09b123ebff4e79408bb6d0f24ffb9b9299481cb5dcc0c2185df4efd3ff014d2f

General

Target
09b123ebff4e79408bb6d0f24ffb9b9299481cb5dcc0c2185df4efd3ff014d2f
Size 828KB
Sample261012-v8wldsywfx
SHA256 09b123ebff4e79408bb6d0f24ffb9b9299481cb5dcc0c2185df4efd3ff014d2f
MD5 5c861f754bfbf02ed3f55225a050bd83
SHA1 86e9401948e1603be4501dcc682cde7a3ea491e7
SHA512 4c778af70f7ee0ef04de1bfae0057a5807800c60c48a62c7aefb8343a5d284b1e0df7ca2cae8a2f305aa953d9b85210214d7250f880f0c3e67d8bdc2c4d32463
SSDEEP 12288:RMLRVKxQAd3HaHH/KVuaczSWiegmC0/Q3iDlfdp4tDO+lBjj6aew+tOekOETvafL:RMmmCzVuL2W/HQyDbaDNjjQqTyfEi
TLSH
T142050205F65120FBD1668A38C9A20A05FB3278554BA0AEDF47900EF5AF377D1AE3D712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
09b123ebff4e79408bb6d0f24ffb9b9299481cb5dcc0c2185df4efd3ff014d2f

File Explorer

09b123ebff4e79408bb6d0f24ffb9b9299481cb5dcc0c2185df4efd3ff014d2f

.exe 828KB

09b123ebff4e79408bb6d0f24ffb9b9299481cb5dcc0c2185df4efd3ff014d2f

IMPHASH 60dc6727c8bbae4170643b46bc5130e4
SHA256 09b123ebff4e79408bb6d0f24ffb9b9299481cb5dcc0c2185df4efd3ff014d2f
MD5 5c861f754bfbf02ed3f55225a050bd83
SHA1 86e9401948e1603be4501dcc682cde7a3ea491e7
SHA512 4c778af70f7ee0ef04de1bfae0057a5807800c60c48a62c7aefb8343a5d284b1e0df7ca2cae8a2f305aa953d9b85210214d7250f880f0c3e67d8bdc2c4d32463
SSDEEP 12288:RMLRVKxQAd3HaHH/KVuaczSWiegmC0/Q3iDlfdp4tDO+lBjj6aew+tOekOETvafL:RMmmCzVuL2W/HQyDbaDNjjQqTyfEi
TLSH
T142050205F65120FBD1668A38C9A20A05FB3278554BA0AEDF47900EF5AF377D1AE3D712
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

21584

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetStdHandle SetConsoleMode CreateMutexW WaitForSingleObject GetModuleHandleA OpenProcess CreateToolhelp32Snapshot Sleep GetConsoleMode GetTickCount64 GetLastError Process32NextW ReadConsoleInputW LockResource Process32FirstW SetConsoleTitleA LoadResource FindResourceW Module32FirstW VirtualProtectEx FlushConsoleInputBuffer GetProcAddress VirtualAllocEx ReadProcessMemory SetConsoleCP CreateRemoteThread Module32NextW SetConsoleOutputCP VirtualFreeEx IsWow64Process MultiByteToWideChar WriteConsoleW WriteProcessMemory SetConsoleCtrlHandler CloseHandle SizeofResource QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlPcToFileHeader RaiseException RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer CreateFileW GetFileType WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetCommandLineA GetCommandLineW IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree VirtualProtect LoadLibraryExW CompareStringW LCMapStringW SetStdHandle FlushFileBuffers GetConsoleOutputCP HeapReAlloc GetFileSizeEx SetFilePointerEx FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetStringTypeW GetProcessHeap HeapSize

advapi32

FreeSid CheckTokenMembership AllocateAndInitializeSid

Name

.text

Size

101KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

56KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

658KB

Virtual Size

657KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

09b123ebff4e79408bb6d0f24ffb9b9299481cb5dcc0c2185df4efd3ff014d2f

kernel32

advapi32

generic