bc9e7922bdf5cca48f583a5cd854286efac7de656ef58b1a3582e7aa8418fda5

Sharing

Copy URL Twitter E-mail

General

Target
bc9e7922bdf5cca48f583a5cd854286efac7de656ef58b1a3582e7aa8418fda5
Size 3.7MB
Sample261002-e9j1zsvfnf
SHA256 bc9e7922bdf5cca48f583a5cd854286efac7de656ef58b1a3582e7aa8418fda5
MD5 dac5f24452e3ffbb62b7a9b7b153e5f3
SHA1 70c8c996b9000b5d80099c4d71311f5e6b9b58cc
SHA512 c7bbccb69eee95d386a1381d65387bdb6eb2ddae55a53343872b052c8e43009bcc0348da73eb04323a9924d5dcd5781c4c32afb9f6ac4fa14fb7ee98cad2c25d
SSDEEP 49152:YWYS/v6BYCo/ccdz9tAEGPaC5GpkxNUFepF8SwjZpEJyc3EiRja6Ejb+WfRjg7wo:tQlrtUmGjg78eQU
TLSH
T12C06C51AB66960D9C17BC07892879F62B92170CE0B393BF785D182792F64EF86D3C714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bc9e7922bdf5cca48f583a5cd854286efac7de656ef58b1a3582e7aa8418fda5

File Explorer

bc9e7922bdf5cca48f583a5cd854286efac7de656ef58b1a3582e7aa8418fda5

.exe 3.7MB

bc9e7922bdf5cca48f583a5cd854286efac7de656ef58b1a3582e7aa8418fda5

IMPHASH fd505fe7598c6f9baf0809b533df8c43
SHA256 bc9e7922bdf5cca48f583a5cd854286efac7de656ef58b1a3582e7aa8418fda5
MD5 dac5f24452e3ffbb62b7a9b7b153e5f3
SHA1 70c8c996b9000b5d80099c4d71311f5e6b9b58cc
SHA512 c7bbccb69eee95d386a1381d65387bdb6eb2ddae55a53343872b052c8e43009bcc0348da73eb04323a9924d5dcd5781c4c32afb9f6ac4fa14fb7ee98cad2c25d
SSDEEP 49152:YWYS/v6BYCo/ccdz9tAEGPaC5GpkxNUFepF8SwjZpEJyc3EiRja6Ejb+WfRjg7wo:tQlrtUmGjg78eQU
TLSH
T12C06C51AB66960D9C17BC07892879F62B92170CE0B393BF785D182792F64EF86D3C714
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

2884476

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

rg_core-91addf1cfea2fded.pdb

ntdll

NtQueryInformationProcess NtReadFile NtCreateNamedPipeFile RtlNtStatusToDosError NtWriteFile NtOpenFile NtSetInformationProcess

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

bcryptprimitives

ProcessPrng

kernel32

IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime ReadProcessMemory CreateFileW GetDriveTypeW GetVolumePathNameW GetDiskFreeSpaceExW GetFinalPathNameByHandleW GetFileInformationByHandle GetVolumeNameForVolumeMountPointW OpenProcess GetProcessId IsWow64Process GetProcessTimes GetPriorityClass SetPriorityClass IsProcessCritical WaitForSingleObject GetProcessInformation SetProcessInformation QueryFullProcessImageNameW GetCurrentProcess CreateToolhelp32Snapshot ProcessIdToSessionId CloseHandle FreeLibrary GetSystemInfo GetNativeSystemInfo GetWindowsDirectoryW GlobalMemoryStatusEx GetLogicalDriveStringsW GetProcAddress LoadLibraryExW GetModuleHandleW Process32NextW Process32FirstW GetStdHandle SetConsoleTextAttribute GetConsoleScreenBufferInfo LoadLibraryExA CreateEventW GetProcessHeap HeapFree HeapAlloc GetLastError FormatMessageW CompareStringOrdinal FreeEnvironmentStringsW WriteFileEx SleepEx SetLastError GetFullPathNameW GetCurrentThreadId SetFileInformationByHandle SetFileTime HeapReAlloc QueryPerformanceFrequency QueryPerformanceCounter CreateThread GetCurrentProcessId ReadFileEx ReadFile GetOverlappedResult DuplicateHandle RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetSystemTimePreciseAsFileTime CancelIo GetFileInformationByHandleEx GetEnvironmentStringsW GetSystemDirectoryW CreateProcessW GetExitCodeProcess TerminateProcess CreateDirectoryW SetFilePointerEx AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW lstrlenW RemoveDirectoryW FindFirstFileExW FindClose ExitProcess SwitchToThread WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex DeleteFileW GetModuleFileNameW MultiByteToWideChar WriteConsoleW GetConsoleMode GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer Sleep GetFileAttributesW GetFileType WaitForMultipleObjects GetModuleHandleA GetTempPathW

psapi

GetProcessMemoryInfo GetPerformanceInfo EmptyWorkingSet EnumPageFilesW

advapi32

RegQueryValueExW GetLengthSid GetTokenInformation OpenProcessToken RegOpenKeyExW RegGetValueW RegCloseKey

ole32

CoInitializeEx CoUninitialize CoCreateInstance CoSetProxyBlanket

user32

GetWindowThreadProcessId GetForegroundWindow

gdi32

DeleteDC CreateCompatibleDC

propsys

VariantToBoolean

oleaut32

SysStringLen SysAllocStringLen SysFreeString VariantClear GetErrorInfo

userenv

GetUserProfileDirectoryW

vcruntime140

__CxxFrameHandler3 __current_exception_context __current_exception memset memcmp memmove __C_specific_handler _CxxThrowException memcpy

api-ms-win-crt-math-l1-1-0

floor fmod __setusermatherr

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment _get_initial_narrow_environment __p___argc _c_exit _register_thread_local_exe_atexit_callback _exit _set_app_type _initialize_onexit_table _register_onexit_function _crt_atexit _initterm_e _seh_filter_exe exit _cexit _configure_narrow_argv _initterm __p___argv terminate

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

bc9e7922bdf5cca48f583a5cd854286efac7de656ef58b1a3582e7aa8418fda5

ntdll

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

psapi

advapi32

ole32

user32

gdi32

propsys

oleaut32

userenv

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic