4696023cb5b9a9202c8c060c09db72ad50ff06f01acfdb4c0929f5095d880a32

Sharing

Copy URL Twitter E-mail

General

Target
4696023cb5b9a9202c8c060c09db72ad50ff06f01acfdb4c0929f5095d880a32
Size 6.4MB
Sample261002-e857tsvfkb
SHA256 4696023cb5b9a9202c8c060c09db72ad50ff06f01acfdb4c0929f5095d880a32
MD5 3e858f2681ea9440fb04e50c08c7b9f4
SHA1 b231ea2bcb059b27712531aa5b969eae1d2294f0
SHA512 42746a15b7bd521deb5c171692a9a2af55855458e4ad3caff2265c38db9aee5b736fd0de8d7b52cb3d4e93ea51e3e3666b7ae9573a46d0ec1438bcf6eeb6ee2f
SSDEEP 49152:F1Ta7vBYEO7dnvbswR6QodleC5Ei4ljLsY+jV9VvA6X0aV0SViIeaDp1D/UUxjud:ijJ1zEZgxv7S/Nugv
TLSH
T16566C626A77960D9D17FC07892879F62BD2070D907392BF34991827A2F24EF8AD3D714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4696023cb5b9a9202c8c060c09db72ad50ff06f01acfdb4c0929f5095d880a32

File Explorer

4696023cb5b9a9202c8c060c09db72ad50ff06f01acfdb4c0929f5095d880a32

.exe 6.4MB

4696023cb5b9a9202c8c060c09db72ad50ff06f01acfdb4c0929f5095d880a32

IMPHASH 596d5f15dd411b72a7c58aede30cc310
SHA256 4696023cb5b9a9202c8c060c09db72ad50ff06f01acfdb4c0929f5095d880a32
MD5 3e858f2681ea9440fb04e50c08c7b9f4
SHA1 b231ea2bcb059b27712531aa5b969eae1d2294f0
SHA512 42746a15b7bd521deb5c171692a9a2af55855458e4ad3caff2265c38db9aee5b736fd0de8d7b52cb3d4e93ea51e3e3666b7ae9573a46d0ec1438bcf6eeb6ee2f
SSDEEP 49152:F1Ta7vBYEO7dnvbswR6QodleC5Ei4ljLsY+jV9VvA6X0aV0SViIeaDp1D/UUxjud:ijJ1zEZgxv7S/Nugv
TLSH
T16566C626A77960D9D17FC07892879F62BD2070D907392BF34991827A2F24EF8AD3D714
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4948028

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ram_governor_lib-6723c18cb77b37a1.pdb

bcryptprimitives

ProcessPrng

advapi32

IsValidSid IsWellKnownSid GetSecurityDescriptorControl IsValidAcl GetAclInformation GetAce RegDeleteTreeW RegCreateKeyExW RegOpenKeyTransactedW RegCloseKey RegOpenKeyExW RegQueryValueExW RegFlushKey GetSecurityInfo ConvertStringSecurityDescriptorToSecurityDescriptorW RegSetValueExW OpenProcessToken GetTokenInformation

ktmw32

CreateTransaction CommitTransaction RollbackTransaction

kernel32

GetFileAttributesW GetStdHandle SetConsoleTextAttribute GetConsoleScreenBufferInfo MoveFileExW GetFileInformationByHandle GetModuleHandleW GetConsoleMode GetCurrentThreadId GetSystemTimeAsFileTime IsProcessorFeaturePresent GetVolumeInformationByHandleW LoadLibraryA CreateDirectoryW ReplaceFileW CreateFileW GetCurrentProcess GetOverlappedResult LocalFree WaitForSingleObject CreateEventW IsDebuggerPresent GetModuleFileNameW ReadFile CloseHandle GetProcessHeap HeapAlloc HeapFree GetQueuedCompletionStatusEx PostQueuedCompletionStatus CreateIoCompletionPort GetWindowsDirectoryW GetTickCount64 GetLastError FormatMessageW LoadLibraryExA GetModuleHandleA Sleep GetProcAddress lstrlenW UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeSListHead SystemTimeToFileTime FileTimeToSystemTime GetEnvironmentVariableW GetDriveTypeW GetVolumePathNameW GetDiskFreeSpaceExW GetFinalPathNameByHandleW GetVolumeNameForVolumeMountPointW GetSystemInfo GetNativeSystemInfo GetLogicalDriveStringsW CompareStringOrdinal FreeEnvironmentStringsW WriteFileEx SleepEx SetLastError GetFullPathNameW SetFileInformationByHandle SetFileTime HeapReAlloc QueryPerformanceFrequency QueryPerformanceCounter CreateThread GetCurrentProcessId ReadFileEx FlushFileBuffers DuplicateHandle RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetSystemTimePreciseAsFileTime CancelIo GetFileInformationByHandleEx GetEnvironmentStringsW GetSystemDirectoryW CreateProcessW GetExitCodeProcess TerminateProcess SetFilePointerEx AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetCommandLineW RemoveDirectoryW FindFirstFileExW FindClose CreateHardLinkW FindNextFileW GetTempPathW WaitForMultipleObjects GetFileType SetWaitableTimer CreateWaitableTimerExW GetConsoleOutputCP WriteConsoleW MultiByteToWideChar DeleteFileW ReleaseMutex CreateMutexA WaitForSingleObjectEx WideCharToMultiByte SwitchToThread ExitProcess

oleaut32

GetErrorInfo SysStringLen SysAllocStringLen SysFreeString VariantClear

ntdll

NtWriteFile NtReadFile NtDeviceIoControlFile NtCreateNamedPipeFile RtlNtStatusToDosError NtOpenFile NtCancelIoFileEx

ole32

CoCreateInstance CoCreateGuid CoInitializeEx PropVariantClear CoUninitialize CoSetProxyBlanket

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

propsys

VariantToPropVariant VariantToBoolean PropVariantToBSTR

wevtapi

EvtOpenEventMetadataEnum EvtOpenPublisherMetadata EvtGetEventMetadataProperty EvtNext EvtNextEventMetadata EvtClose EvtQuery EvtRender EvtCreateRenderContext

psapi

GetPerformanceInfo EnumPageFilesW

userenv

GetUserProfileDirectoryW

vcruntime140

__CxxFrameHandler3 memcpy memcmp memmove memset _CxxThrowException __C_specific_handler __current_exception __current_exception_context

api-ms-win-crt-math-l1-1-0

fmod pow __setusermatherr floor

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

api-ms-win-crt-runtime-l1-1-0

_cexit __p___argv _initterm_e _c_exit _configure_narrow_argv terminate _set_app_type _seh_filter_exe _get_initial_narrow_environment _initterm _crt_atexit _register_onexit_function _initialize_onexit_table _exit exit _register_thread_local_exe_atexit_callback _initialize_narrow_environment __p___argc

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

4696023cb5b9a9202c8c060c09db72ad50ff06f01acfdb4c0929f5095d880a32

bcryptprimitives

advapi32

ktmw32

kernel32

oleaut32

ntdll

ole32

api-ms-win-core-synch-l1-2-0

propsys

wevtapi

psapi

userenv

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic