dc6984c4630d80ad700c0e0b3cf799805f5b04abf7999deec504f47793dc821b

Sharing

Copy URL Twitter E-mail

General

Target
dc6984c4630d80ad700c0e0b3cf799805f5b04abf7999deec504f47793dc821b
Size 3.2MB
Sample261002-szr6hawt8j
SHA256 dc6984c4630d80ad700c0e0b3cf799805f5b04abf7999deec504f47793dc821b
MD5 a127fa89c1f7a406ae420e6c61b25972
SHA1 01fb7eae64378131a09860868e75f713f40d1d01
SHA512 1804c3b6b97a17f1048a54e2f9b7dfa64a783b2b5daf28c17bc945facc25174eb6948152434ae31912c7a99047e3a5631ef16923903356aab99d50fde5e65490
SSDEEP 49152:abe0INpkDORWtD3FMDLUHzvpJgKvIMFjrOqaKYYrYIU6iZtqMlhacmA0jRFRRRRd:CeRWxaMH3JvRCNYrn+ZW
TLSH
T15FE59E13E5A484E9C1ADC074C39E9673FE36BC8E0634B1AB17E4BA212F25F901B5D749
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dc6984c4630d80ad700c0e0b3cf799805f5b04abf7999deec504f47793dc821b

File Explorer

dc6984c4630d80ad700c0e0b3cf799805f5b04abf7999deec504f47793dc821b

.exe 3.2MB

dc6984c4630d80ad700c0e0b3cf799805f5b04abf7999deec504f47793dc821b

IMPHASH 0722da3a4c8ee643cd9f89b88802a96d
SHA256 dc6984c4630d80ad700c0e0b3cf799805f5b04abf7999deec504f47793dc821b
MD5 a127fa89c1f7a406ae420e6c61b25972
SHA1 01fb7eae64378131a09860868e75f713f40d1d01
SHA512 1804c3b6b97a17f1048a54e2f9b7dfa64a783b2b5daf28c17bc945facc25174eb6948152434ae31912c7a99047e3a5631ef16923903356aab99d50fde5e65490
SSDEEP 49152:abe0INpkDORWtD3FMDLUHzvpJgKvIMFjrOqaKYYrYIU6iZtqMlhacmA0jRFRRRRd:CeRWxaMH3JvRCNYrn+ZW
TLSH
T15FE59E13E5A484E9C1ADC074C39E9673FE36BC8E0634B1AB17E4BA212F25F901B5D749
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1826656

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

exeify.pdb

ntdll

NtOpenFile RtlNtStatusToDosError RtlGetVersion NtCreateNamedPipeFile NtReadFile NtWriteFile

kernel32

GetModuleFileNameW CompareStringOrdinal SleepEx GetSystemTimePreciseAsFileTime SetWaitableTimer ExitProcess GetSystemDirectoryW GetWindowsDirectoryW DuplicateHandle FormatMessageW LoadLibraryW SetLastError GetExitCodeProcess WaitForSingleObject WaitForMultipleObjects LCIDToLocaleName GetUserDefaultUILanguage SetThreadStackGuarantee GetCurrentThread HeapAlloc MultiByteToWideChar ReleaseMutex WideCharToMultiByte lstrlenW SetHandleInformation GetCurrentProcessId ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable GetCurrentProcess GetProcessHeap HeapFree GetCurrentThreadId SwitchToThread FindNextFileW SetFilePointerEx GetFileAttributesW CreateProcessW FreeEnvironmentStringsW GetEnvironmentStringsW ReadFile CancelIo CreateEventW CreateWaitableTimerExW GetProcAddress QueryPerformanceCounter QueryPerformanceFrequency LoadLibraryA ReadFileEx WriteFileEx CreateThread DeleteFileW GetTempPathW LoadLibraryExA GetFileInformationByHandle SetFileTime CreateFileW FindFirstFileExW OutputDebugStringA OutputDebugStringW LoadLibraryExW GetModuleHandleA Sleep SetUnhandledExceptionFilter FreeLibrary CloseHandle GetFullPathNameW WaitForSingleObjectEx SleepConditionVariableSRW CreateDirectoryW GetEnvironmentVariableW RtlLookupFunctionEntry WriteConsoleW GetLastError GetConsoleOutputCP GetSystemTimeAsFileTime HeapReAlloc MoveFileExW SetFileInformationByHandle GetConsoleMode GetStdHandle CreateMutexA GetCurrentDirectoryW RtlVirtualUnwind FindClose SetEnvironmentVariableW GetCommandLineW RtlCaptureContext GetFileInformationByHandleEx InitializeSListHead GetOverlappedResult AddVectoredExceptionHandler GetModuleHandleW

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

user32

SetPropW SystemParametersInfoA GetKeyboardState GetAsyncKeyState EnumDisplayMonitors MonitorFromPoint SetWindowDisplayAffinity SendInput SetForegroundWindow GetWindowRect ToUnicodeEx ClientToScreen ScreenToClient MonitorFromRect GetKeyState GetSystemMetrics MonitorFromWindow FillRect SetCursor MapVirtualKeyExW GetKeyboardLayout ShowCursor ClipCursor GetMonitorInfoW GetClipCursor ValidateRect GetActiveWindow PeekMessageW GetWindowPlacement SetWindowPlacement ChangeDisplaySettingsExW TranslateMessage EnableMenuItem GetSystemMenu ShowWindow DestroyIcon GetUpdateRect RegisterRawInputDevices SetWindowLongPtrW GetMenu InvalidateRgn ReleaseCapture SetCapture DispatchMessageW GetWindowLongW RegisterWindowMessageA MessageBoxW GetMessageW GetWindow DefWindowProcW SetFocus PostThreadMessageW CreateIcon CloseTouchInputHandle RegisterTouchWindow GetTouchInputInfo TrackMouseEvent SystemParametersInfoW AdjustWindowRectEx CreateWindowExW GetClientRect SetWindowPos PostMessageW GetCursorPos LoadCursorW MapVirtualKeyW RedrawWindow SendMessageW DestroyWindow SetWindowLongW EnumChildWindows DispatchMessageA GetMessageA IsProcessDPIAware GetDC RegisterClassExW MsgWaitForMultipleObjectsEx GetWindowLongPtrW IsWindow GetRawInputData

comctl32

SetWindowSubclass DefSubclassProc RemoveWindowSubclass

gdi32

CreateRectRgn CreateSolidBrush GetDeviceCaps DeleteObject

ole32

CoInitializeEx CoUninitialize OleInitialize CoTaskMemAlloc RevokeDragDrop RegisterDragDrop CoCreateInstance CoCreateFreeThreadedMarshaler CoTaskMemFree

shlwapi

SHCreateMemStream

dwmapi

DwmSetWindowAttribute DwmEnableBlurBehindWindow

shell32

DragQueryFileW SHCreateItemFromParsingName DragFinish SHAppBarMessage

advapi32

EventWriteTransfer SystemFunction036 RegQueryValueExW RegOpenKeyExW RegCloseKey EventSetInformation RegGetValueW EventUnregister EventRegister

oleaut32

SysStringLen SetErrorInfo GetErrorInfo SysFreeString

bcryptprimitives

ProcessPrng

ws2_32

closesocket accept getsockopt select getpeername send freeaddrinfo getaddrinfo WSADuplicateSocketW connect listen bind setsockopt ioctlsocket WSACleanup WSAStartup WSAGetLastError recv getsockname WSASocketW

bcrypt

BCryptGenRandom

vcruntime140

__C_specific_handler _CxxThrowException __std_exception_destroy __std_exception_copy __current_exception_context __current_exception memcpy _purecall wcsrchr memset memcmp memmove __CxxFrameHandler3

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-math-l1-1-0

__setusermatherr ceil log2 floor fmin roundf floorf round trunc pow

api-ms-win-crt-string-l1-1-0

wcslen _wcsicmp wcscmp

api-ms-win-crt-convert-l1-1-0

_wtoi wcstol _ultow_s

api-ms-win-crt-runtime-l1-1-0

__p___argc _exit exit _initterm_e __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv terminate _set_app_type _seh_filter_exe _initialize_onexit_table _register_onexit_function _crt_atexit

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_callnewh free malloc _set_new_mode

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

735KB

Virtual Size

735KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

55KB

Virtual Size

55KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.pedata

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

dc6984c4630d80ad700c0e0b3cf799805f5b04abf7999deec504f47793dc821b

ntdll

kernel32

api-ms-win-core-synch-l1-2-0

user32

comctl32

gdi32

ole32

shlwapi

dwmapi

shell32

advapi32

oleaut32

bcryptprimitives

ws2_32

bcrypt

vcruntime140

vcruntime140_1

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic