a277b95cd0eeb14c1d5a301215869da0e8f8f91c0dbbca60627c3c548df4bb0e

Sharing

Copy URL Twitter E-mail

General

Target
a277b95cd0eeb14c1d5a301215869da0e8f8f91c0dbbca60627c3c548df4bb0e
Size 9.9MB
Sample261003-sdh1ps1dla
SHA256 a277b95cd0eeb14c1d5a301215869da0e8f8f91c0dbbca60627c3c548df4bb0e
MD5 dd943d25e3aa0ee49ba82b6bfc02041e
SHA1 ca269efb955263a0466ea2ac95c6c11dc6865959
SHA512 018ec95a0c2e2c26e12ecc1eab6e559d7683ec266f497e49ee22a87dd8c7726d2ad0051a07212a50425a678570200e914deece8e10f8c7cf6984eb75093c6490
SSDEEP 49152:vhzJ3WGKyEcT8tv1WbnZ3zC7H07N4XusJE6OusFgI1O5QIi7TZQebfB32ckGU16B:xgtZG9ekQ84O4B3XERT2BtzD8
TLSH
T1D6A6B62A667DA4E9C17BC0B882838F61792130DA47392FF744D1827A2F25EF96D3D354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a277b95cd0eeb14c1d5a301215869da0e8f8f91c0dbbca60627c3c548df4bb0e

File Explorer

a277b95cd0eeb14c1d5a301215869da0e8f8f91c0dbbca60627c3c548df4bb0e

.exe 9.9MB

a277b95cd0eeb14c1d5a301215869da0e8f8f91c0dbbca60627c3c548df4bb0e

IMPHASH 683618f8c1ba4474a2ea254530fef59c
SHA256 a277b95cd0eeb14c1d5a301215869da0e8f8f91c0dbbca60627c3c548df4bb0e
MD5 dd943d25e3aa0ee49ba82b6bfc02041e
SHA1 ca269efb955263a0466ea2ac95c6c11dc6865959
SHA512 018ec95a0c2e2c26e12ecc1eab6e559d7683ec266f497e49ee22a87dd8c7726d2ad0051a07212a50425a678570200e914deece8e10f8c7cf6984eb75093c6490
SSDEEP 49152:vhzJ3WGKyEcT8tv1WbnZ3zC7H07N4XusJE6OusFgI1O5QIi7TZQebfB32ckGU16B:xgtZG9ekQ84O4B3XERT2BtzD8
TLSH
T1D6A6B62A667DA4E9C17BC0B882838F61792130DA47392FF744D1827A2F25EF96D3D354
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7633800

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

build_script_build-28bc4c798dd87867.pdb

shell32

SHGetKnownFolderPath

combase

CoTaskMemFree

kernel32

SetFileInformationByHandle GetCurrentThreadId GetFullPathNameW SetLastError SleepEx WriteFileEx GetCurrentProcessId SetFileTime ReadFileEx ReadFile GetOverlappedResult GetCurrentProcess WaitForSingleObject RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind GetProcessHeap FreeEnvironmentStringsW CancelIo GetFileInformationByHandleEx GetEnvironmentStringsW GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW GetExitCodeProcess TerminateProcess CompareStringOrdinal LoadLibraryA GetStdHandle CreateDirectoryW SetFilePointerEx IsProcessorFeaturePresent CreateEventW GetCurrentThread GetCurrentDirectoryW GetEnvironmentVariableW CreateFileW HeapFree CopyFileExW FindFirstFileExW ExitProcess SwitchToThread WideCharToMultiByte WaitForSingleObjectEx CreateMutexA ReleaseMutex GetFinalPathNameByHandleW CreateSymbolicLinkW DeviceIoControl GetModuleHandleA DeleteFileW SetEnvironmentVariableW HeapAlloc GetModuleFileNameW SetCurrentDirectoryW MultiByteToWideChar WriteConsoleW GetConsoleOutputCP GetModuleHandleW FormatMessageW HeapReAlloc WaitForMultipleObjects GetLastError GetProcAddress SetThreadStackGuarantee GetSystemTimeAsFileTime GetConsoleMode GetFileInformationByHandle GetNativeSystemInfo InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetFileSizeEx GetFileAttributesW CreateThread FindNextFileW FindFirstFileW FindClose CloseHandle lstrlenW QueryPerformanceCounter DuplicateHandle AddVectoredExceptionHandler

ole32

CoInitializeEx CoCreateInstance CoInitialize

oleaut32

SysStringLen SysFreeString

bcryptprimitives

ProcessPrng

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

advapi32

RegQueryValueExW RegCloseKey RegEnumKeyExW RegOpenKeyExA RegOpenKeyExW

ntdll

NtCreateNamedPipeFile NtReadFile RtlNtStatusToDosError NtWriteFile NtOpenFile

vcruntime140

memmove __CxxFrameHandler3 memcpy memcmp memset wcschr _CxxThrowException __C_specific_handler __current_exception_context __current_exception

api-ms-win-crt-string-l1-1-0

wcslen _wcsdup

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc free

api-ms-win-crt-stdio-l1-1-0

_fileno _set_fmode __p__commode fgetws _wfopen_s __stdio_common_vswscanf fclose _get_osfhandle

api-ms-win-crt-math-l1-1-0

__setusermatherr fmod

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _set_app_type _initialize_onexit_table _configure_narrow_argv _register_onexit_function _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e _seh_filter_exe exit _exit _register_thread_local_exe_atexit_callback __p___argc __p___argv terminate _cexit _c_exit

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

a277b95cd0eeb14c1d5a301215869da0e8f8f91c0dbbca60627c3c548df4bb0e

shell32

combase

kernel32

ole32

oleaut32

bcryptprimitives

api-ms-win-core-synch-l1-2-0

advapi32

ntdll

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic