13c0e5224c4bb97c8422d812fbd70717c16ddd5310b06482670909fce88fef43

Sharing

Copy URL Twitter E-mail

General

Target
13c0e5224c4bb97c8422d812fbd70717c16ddd5310b06482670909fce88fef43
Size 3.9MB
Sample261002-e686psveld
SHA256 13c0e5224c4bb97c8422d812fbd70717c16ddd5310b06482670909fce88fef43
MD5 947a2e5a110e7dc0cdf7db49a841ec16
SHA1 7bf89918fbe17fec85ec57d1ce4c9146ae88065c
SHA512 046d204b23f9c2282b519c9b7a79c401efd041d6a16ef25c0081ac22205d2f7104e49db490a19157e2d4cf90a904dce40338d73bcdd959baa15f4a24353ba435
SSDEEP 49152:rLJTI4FEY0SnDMXOofpwe9xJtaDe2nYzrBvnJSLuW/L9VL7D7f+:rGkP4vnAZVL7D7f+
TLSH
T18A16B51AAA6960E9C17BC07892878F62BD2070DD0B393BF345D182792F64EF96D3C754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
13c0e5224c4bb97c8422d812fbd70717c16ddd5310b06482670909fce88fef43

File Explorer

13c0e5224c4bb97c8422d812fbd70717c16ddd5310b06482670909fce88fef43

.exe 3.9MB

13c0e5224c4bb97c8422d812fbd70717c16ddd5310b06482670909fce88fef43

IMPHASH 1c6d4b6ab3c4440ec3f4fae9f6728e39
SHA256 13c0e5224c4bb97c8422d812fbd70717c16ddd5310b06482670909fce88fef43
MD5 947a2e5a110e7dc0cdf7db49a841ec16
SHA1 7bf89918fbe17fec85ec57d1ce4c9146ae88065c
SHA512 046d204b23f9c2282b519c9b7a79c401efd041d6a16ef25c0081ac22205d2f7104e49db490a19157e2d4cf90a904dce40338d73bcdd959baa15f4a24353ba435
SSDEEP 49152:rLJTI4FEY0SnDMXOofpwe9xJtaDe2nYzrBvnJSLuW/L9VL7D7f+:rGkP4vnAZVL7D7f+
TLSH
T18A16B51AAA6960E9C17BC07892878F62BD2070DD0B393BF345D182792F64EF96D3C754
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3011804

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

rg_core-91addf1cfea2fded.pdb

ntdll

NtCreateNamedPipeFile RtlNtStatusToDosError NtWriteFile NtQueryInformationProcess NtReadFile NtOpenFile NtSetInformationProcess

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

bcryptprimitives

ProcessPrng

kernel32

IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime CreateFileW GetDriveTypeW GetVolumePathNameW GetDiskFreeSpaceExW GetFinalPathNameByHandleW GetFileInformationByHandle GetVolumeNameForVolumeMountPointW OpenProcess GetProcessId IsWow64Process GetProcessTimes GetPriorityClass SetPriorityClass IsProcessCritical WaitForSingleObject GetProcessInformation SetProcessInformation QueryFullProcessImageNameW GetSystemInfo GetNativeSystemInfo GetWindowsDirectoryW GlobalMemoryStatusEx GetLogicalDriveStringsW Process32NextW Process32FirstW ReadProcessMemory ProcessIdToSessionId CloseHandle FreeLibrary CreateToolhelp32Snapshot GetCurrentProcess GetProcAddress LoadLibraryExW GetModuleHandleW GetStdHandle SetConsoleTextAttribute GetConsoleScreenBufferInfo LoadLibraryExA CreateEventW GetProcessHeap HeapFree HeapAlloc GetLastError FormatMessageW CompareStringOrdinal FreeEnvironmentStringsW WriteFileEx SleepEx SetLastError GetFullPathNameW GetCurrentThreadId SetFileInformationByHandle SetFileTime HeapReAlloc QueryPerformanceFrequency QueryPerformanceCounter CreateThread GetCurrentProcessId ReadFileEx ReadFile GetOverlappedResult DuplicateHandle RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetSystemTimePreciseAsFileTime CancelIo GetFileInformationByHandleEx GetEnvironmentStringsW GetSystemDirectoryW CreateProcessW GetExitCodeProcess TerminateProcess CreateDirectoryW SetFilePointerEx AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW lstrlenW RemoveDirectoryW FindFirstFileExW FindClose ExitProcess SwitchToThread WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex DeleteFileW GetModuleFileNameW MultiByteToWideChar WriteConsoleW GetConsoleMode GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer Sleep GetFileAttributesW GetFileType WaitForMultipleObjects GetModuleHandleA GetTempPathW

user32

GetForegroundWindow GetWindowThreadProcessId

advapi32

RegGetValueW GetTokenInformation GetLengthSid OpenProcessToken RegQueryValueExW RegCloseKey RegOpenKeyExW

gdi32

CreateCompatibleDC DeleteDC

ole32

CoInitializeEx CoUninitialize CoCreateInstance CoSetProxyBlanket

psapi

EmptyWorkingSet EnumPageFilesW GetProcessMemoryInfo GetPerformanceInfo

propsys

VariantToBoolean

oleaut32

GetErrorInfo SysFreeString SysAllocStringLen SysStringLen VariantClear

userenv

GetUserProfileDirectoryW

vcruntime140

__CxxFrameHandler3 __current_exception_context __current_exception memset memcmp __C_specific_handler _CxxThrowException memcpy memmove

api-ms-win-crt-math-l1-1-0

__setusermatherr fmod floor

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _initialize_narrow_environment _exit _c_exit _register_thread_local_exe_atexit_callback exit _initterm_e _initialize_onexit_table _register_onexit_function _crt_atexit _initterm __p___argc _seh_filter_exe _set_app_type _cexit _get_initial_narrow_environment __p___argv terminate

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

13c0e5224c4bb97c8422d812fbd70717c16ddd5310b06482670909fce88fef43

ntdll

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

user32

advapi32

gdi32

ole32

psapi

propsys

oleaut32

userenv

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic