cb86aca44adaffcf24a021ac42ef38ec40bef3636732a79d6f9ce5b5c95af335

Sharing

Copy URL Twitter E-mail

General

Target
cb86aca44adaffcf24a021ac42ef38ec40bef3636732a79d6f9ce5b5c95af335
Size 7.3MB
Sample261002-e82jmsvz9j
SHA256 cb86aca44adaffcf24a021ac42ef38ec40bef3636732a79d6f9ce5b5c95af335
MD5 6e83475d189ccad6d7722df30cea8ae6
SHA1 ce788bf8b8874e5e44d0163a3176ff92f45a2e78
SHA512 26fb966b60e1644298a85c8e9bd068e789022fc9902a5e979e6d1096cb735c0fe27feb9e2a1eead5a769f6ca39b8128e35ea34e9a99ce5a715450adde6627c65
SSDEEP 49152:h6pRhxvXoBADkCQxpLoLR87qllibjowGN04zooiYCbzzjN8l8r0tUHj/2JDdtQlZ:+xpt5D/T3jB70uChkubfg
TLSH
T17676C62A677960D9C17BC07892878F62BD2170D90B392BF344D1827A2F24EF96D3D758
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cb86aca44adaffcf24a021ac42ef38ec40bef3636732a79d6f9ce5b5c95af335

File Explorer

cb86aca44adaffcf24a021ac42ef38ec40bef3636732a79d6f9ce5b5c95af335

.exe 7.3MB

cb86aca44adaffcf24a021ac42ef38ec40bef3636732a79d6f9ce5b5c95af335

IMPHASH b202ba33bfeff1feceea4b2e62fd7406
SHA256 cb86aca44adaffcf24a021ac42ef38ec40bef3636732a79d6f9ce5b5c95af335
MD5 6e83475d189ccad6d7722df30cea8ae6
SHA1 ce788bf8b8874e5e44d0163a3176ff92f45a2e78
SHA512 26fb966b60e1644298a85c8e9bd068e789022fc9902a5e979e6d1096cb735c0fe27feb9e2a1eead5a769f6ca39b8128e35ea34e9a99ce5a715450adde6627c65
SSDEEP 49152:h6pRhxvXoBADkCQxpLoLR87qllibjowGN04zooiYCbzzjN8l8r0tUHj/2JDdtQlZ:+xpt5D/T3jB70uChkubfg
TLSH
T17676C62A677960D9C17BC07892878F62BD2170D90B392BF344D1827A2F24EF96D3D758
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5581964

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ram_governor_lib-fae92c26e32085f3.pdb

bcryptprimitives

ProcessPrng

advapi32

IsValidAcl GetAclInformation GetAce IsValidSid IsWellKnownSid GetSecurityDescriptorControl RegQueryValueExW RegDeleteTreeW RegCreateKeyExW RegOpenKeyTransactedW RegCloseKey RegOpenKeyExW RegFlushKey GetSecurityInfo ConvertStringSecurityDescriptorToSecurityDescriptorW GetTokenInformation RegSetValueExW OpenProcessToken

ktmw32

CommitTransaction CreateTransaction RollbackTransaction

kernel32

GetStdHandle SetConsoleTextAttribute GetConsoleScreenBufferInfo MoveFileExW GetVolumeInformationByHandleW CreateDirectoryW ReplaceFileW LocalFree LoadLibraryA GetModuleHandleW GetWindowsDirectoryW GetTickCount64 GetCurrentProcess GetModuleHandleA Sleep GetProcAddress LoadLibraryExA FormatMessageW GetLastError HeapFree HeapAlloc CreateFileW GetProcessHeap CloseHandle GetSystemTimeAsFileTime lstrlenW GetModuleFileNameW IsDebuggerPresent GetCurrentThreadId WaitForSingleObject IsProcessorFeaturePresent CreateEventW GetConsoleMode GetFileInformationByHandle GetFileAttributesW GetOverlappedResult ReadFile GetQueuedCompletionStatusEx PostQueuedCompletionStatus CreateIoCompletionPort UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeSListHead SystemTimeToFileTime FileTimeToSystemTime GetEnvironmentVariableW GetDriveTypeW GetVolumePathNameW GetDiskFreeSpaceExW GetFinalPathNameByHandleW GetVolumeNameForVolumeMountPointW GetLogicalDriveStringsW GetSystemInfo GetNativeSystemInfo CompareStringOrdinal FreeEnvironmentStringsW WriteFileEx SleepEx SetLastError GetFullPathNameW SetFileInformationByHandle SetFileTime HeapReAlloc QueryPerformanceFrequency QueryPerformanceCounter CreateThread GetCurrentProcessId ReadFileEx FlushFileBuffers DuplicateHandle RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetSystemTimePreciseAsFileTime CancelIo GetFileInformationByHandleEx GetEnvironmentStringsW GetSystemDirectoryW CreateProcessW GetExitCodeProcess TerminateProcess SetFilePointerEx AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetCommandLineW RemoveDirectoryW FindFirstFileExW FindClose CreateHardLinkW FindNextFileW GetTempPathW WaitForMultipleObjects GetFileType SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP WriteConsoleW MultiByteToWideChar DeleteFileW ReleaseMutex CreateMutexA WaitForSingleObjectEx WideCharToMultiByte SwitchToThread ExitProcess

oleaut32

SysAllocStringLen GetErrorInfo SysFreeString VariantClear SysStringLen

ntdll

NtDeviceIoControlFile NtCancelIoFileEx RtlNtStatusToDosError NtWriteFile NtCreateNamedPipeFile NtReadFile NtOpenFile

ole32

CoSetProxyBlanket CoCreateInstance PropVariantClear CoCreateGuid CoInitializeEx CoUninitialize

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

propsys

VariantToPropVariant VariantToBoolean PropVariantToBSTR

wevtapi

EvtGetEventMetadataProperty EvtNext EvtClose EvtOpenPublisherMetadata EvtOpenEventMetadataEnum EvtQuery EvtNextEventMetadata EvtCreateRenderContext EvtRender

psapi

GetPerformanceInfo EnumPageFilesW

userenv

GetUserProfileDirectoryW

vcruntime140

__CxxFrameHandler3 memcpy memmove memset memcmp _CxxThrowException __C_specific_handler __current_exception __current_exception_context

api-ms-win-crt-math-l1-1-0

fmod __setusermatherr pow floor

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

api-ms-win-crt-runtime-l1-1-0

_c_exit _cexit _initterm _register_thread_local_exe_atexit_callback _configure_narrow_argv terminate _set_app_type _seh_filter_exe __p___argv _get_initial_narrow_environment _crt_atexit _register_onexit_function _initialize_onexit_table _exit exit _initterm_e _initialize_narrow_environment __p___argc

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

cb86aca44adaffcf24a021ac42ef38ec40bef3636732a79d6f9ce5b5c95af335

bcryptprimitives

advapi32

ktmw32

kernel32

oleaut32

ntdll

ole32

api-ms-win-core-synch-l1-2-0

propsys

wevtapi

psapi

userenv

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic