dfdad98468a284cd87b2780325f469128f2b71d70603a6a36a749c0c7b4a1652

Sharing

Copy URL Twitter E-mail

General

Target
dfdad98468a284cd87b2780325f469128f2b71d70603a6a36a749c0c7b4a1652
Size 673KB
Sample261012-xgd85sed38
SHA256 dfdad98468a284cd87b2780325f469128f2b71d70603a6a36a749c0c7b4a1652
MD5 dd996ec7ada386c620d2a3b81fb4e2e1
SHA1 85bd3139028b9a8fa75c74189bc965d2dc5444e5
SHA512 3977262bc8b5c5e229a9db8bfac0c5c6aaa170ad4d8031a15d7969123e7d524a5504c2143820fc5ebc058316c4718142335ce76d47c9aeebf84d355059760ebe
SSDEEP 6144:cstEDhbCX50jzM25LNoE+gt3fWrz2ehu7xR:XK1CX58tZfoqF7x
TLSH
T1DBE4B565EE32FA44C75B203D6484995FC5B329185FE147EFC3908B1D4A0BAC05B7F2AA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dfdad98468a284cd87b2780325f469128f2b71d70603a6a36a749c0c7b4a1652

File Explorer

dfdad98468a284cd87b2780325f469128f2b71d70603a6a36a749c0c7b4a1652

.exe 673KB

dfdad98468a284cd87b2780325f469128f2b71d70603a6a36a749c0c7b4a1652

IMPHASH bb7da77d8d8d4586e0730097b21b532c
SHA256 dfdad98468a284cd87b2780325f469128f2b71d70603a6a36a749c0c7b4a1652
MD5 dd996ec7ada386c620d2a3b81fb4e2e1
SHA1 85bd3139028b9a8fa75c74189bc965d2dc5444e5
SHA512 3977262bc8b5c5e229a9db8bfac0c5c6aaa170ad4d8031a15d7969123e7d524a5504c2143820fc5ebc058316c4718142335ce76d47c9aeebf84d355059760ebe
SSDEEP 6144:cstEDhbCX50jzM25LNoE+gt3fWrz2ehu7xR:XK1CX58tZfoqF7x
TLSH
T1DBE4B565EE32FA44C75B203D6484995FC5B329185FE147EFC3908B1D4A0BAC05B7F2AA
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

211880

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\24808\Desktop\badcode\x64\Debug\badcode.pdb

kernel32

WaitForSingleObject Sleep CreateThread VirtualAlloc VirtualProtect WriteConsoleW GetCurrentThreadId IsDebuggerPresent RaiseException MultiByteToWideChar WideCharToMultiByte RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead GetStartupInfoW GetModuleHandleW GetLastError HeapAlloc HeapFree GetProcessHeap VirtualQuery FreeLibrary GetProcAddress RtlUnwindEx InterlockedPushEntrySList InterlockedFlushSList GetModuleFileNameW LoadLibraryExW SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer RtlPcToFileHeader GetStdHandle WriteFile ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW GetCurrentThread OutputDebugStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW SetConsoleCtrlHandler GetFileSizeEx SetFilePointerEx HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile ReadConsoleW CloseHandle CreateFileW RtlUnwind

Name

.textbss

Size

Virtual Size

194KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

434KB

Virtual Size

434KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

89KB

Virtual Size

88KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

512B

Virtual Size

278B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

355B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

1024B

Virtual Size

546B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.rdata2

Size

105KB

Virtual Size

105KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

dfdad98468a284cd87b2780325f469128f2b71d70603a6a36a749c0c7b4a1652

kernel32

generic