId GetProcAddress LoadLibraryExW GetModuleHandleW GetStdHandle SetConsoleTextAttribute GetConsoleScreenBufferInfo LoadLibraryExA CreateEventW GetProcessHeap HeapFree HeapAlloc GetLastError FormatMessageW CompareStringOrdinal FreeEnvironmentStringsW WriteFileEx SleepEx SetLastError GetFullPathNameW GetCurrentThreadId SetFileInformationByHandle SetFileTime HeapReAlloc QueryPerformanceFrequency QueryPerformanceCounter CreateThread GetCurrentProcessId ReadFileEx ReadFile GetOverlappedResult DuplicateHandle RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetSystemTimePreciseAsFileTime CancelIo GetFileInformationByHandleEx GetEnvironmentStringsW GetSystemDirectoryW CreateProcessW GetExitCodeProcess TerminateProcess CreateDirectoryW SetFilePointerEx AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW lstrlenW RemoveDirectoryW FindFirstFileExW FindClose ExitProcess SwitchToThread WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex DeleteFileW GetModuleFileNameW MultiByteToWideChar WriteConsoleW GetConsoleMode GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer Sleep GetFileAttributesW GetFileType WaitForMultipleObjects GetModuleHandleA GetTempPathW

ole32

CoCreateInstance CoUninitialize CoInitializeEx CoSetProxyBlanket

gdi32

DeleteDC CreateCompatibleDC

advapi32

OpenProcessToken GetTokenInformation RegCloseKey RegGetValueW RegOpenKeyExW RegQueryValueExW GetLengthSid

psapi

GetProcessMemoryInfo GetPerformanceInfo EmptyWorkingSet EnumPageFilesW

user32

GetForegroundWindow GetWindowThreadProcessId

propsys

VariantToBoolean

oleaut32

SysStringLen SysFreeString GetErrorInfo SysAllocStringLen VariantClear

userenv

GetUserProfileDirectoryW

vcruntime140

__CxxFrameHandler3 __current_exception_context __current_exception __C_specific_handler _CxxThrowException memset memmove memcmp memcpy

api-ms-win-crt-math-l1-1-0

trunc fmod floor __setusermatherr

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _set_app_type _crt_atexit _c_exit _cexit __p___argv __p___argc _configure_narrow_argv _exit exit _initterm_e _initterm terminate _get_initial_narrow_environment _register_onexit_function _register_thread_local_exe_atexit_callback _initialize_narrow_environment _seh_filter_exe

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

afc8d7b2780c4db420d3145653ae2ea9a91683c37c9f21b3015ead8b2c781f0f

ntdll

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

ole32

gdi32

advapi32

psapi

user32

propsys

oleaut32

userenv

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic