518858a690e8661eee644152486dcb0e9b7a2cbf0d31b74d135532e15be29ea3

Sharing

Copy URL Twitter E-mail

General

Target
518858a690e8661eee644152486dcb0e9b7a2cbf0d31b74d135532e15be29ea3
Size 5.0MB
Sample261003-ktnbcsvcpe
SHA256 518858a690e8661eee644152486dcb0e9b7a2cbf0d31b74d135532e15be29ea3
MD5 c999e7b745ab96dea620687dd1779de5
SHA1 2d0c03b674c7b9feece60e2c6101cb926176c1bb
SHA512 20584d508e9733cf4c3b73969aa288faf983509919684bd5a1c7d184487cf80cd46b0b4d77e55a8eccc3ebdf074200d0cb224a43dd56f13ef1ea4a5054d4d7e7
SSDEEP 49152:Bkspu4LZyleuo8u1gQTIfcskbAkPFc4Sef3bSF9JJ5fuCAKscsad1Ings83LT9gz:Be1tGi9wf769n1
TLSH
T14036A31AA679A0DDC17BC0B8D2878F72A92170DD0B396AF345D182792F24EF86D3C754
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
518858a690e8661eee644152486dcb0e9b7a2cbf0d31b74d135532e15be29ea3

File Explorer

518858a690e8661eee644152486dcb0e9b7a2cbf0d31b74d135532e15be29ea3

.exe 5.0MB

518858a690e8661eee644152486dcb0e9b7a2cbf0d31b74d135532e15be29ea3

IMPHASH d8c68e1e8510c73bf0d1cbdeb827905c
SHA256 518858a690e8661eee644152486dcb0e9b7a2cbf0d31b74d135532e15be29ea3
MD5 c999e7b745ab96dea620687dd1779de5
SHA1 2d0c03b674c7b9feece60e2c6101cb926176c1bb
SHA512 20584d508e9733cf4c3b73969aa288faf983509919684bd5a1c7d184487cf80cd46b0b4d77e55a8eccc3ebdf074200d0cb224a43dd56f13ef1ea4a5054d4d7e7
SSDEEP 49152:Bkspu4LZyleuo8u1gQTIfcskbAkPFc4Sef3bSF9JJ5fuCAKscsad1Ings83LT9gz:Be1tGi9wf769n1
TLSH
T14036A31AA679A0DDC17BC0B8D2878F72A92170DD0B396AF345D182792F24EF86D3C754
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3869596

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

rg_core-91addf1cfea2fded.pdb

ntdll

NtQueryInformationProcess NtSetInformationProcess NtCreateNamedPipeFile NtReadFile RtlNtStatusToDosError NtWriteFile NtOpenFile

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

kernel32

IsProcessorFeaturePresent GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetLogicalDriveStringsW CreateFileW GetDriveTypeW GetVolumePathNameW GetDiskFreeSpaceExW GetFileAttributesExW GetVolumeInformationW GetFinalPathNameByHandleW GetFileInformationByHandle GetFileInformationByHandleEx GetVolumeNameForVolumeMountPointW Process32NextW Process32FirstW GetCurrentProcess ProcessIdToSessionId GetProcAddress LoadLibraryExW GetModuleHandleW GetSystemInfo GetNativeSystemInfo GetWindowsDirectoryW GlobalMemoryStatusEx CloseHandle FreeLibrary ReadProcessMemory OpenProcess GetProcessId IsWow64Process GetProcessTimes GetPriorityClass SetPriorityClass IsProcessCritical WaitForSingleObject GetProcessInformation SetProcessInformation QueryFullProcessImageNameW CreateToolhelp32Snapshot GetStdHandle SetConsoleTextAttribute GetConsoleScreenBufferInfo LoadLibraryExA CreateEventW GetProcessHeap HeapFree HeapAlloc GetLastError FormatMessageW CompareStringOrdinal FreeEnvironmentStringsW WriteFileEx SleepEx SetLastError GetFullPathNameW GetCurrentThreadId SetFileInformationByHandle SetFileTime HeapReAlloc QueryPerformanceFrequency QueryPerformanceCounter CreateThread GetCurrentProcessId ReadFileEx ReadFile GetOverlappedResult DuplicateHandle RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetSystemTimePreciseAsFileTime CancelIo GetEnvironmentStringsW GetSystemDirectoryW CreateProcessW GetExitCodeProcess TerminateProcess CreateDirectoryW SetFilePointerEx AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW GetCommandLineW lstrlenW RemoveDirectoryW FindFirstFileExW FindClose ExitProcess SwitchToThread WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA CreateMutexA ReleaseMutex DeleteFileW GetModuleFileNameW MultiByteToWideChar WriteConsoleW GetConsoleMode GetConsoleOutputCP CreateWaitableTimerExW SetWaitableTimer Sleep GetFileAttributesW GetFileType WaitForMultipleObjects GetModuleHandleA GetTempPathW

gdi32

CreateCompatibleDC DeleteDC

advapi32

RegOpenKeyExW GetTokenInformation GetLengthSid RegQueryValueExW OpenProcessToken RegCloseKey RegGetValueW

user32

GetWindowThreadProcessId GetForegroundWindow

pdh

PdhCloseQuery

psapi

GetProcessMemoryInfo GetPerformanceInfo EmptyWorkingSet EnumPageFilesW

ole32

CoInitializeEx CoUninitialize CoCreateInstance CoSetProxyBlanket

propsys

VariantToBoolean

oleaut32

SysStringLen SysAllocStringLen SysFreeString VariantClear GetErrorInfo

userenv

GetUserProfileDirectoryW

vcruntime140

memcmp _CxxThrowException memmove __current_exception_context __current_exception __C_specific_handler memset __CxxFrameHandler3 memcpy

api-ms-win-crt-math-l1-1-0

trunc floor fmod __setusermatherr

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

api-ms-win-crt-runtime-l1-1-0

_cexit _c_exit __p___argc _register_thread_local_exe_atexit_callback _exit exit _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _register_onexit_function _set_app_type _seh_filter_exe _initialize_onexit_table _crt_atexit terminate _initterm_e __p___argv

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

518858a690e8661eee644152486dcb0e9b7a2cbf0d31b74d135532e15be29ea3

ntdll

api-ms-win-core-synch-l1-2-0

bcryptprimitives

kernel32

gdi32

advapi32

user32

pdh

psapi

ole32

propsys

oleaut32

userenv

vcruntime140

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic