199720cc63aca9403bbc13ea03e19bae11ea33723bf3055f923c6313ee698cb7

Sharing

Copy URL Twitter E-mail

General

Target
199720cc63aca9403bbc13ea03e19bae11ea33723bf3055f923c6313ee698cb7
Size 216KB
Sample261003-npfx9sys2n
SHA256 199720cc63aca9403bbc13ea03e19bae11ea33723bf3055f923c6313ee698cb7
MD5 8e27a716e14e068090366dd937904203
SHA1 8b4b665211834b26fa83d1595ca065313d4638f6
SHA512 bb9527c1981d44a6bb3df959984d4f1cbbb945ed9b7cbe556a7b4be1510858caa4a8e329384285c1656f192ae8ae62878e5bd04565b49f6e5dd21e00c69e030e
SSDEEP 3072:A6SdqtOS3qx8ML+FHv03PMAfEqN8ESnZnBZVkaCxTyM+ZizG94Y:kdqoDPpfXNAYa74
TLSH
T1C0242806F6A540BAEC7A85349A674D05E7B2F85503A0ABDB17401EFD8F2B7E09E3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
199720cc63aca9403bbc13ea03e19bae11ea33723bf3055f923c6313ee698cb7

File Explorer

199720cc63aca9403bbc13ea03e19bae11ea33723bf3055f923c6313ee698cb7

.dll 216KB

199720cc63aca9403bbc13ea03e19bae11ea33723bf3055f923c6313ee698cb7

IMPHASH f8de028e222824b4f3a2cf039687b2db
SHA256 199720cc63aca9403bbc13ea03e19bae11ea33723bf3055f923c6313ee698cb7
MD5 8e27a716e14e068090366dd937904203
SHA1 8b4b665211834b26fa83d1595ca065313d4638f6
SHA512 bb9527c1981d44a6bb3df959984d4f1cbbb945ed9b7cbe556a7b4be1510858caa4a8e329384285c1656f192ae8ae62878e5bd04565b49f6e5dd21e00c69e030e
SSDEEP 3072:A6SdqtOS3qx8ML+FHv03PMAfEqN8ESnZnBZVkaCxTyM+ZizG94Y:kdqoDPpfXNAYa74
TLSH
T1C0242806F6A540BAEC7A85349A674D05E7B2F85503A0ABDB17401EFD8F2B7E09E3D710
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

53680

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

ExpandEnvironmentStringsW CreateFileW CloseHandle DeviceIoControl GetCurrentThread FreeLibrary GetProcAddress LoadLibraryW MulDiv HeapSize VirtualProtect GetLastError GetCurrentProcess GetCurrentThreadId SuspendThread ResumeThread GetThreadContext SetThreadContext FlushInstructionCache VirtualAlloc VirtualFree VirtualQuery SetLastError GetModuleHandleW LoadLibraryExW WriteConsoleW SetEndOfFile GetConsoleOutputCP WriteFile FlushFileBuffers SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WideCharToMultiByte MultiByteToWideChar GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection QueryPerformanceCounter EncodePointer DecodePointer GetSystemTimeAsFileTime GetCPInfo WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent TerminateProcess GetCurrentProcessId InitializeSListHead RtlPcToFileHeader RaiseException RtlUnwindEx InterlockedFlushSList InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW GetModuleFileNameW HeapFree HeapAlloc HeapReAlloc ReadFile GetConsoleMode ReadConsoleW FlsAlloc FlsGetValue FlsSetValue FlsFree LCMapStringW GetStdHandle GetFileType SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW

user32

GetAsyncKeyState SendInput GetSystemMetrics GetCursorPos

ntdll

NtOpenDirectoryObject NtQueryDirectoryObject RtlInitUnicodeString

Name

.text

Size

120KB

Virtual Size

120KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

66KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourc

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

199720cc63aca9403bbc13ea03e19bae11ea33723bf3055f923c6313ee698cb7

kernel32

user32

ntdll

generic