256a4f87f13fdd8537b9b3bf0cdb9829b2c6e03105b2150bcd827f97a0e3d3b2

Sharing

Copy URL Twitter E-mail

General

Target
256a4f87f13fdd8537b9b3bf0cdb9829b2c6e03105b2150bcd827f97a0e3d3b2
Size 2.4MB
Sample261017-n1cd8aev7j
SHA256 256a4f87f13fdd8537b9b3bf0cdb9829b2c6e03105b2150bcd827f97a0e3d3b2
MD5 cbeae79ebb09963ed3a83a65050c16dc
SHA1 2be8c9b60fd57f114d73dd1e295fa74a9b08029f
SHA512 d3d2e0f8ec368f111c4c18a38249d376989f75e4c23e6bfb3d61170189e87918c905588d67088fb21ace881ce4e64b9fc35318acd1e2a9648f43bdc5115e7903
SSDEEP 49152:6Gtlq3Wyu2qgHO4c2bPXhSyILftHyqkHFUKcb51zLrCVJcJcn10v4W9DUTFPTDGH:km2cZEHFUKc51LCVJcJcn10v4W9DUTF+
TLSH
T145C59D17A3A800EDD5A7C17CD526A627E6F2740613F0DBDB4690C6791F63EEA16BE300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
256a4f87f13fdd8537b9b3bf0cdb9829b2c6e03105b2150bcd827f97a0e3d3b2

File Explorer

256a4f87f13fdd8537b9b3bf0cdb9829b2c6e03105b2150bcd827f97a0e3d3b2

.dll 2.4MB

256a4f87f13fdd8537b9b3bf0cdb9829b2c6e03105b2150bcd827f97a0e3d3b2

IMPHASH 6259454308fe20be2e066edbe91b1dd8
SHA256 256a4f87f13fdd8537b9b3bf0cdb9829b2c6e03105b2150bcd827f97a0e3d3b2
MD5 cbeae79ebb09963ed3a83a65050c16dc
SHA1 2be8c9b60fd57f114d73dd1e295fa74a9b08029f
SHA512 d3d2e0f8ec368f111c4c18a38249d376989f75e4c23e6bfb3d61170189e87918c905588d67088fb21ace881ce4e64b9fc35318acd1e2a9648f43bdc5115e7903
SSDEEP 49152:6Gtlq3Wyu2qgHO4c2bPXhSyILftHyqkHFUKcb51zLrCVJcJcn10v4W9DUTFPTDGH:km2cZEHFUKc51LCVJcJcn10v4W9DUTF+
TLSH
T145C59D17A3A800EDD5A7C17CD526A627E6F2740613F0DBDB4690C6791F63EEA16BE300
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1745300

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

E:\workspace\Beacon\build_x64\bin\Release\beacon_sdk.pdb

ws2_32

connect closesocket ioctlsocket WSACleanup __WSAFDIsSet htons recv select send setsockopt shutdown socket WSAStartup gethostbyname WSAGetLastError

kernel32

RaiseException GetLastError HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSection EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection FindResourceExW LoadResource LockResource SizeofResource FindResourceW GetPrivateProfileIntW GetPrivateProfileStringW WritePrivateProfileStringW CreateDirectoryW GetFileAttributesW GetModuleFileNameW MultiByteToWideChar WideCharToMultiByte CreateDirectoryA CreateMutexA GetCurrentProcessId ProcessIdToSessionId CloseHandle SetEvent WaitForSingleObject SleepEx CreateEventW Sleep CreateFileW DeviceIoControl GetVersionExW GetSystemDirectoryW FreeLibrary GetProcAddress LoadLibraryW DeleteFileW FindClose FindFirstFileW GetFileSize ReadFile RtlLookupFunctionEntry SetFilePointer WriteFile SwitchToThread CopyFileW GetFullPathNameW GetCurrentThreadId MoveFileW GetStdHandle GetFileType GetModuleHandleW RtlVirtualUnwind QueryPerformanceCounter GetTickCount GlobalMemoryStatus FlushConsoleInputBuffer LoadLibraryA FlushFileBuffers MapViewOfFile CreateFileMappingW FormatMessageA GetSystemTime GetSystemTimeAsFileTime SystemTimeToFileTime LockFileEx LocalFree UnlockFile HeapCompact GetSystemInfo DeleteFileA WaitForSingleObjectEx CreateFileA FlushViewOfFile OutputDebugStringW GetFileAttributesA GetDiskFreeSpaceA FormatMessageW GetTempPathA HeapValidate UnmapViewOfFile CreateMutexW GetTempPathW UnlockFileEx GetFullPathNameA LockFile OutputDebugStringA GetDiskFreeSpaceW HeapCreate AreFileApisANSI TryEnterCriticalSection UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent DisableThreadLibraryCalls RtlCaptureContext InitOnceBeginInitialize InitOnceComplete InitializeCriticalSectionAndSpinCount GetFileAttributesExW ResetEvent SetEndOfFile InitializeSListHead

user32

GetProcessWindowStation GetUserObjectInformationW MessageBoxW

shell32

SHGetFolderPathA SHGetFolderPathW SHGetSpecialFolderPathW

ole32

CoUninitialize CoInitialize CoCreateGuid

advapi32

RegCloseKey RegQueryValueExA RegOpenKeyExA CryptAcquireContextW CryptReleaseContext CryptGenRandom DeregisterEventSource RegisterEventSourceW ReportEventW

