23de6c0ffccebceb9f4bf3731f65711a00545c06f194dc19fcac3de128f816e7

Sharing

Copy URL Twitter E-mail

General

Target
23de6c0ffccebceb9f4bf3731f65711a00545c06f194dc19fcac3de128f816e7
Size 10.1MB
Sample261002-e66qksveje
SHA256 23de6c0ffccebceb9f4bf3731f65711a00545c06f194dc19fcac3de128f816e7
MD5 d62a9d67ba1b0d0d929e378262b78f3a
SHA1 74d0f7ce74796e2094a0e6b97d2dc968f8569130
SHA512 b59767c22f55a40b89ae6b794db3066e474c2b4b526c585af4bd35856a6d2509cc0b2c2c168580ffc6a0ad740871f022b80336083d3280425653d1393e78bfa7
SSDEEP 49152:PaZc6g0celpJr1cPHe7J6bJLFB95Uni9Ir/Y/9O3OnhqQrQbf8L+Vd7hKGt9gfSs:HdPX12ou8rI0+Af0cfi
TLSH
T173B6B626667D94E9C17BC0B882838F617A2170DA0B392FF345D1827A2F25EF96D3D354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
23de6c0ffccebceb9f4bf3731f65711a00545c06f194dc19fcac3de128f816e7

File Explorer

23de6c0ffccebceb9f4bf3731f65711a00545c06f194dc19fcac3de128f816e7

.exe 10.1MB

23de6c0ffccebceb9f4bf3731f65711a00545c06f194dc19fcac3de128f816e7

IMPHASH de786177c2bd3da263ce6da1cd9be64f
SHA256 23de6c0ffccebceb9f4bf3731f65711a00545c06f194dc19fcac3de128f816e7
MD5 d62a9d67ba1b0d0d929e378262b78f3a
SHA1 74d0f7ce74796e2094a0e6b97d2dc968f8569130
SHA512 b59767c22f55a40b89ae6b794db3066e474c2b4b526c585af4bd35856a6d2509cc0b2c2c168580ffc6a0ad740871f022b80336083d3280425653d1393e78bfa7
SSDEEP 49152:PaZc6g0celpJr1cPHe7J6bJLFB95Uni9Ir/Y/9O3OnhqQrQbf8L+Vd7hKGt9gfSs:HdPX12ou8rI0+Af0cfi
TLSH
T173B6B626667D94E9C17BC0B882838F617A2170DA0B392FF345D1827A2F25EF96D3D354
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7847880

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

build_script_build-b2e45482ae52213e.pdb

shell32

SHGetKnownFolderPath

combase

CoTaskMemFree

kernel32

CreateEventW GetCurrentThreadId GetFullPathNameW SetLastError SleepEx WriteFileEx SetFileTime GetCurrentProcessId WaitForSingleObject ReadFileEx ReadFile GetOverlappedResult GetCurrentProcess GetProcessHeap RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind FreeEnvironmentStringsW CompareStringOrdinal CancelIo GetFileInformationByHandleEx GetEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetExitCodeProcess TerminateProcess LoadLibraryA GetStdHandle SetFileInformationByHandle CreateDirectoryW IsProcessorFeaturePresent CreateThread SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW HeapFree GetModuleHandleA CopyFileExW FindFirstFileExW ExitProcess SwitchToThread WideCharToMultiByte WaitForSingleObjectEx CreateMutexA ReleaseMutex GetFinalPathNameByHandleW CreateSymbolicLinkW DeviceIoControl GetLastError DeleteFileW SetEnvironmentVariableW HeapAlloc GetModuleFileNameW SetCurrentDirectoryW MultiByteToWideChar WriteConsoleW GetConsoleOutputCP GetModuleHandleW FormatMessageW HeapReAlloc WaitForMultipleObjects GetProcAddress AddVectoredExceptionHandler GetSystemTimeAsFileTime GetConsoleMode GetFileInformationByHandle GetNativeSystemInfo InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetFileSizeEx GetFileAttributesW FindNextFileW CreateFileW FindFirstFileW FindClose CloseHandle lstrlenW QueryPerformanceCounter DuplicateHandle SetFilePointerEx

ole32

CoInitializeEx CoCreateInstance CoInitialize

oleaut32

SysStringLen SysFreeString

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

advapi32

RegOpenKeyExW RegCloseKey RegEnumKeyExW RegOpenKeyExA RegQueryValueExW

ntdll

NtCreateNamedPipeFile NtReadFile RtlNtStatusToDosError NtWriteFile NtOpenFile

vcruntime140

memmove __CxxFrameHandler3 memcpy memcmp memset wcschr _CxxThrowException __current_exception_context __current_exception __C_specific_handler

api-ms-win-crt-string-l1-1-0

wcslen _wcsdup

api-ms-win-crt-heap-l1-1-0

malloc _set_new_mode free

api-ms-win-crt-stdio-l1-1-0

fclose _set_fmode __p__commode _get_osfhandle fgetws _wfopen_s __stdio_common_vswscanf _fileno

api-ms-win-crt-math-l1-1-0

__setusermatherr fmod

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _set_app_type _initialize_onexit_table _register_onexit_function _crt_atexit _get_initial_narrow_environment _initterm _initterm_e _seh_filter_exe _initialize_narrow_environment exit _exit _register_thread_local_exe_atexit_callback __p___argc __p___argv _cexit terminate _c_exit

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

23de6c0ffccebceb9f4bf3731f65711a00545c06f194dc19fcac3de128f816e7

shell32

combase

kernel32

ole32

oleaut32

bcryptprimitives

api-ms-win-core-synch-l1-2-0

advapi32

ntdll

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic