6d419fa05184262ee7f3a098ea94b1f27b37dff2624aafc5c6edc8d55320bb07

Sharing

Copy URL Twitter E-mail

General

Target
6d419fa05184262ee7f3a098ea94b1f27b37dff2624aafc5c6edc8d55320bb07
Size 759KB
Sample261015-we54eaax5w
SHA256 6d419fa05184262ee7f3a098ea94b1f27b37dff2624aafc5c6edc8d55320bb07
MD5 136b916aa396e2518e02699097b2c8cc
SHA1 73794f66430f0b9e253cff61976f2a5b9effdd59
SHA512 0c30bb2a7d165b0599fb71bf07bfe59b603097b60bcdfb299118967a887b34a4b911fb34fe8cf382dbc0125a9a9f1f1638cc2a51ed09271ac171cca931268998
SSDEEP 6144:bDAvQpVFhYnYLVAZffexqt5Qrgf3sdk36P8:b8qrEk
TLSH
T1EBF44156DAA6A694C07BC03C9552951EF96434BA8338A3FF76C54E812F817E4EF3D380
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6d419fa05184262ee7f3a098ea94b1f27b37dff2624aafc5c6edc8d55320bb07

File Explorer

6d419fa05184262ee7f3a098ea94b1f27b37dff2624aafc5c6edc8d55320bb07

.exe 759KB

6d419fa05184262ee7f3a098ea94b1f27b37dff2624aafc5c6edc8d55320bb07

IMPHASH 5cd4630b7c11d43483801180f0e8b020
SHA256 6d419fa05184262ee7f3a098ea94b1f27b37dff2624aafc5c6edc8d55320bb07
MD5 136b916aa396e2518e02699097b2c8cc
SHA1 73794f66430f0b9e253cff61976f2a5b9effdd59
SHA512 0c30bb2a7d165b0599fb71bf07bfe59b603097b60bcdfb299118967a887b34a4b911fb34fe8cf382dbc0125a9a9f1f1638cc2a51ed09271ac171cca931268998
SSDEEP 6144:bDAvQpVFhYnYLVAZffexqt5Qrgf3sdk36P8:b8qrEk
TLSH
T1EBF44156DAA6A694C07BC03C9552951EF96434BA8338A3FF76C54E812F817E4EF3D380
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

329940

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\matrix\x64\Debug\matrix.pdb

kernel32

GetLastError InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter WideCharToMultiByte HeapFree RaiseException IsDebuggerPresent GetStartupInfoW SetUnhandledExceptionFilter GetCurrentThreadId FreeLibrary HeapAlloc GetProcessHeap VirtualQuery LoadLibraryA GetProcAddress MultiByteToWideChar GetModuleHandleW

user32

GetWindowTextW SetWindowTextW UnhookWindowsHookEx CallNextHookEx LoadCursorW GetClientRect SetWindowsHookExW UpdateWindow DrawTextW GetSystemMetrics GetKeyState BeginPaint SetFocus SetWindowPos ShowWindow CreateWindowExW RegisterClassW PostQuitMessage GetMessageW DefWindowProcW DispatchMessageW TranslateMessage EndPaint InvalidateRect KillTimer SetTimer wsprintfW FillRect

gdi32

CreateFontW GetStockObject SelectObject SetBkMode SetTextColor DeleteObject

msvcp140d

?_Xlength_error@std@@YAXPEBD@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z

vcruntime140d

__vcrt_LoadLibraryExW __vcrt_GetModuleHandleW __vcrt_GetModuleFileNameW __std_type_info_destroy_list __C_specific_handler_noexcept __current_exception __C_specific_handler memset memmove memcmp memchr _CxxThrowException __std_exception_destroy __std_exception_copy memcpy __current_exception_context

vcruntime140_1d

__CxxFrameHandler4

ucrtbased

_set_app_type __setusermatherr _get_narrow_winmain_command_line _initterm _initterm_e exit _exit _set_fmode _c_exit _seh_filter_exe _configthreadlocale _set_new_mode __p__commode terminate strcpy_s strcat_s __stdio_common_vsprintf_s _wmakepath_s _wsplitpath_s wcscpy_s _register_thread_local_exe_atexit_callback _cexit _crt_at_quick_exit _execute_onexit_table _register_onexit_function _initialize_onexit_table _initialize_narrow_environment _configure_narrow_argv _seh_filter_dll _free_dbg malloc _callnewh _rotl _CrtDbgReport wcslen _CrtDbgReportW _crt_atexit

Name

.textbss

Size

Virtual Size

315KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.text

Size

662KB

Virtual Size

662KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

52KB

Virtual Size

52KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

31KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.msvcjmc

Size

1024B

Virtual Size

535B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

373B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

6d419fa05184262ee7f3a098ea94b1f27b37dff2624aafc5c6edc8d55320bb07

kernel32

user32

gdi32

msvcp140d

vcruntime140d

vcruntime140_1d

ucrtbased

generic