msvcp140

_Stat ?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A _File_size ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?uncaught_exception@std@@YA_NXZ ?_Xout_of_range@std@@YAXPEBD@Z ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ _Xtime_get_ticks _Mtx_init_in_situ _Mtx_destroy_in_situ _Mtx_lock _Mtx_unlock ?_Throw_C_error@std@@YAXH@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z ?_Xbad_function_call@std@@YAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z _Thrd_hardware_concurrency ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ _Query_perf_counter _Query_perf_frequency _Thrd_join _Thrd_id _Cnd_do_broadcast_at_thread_exit ?_Throw_Cpp_error@std@@YAXH@Z ?_Xinvalid_argument@std@@YAXPEBD@Z _Cnd_init_in_situ _Cnd_destroy_in_situ _Cnd_wait _Cnd_broadcast _Cnd_signal ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ _Thrd_detach _Mtx_current_owns _Cnd_timedwait ?_Syserror_map@std@@YAPEBDH@Z ??Bid@locale@std@@QEAA_KXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXPEAPEAD0PEAH001@Z

shlwapi

PathAppendW PathFindFileNameW

netapi32

Netbios

vcruntime140

__std_type_info_destroy_list _purecall __C_specific_handler __std_terminate memcpy memmove memset __std_exception_copy __std_exception_destroy _CxxThrowException strstr memcmp wcschr wcsrchr wcsstr __std_type_info_compare strchr strrchr

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

terminate _errno _invalid_parameter_noinfo_noreturn _invalid_parameter_noinfo signal _execute_onexit_table _beginthreadex _cexit _register_onexit_function _initterm _initterm_e _initialize_narrow_environment _endthreadex abort _configure_narrow_argv _wassert _exit _crt_atexit _initialize_onexit_table raise _seh_filter_dll

api-ms-win-crt-string-l1-1-0

strcspn wcsnlen isupper isxdigit _strnicmp isdigit tolower strcmp strncmp isspace strncpy strspn isalnum isprint wcscmp wcsncpy_s wmemcpy_s strcpy_s _stricmp strlen wcslen

api-ms-win-crt-heap-l1-1-0

realloc _msize free malloc _callnewh

api-ms-win-crt-convert-l1-1-0

_wtoi64 strtod strtoll atoi strtoul strtoull

api-ms-win-crt-stdio-l1-1-0

setvbuf ungetc __stdio_common_vsprintf fwrite _fseeki64 fsetpos _wfopen feof ferror fgets _fileno fopen fseek ftell _setmode fread fputc fgetpos fgetc fflush fclose fputs __stdio_common_vsprintf_s _get_stream_buffer_pointers __stdio_common_vsscanf __stdio_common_vswprintf_s __stdio_common_vsnprintf_s __stdio_common_vswprintf __stdio_common_vsnwprintf_s __stdio_common_vfprintf __acrt_iob_func

api-ms-win-crt-math-l1-1-0

_dtest _dsign pow

api-ms-win-crt-utility-l1-1-0

labs qsort

api-ms-win-crt-time-l1-1-0

_gmtime64 _time64 _localtime64_s

api-ms-win-crt-locale-l1-1-0

localeconv

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file _wstat64 _wmkdir _wsplitpath_s

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-conio-l1-1-0

_getch

??4BeaconClient@@QEAAAEAV0@$$QEAV0@@Z ??4BeaconClient@@QEAAAEAV0@AEBV0@@Z ?BeaconDeviceId@BeaconClient@@SAAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?BeaconDeviceIdForce@BeaconClient@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?BeaconSessionId@BeaconClient@@SAAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?GetProcessName@BeaconClient@@SAAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ ?InitSDK@BeaconClient@@SAXAEBUBeaconConfig@@@Z ?PrepareParams@BeaconClient@@KA?AV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@3@AEBV23@_J@Z ?Report@BeaconClient@@SAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@3@W4RequestPriority@Beacon@@0@Z ?SetLogLevel@BeaconClient@@SAXW4LogLevel@Beacon@@@Z ?UninitSDK@BeaconClient@@SAXXZ ?common_param_getters@BeaconClient@@SAAEBV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$function@$$A6A?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ@2@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$function@$$A6A?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ@2@@std@@@2@@std@@XZ ?common_params@BeaconClient@@SAAEBV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@XZ ?config@BeaconClient@@SAAEBUBeaconConfig@@XZ ?set_common_param_getters@BeaconClient@@SAXAEBV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$function@$$A6A?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ@2@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$function@$$A6A?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ@2@@std@@@2@@std@@@Z ?set_common_params@BeaconClient@@SAXAEBV?$map@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@U?$less@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@2@V?$allocator@U?$pair@$$CBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V12@@std@@@2@@std@@@Z

Name

.text

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

497KB

Virtual Size

500KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

170KB

Virtual Size

172KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

79KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.QMGuid

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

15KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

256a4f87f13fdd8537b9b3bf0cdb9829b2c6e03105b2150bcd827f97a0e3d3b2

ws2_32

kernel32

user32

shell32

ole32

advapi32

msvcp140

shlwapi

netapi32

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-conio-l1-1-0

generic