3ed8d12417bb5b7633e676e8b87b84b507956a47193431a277724032c5242c6c

Sharing

Copy URL Twitter E-mail

General

Target
3ed8d12417bb5b7633e676e8b87b84b507956a47193431a277724032c5242c6c
Size 6.8MB
Sample261002-e83rpsvz9m
SHA256 3ed8d12417bb5b7633e676e8b87b84b507956a47193431a277724032c5242c6c
MD5 0ece90b6149c4c60a881c23ca7b4dac7
SHA1 a963e56fc2aee3bacf475bc2e3f33ee9b3c43b97
SHA512 0997e808059812ed937d90940e48e5fd9fff7346e0dc78cc5f2075db566906b13e2dee0a17043f9b9554a43758fe5ed8c2d4bf94c8079087eabd778befb54e69
SSDEEP 49152:lj5httrugT8oWmKUCgC4JBI/5IU6iIxX:DhajfUTJk++2
TLSH
T15C76E5D25593C681F213C8605451BFE20536B47BE9F888B6B3BA1B48DF7EF61160AE4C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3ed8d12417bb5b7633e676e8b87b84b507956a47193431a277724032c5242c6c

File Explorer

3ed8d12417bb5b7633e676e8b87b84b507956a47193431a277724032c5242c6c

.exe 6.8MB

3ed8d12417bb5b7633e676e8b87b84b507956a47193431a277724032c5242c6c

IMPHASH 720acbfd6d95d611e14846a389afee0e
SHA256 3ed8d12417bb5b7633e676e8b87b84b507956a47193431a277724032c5242c6c
MD5 0ece90b6149c4c60a881c23ca7b4dac7
SHA1 a963e56fc2aee3bacf475bc2e3f33ee9b3c43b97
SHA512 0997e808059812ed937d90940e48e5fd9fff7346e0dc78cc5f2075db566906b13e2dee0a17043f9b9554a43758fe5ed8c2d4bf94c8079087eabd778befb54e69
SSDEEP 49152:lj5httrugT8oWmKUCgC4JBI/5IU6iIxX:DhajfUTJk++2
TLSH
T15C76E5D25593C681F213C8605451BFE20536B47BE9F888B6B3BA1B48DF7EF61160AE4C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

873508

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

RustStudy.pdb

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

bcryptprimitives

ProcessPrng

kernel32

FindFirstFileW GetFileInformationByHandleEx GetFileInformationByHandle HeapReAlloc GetCurrentProcessId CreateDirectoryW GetFullPathNameW SetFileInformationByHandle CreateThread ExitProcess QueryPerformanceCounter QueryPerformanceFrequency HeapAlloc GetProcessHeap CreateFileW RtlCaptureContext RtlLookupFunctionEntry WaitForSingleObjectEx LoadLibraryA GetCurrentProcess CreateMutexA ReleaseMutex RtlVirtualUnwind GetModuleFileNameW GetEnvironmentVariableW CreateToolhelp32Snapshot Process32FirstW Process32NextW OpenProcess FindClose CreateProcessW lstrlenW FormatMessageW GetModuleHandleW Sleep SetWaitableTimer CreateWaitableTimerExW SetLastError GetProcAddress GetModuleHandleA WriteConsoleW MultiByteToWideChar GetCurrentThread SetThreadStackGuarantee GetSystemTimeAsFileTime WaitForSingleObject InitializeSListHead LoadLibraryExA FreeLibrary GetConsoleMode AddVectoredExceptionHandler GetStdHandle GetLastError SetCurrentDirectoryW GetCurrentThreadId CloseHandle IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter HeapFree TerminateProcess GetSystemTimePreciseAsFileTime SetHandleInformation GetCurrentDirectoryW IsProcessorFeaturePresent

ws2_32

select send ioctlsocket WSADuplicateSocketW getsockname getpeername WSASend WSARecv recv setsockopt getsockopt WSASocketW freeaddrinfo WSACleanup WSAStartup getaddrinfo bind accept closesocket WSAGetLastError listen connect

advapi32

RegQueryValueExW RegOpenKeyExW FreeSid AllocateAndInitializeSid CheckTokenMembership SystemFunction036 RegCloseKey

bcrypt

BCryptGenRandom

ntdll

RtlNtStatusToDosError NtWriteFile

user32

MessageBoxW

ole32

CoCreateInstance CoUninitialize CoSetProxyBlanket CoInitializeSecurity CoInitializeEx

oleaut32

VariantInit SafeArrayPutElement SysStringLen SafeArrayCreate VariantClear SysFreeString SysAllocStringLen GetErrorInfo

vcruntime140

_CxxThrowException __current_exception_context memmove __current_exception memset memcmp memcpy __CxxFrameHandler3 __C_specific_handler

api-ms-win-crt-runtime-l1-1-0

_initterm _initterm_e exit _set_app_type _initialize_narrow_environment __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _configure_narrow_argv _seh_filter_exe _get_initial_narrow_environment _exit _initialize_onexit_table _crt_atexit terminate _register_onexit_function

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Name

.text

Size

866KB

Virtual Size

865KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

5.8MB

Virtual Size

5.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

35KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rdata2

Size

105KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

3ed8d12417bb5b7633e676e8b87b84b507956a47193431a277724032c5242c6c

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

ws2_32

advapi32

bcrypt

ntdll

user32

ole32

oleaut32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic