64bced2d5fa08934cd46558245d1c8ac8f2ce387405a550935693ab4b84bf360

Sharing

Copy URL Twitter E-mail

General

Target
64bced2d5fa08934cd46558245d1c8ac8f2ce387405a550935693ab4b84bf360
Size 439KB
Sample261017-qagblafv7l
SHA256 64bced2d5fa08934cd46558245d1c8ac8f2ce387405a550935693ab4b84bf360
MD5 340dbd6af98c5d5f4553d77a74f4c8f5
SHA1 89c586b7e4279e57e6195d6f26bb6581736ceb07
SHA512 5519a350dedcb8a9ddcd0a061ad77d347b27a18db9330cea179cc693c7859d7435dd395b7eaca65e7bed51327e578b07d22722c7d2ccf5909b60bade37546d43
SSDEEP 6144:kHBwZAIJL1ORC9JTB0JXNMGz/knxNYAV0N28YMollloyhE+n:uwZAIJZqpzstcohoB+
TLSH
T186A44A5BF75404B5D0679238C9668746E3B378B9077197CF03A893BA2F236D05D3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
64bced2d5fa08934cd46558245d1c8ac8f2ce387405a550935693ab4b84bf360

File Explorer

64bced2d5fa08934cd46558245d1c8ac8f2ce387405a550935693ab4b84bf360

.dll 439KB

64bced2d5fa08934cd46558245d1c8ac8f2ce387405a550935693ab4b84bf360

IMPHASH 324c1d526adc23155ec1d0daa287aef5
SHA256 64bced2d5fa08934cd46558245d1c8ac8f2ce387405a550935693ab4b84bf360
MD5 340dbd6af98c5d5f4553d77a74f4c8f5
SHA1 89c586b7e4279e57e6195d6f26bb6581736ceb07
SHA512 5519a350dedcb8a9ddcd0a061ad77d347b27a18db9330cea179cc693c7859d7435dd395b7eaca65e7bed51327e578b07d22722c7d2ccf5909b60bade37546d43
SSDEEP 6144:kHBwZAIJL1ORC9JTB0JXNMGz/knxNYAV0N28YMollloyhE+n:uwZAIJZqpzstcohoB+
TLSH
T186A44A5BF75404B5D0679238C9668746E3B378B9077197CF03A893BA2F236D05D3AB21
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

86644

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\devops_yanfa\agent\workspace\p-7251d90181e549fe9ac7ed916add6192\src\Src\SymbolTable\x64\Release\WS_Log.pdb

bugsplat64

?sendAdditionalFile@MiniDmpSender@@QEAAXPEB_W@Z ?setCallback@MiniDmpSender@@QEAAXP6A_NIPEAX0@Z@Z ?setMiniDumpType@MiniDmpSender@@QEAAXW4_BS_MINIDUMP_TYPE@1@@Z ??1MiniDmpSender@@UEAA@XZ ?setDefaultUserEmail@MiniDmpSender@@QEAAXPEB_W@Z ??0MiniDmpSender@@QEAA@PEB_W000K@Z

kernel32

CloseHandle SetUnhandledExceptionFilter GetCurrentProcess GetCurrentProcessId GetCurrentThreadId MultiByteToWideChar WideCharToMultiByte FindClose FindFirstFileW FindNextFileW GetPrivateProfileStringW WriteFile InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetLocalTime GetVersionExW GetProcAddress GlobalMemoryStatus LoadLibraryW GetUserDefaultLangID ReadFile CreateDirectoryW GetTempPathW TerminateProcess GetTickCount FreeLibrary GetModuleFileNameW lstrcatW LoadLibraryA UnregisterWaitEx SetFilePointer DeleteFileW CreateFileW SetEndOfFile QueryDepthSList InterlockedFlushSList InterlockedPushEntrySList EncodePointer DecodePointer RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx GetLastError HeapFree SetStdHandle GetFileType GetCommandLineA IsDebuggerPresent IsProcessorFeaturePresent HeapAlloc ExitProcess GetModuleHandleExW AreFileApisANSI HeapSize IsValidCodePage GetACP GetOEMCP GetCPInfo SetLastError GetCurrentThread GetStdHandle GetStartupInfoW GetConsoleMode ReadConsoleW SetFilePointerEx GetProcessHeap FlushFileBuffers GetConsoleCP RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter InitializeCriticalSectionAndSpinCount CreateEventW Sleep TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW CreateSemaphoreW GetModuleFileNameA QueryPerformanceCounter GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW LoadLibraryExW HeapReAlloc GetStringTypeW WriteConsoleW OutputDebugStringW CreateTimerQueue SetEvent WaitForSingleObjectEx SignalObjectAndWait SwitchToThread CreateThread SetThreadPriority GetThreadPriority GetLogicalProcessorInformation CreateTimerQueueTimer ChangeTimerQueueTimer DeleteTimerQueueTimer GetNumaHighestNodeNumber GetProcessAffinityMask SetThreadAffinityMask RegisterWaitForSingleObject UnregisterWait GetThreadTimes FreeLibraryAndExitThread GetModuleHandleA VirtualAlloc VirtualFree VirtualProtect DuplicateHandle ReleaseSemaphore InitializeSListHead InterlockedPopEntrySList

user32

wsprintfW GetSystemMetrics MessageBoxW

advapi32

RegOpenKeyExW RegQueryValueExW RegCloseKey

winmm

timeSetEvent timeKillEvent

??0LogFile@@QEAA@AEBV0@@Z ??0LogFile@@QEAA@PEBGHHK@Z ??0XMLCreate@@QEAA@AEBV0@@Z ??0XMLCreate@@QEAA@XZ ??0XMLParse@@QEAA@AEBV0@@Z ??0XMLParse@@QEAA@XZ ??1LogFile@@UEAA@XZ ??1XMLCreate@@UEAA@XZ ??1XMLParse@@UEAA@XZ ??4LogFile@@QEAAAEAV0@AEBV0@@Z ??4XMLCreate@@QEAAAEAV0@AEBV0@@Z ??4XMLParse@@QEAAAEAV0@AEBV0@@Z ??_7LogFile@@6B@ ??_7XMLCreate@@6B@ ??_7XMLParse@@6B@ ??_FLogFile@@QEAAXXZ ?AddAttributeValue@XMLCreate@@QEAAHPEAXPEBG1@Z ?AddAttributeValueByBase64@XMLCreate@@QEAAHPEAXPEBGPEBD@Z ?AddCommentNode@XMLCreate@@QEAAHPEAXPEBG1@Z ?AddElementNode@XMLCreate@@QEAAPEAXPEAXPEBG@Z ?AddElementValue@XMLCreate@@QEAAHPEAXPEBG@Z ?Close@LogFile@@QEAAXXZ ?GetAttributeCount@XMLParse@@QEBAHPEAX@Z ?GetAttributeValue@XMLParse@@QEBAHPEAXHPEBG1@Z ?GetAttributeValue@XMLParse@@QEBAHPEAXPEBG1@Z ?GetAttributeValueByBase64@XMLParse@@QEBAHPEAXPEBGPEAD@Z ?GetElementValue@XMLParse@@QEBAHPEAXPEBG1@Z ?GetNamedNodeCount@XMLParse@@QEBAHPEAXPEBG@Z ?GetNode@XMLParse@@QEBAPEAXPEAXPEBGH@Z ?GetNodeName@XMLParse@@QEBAHPEAXPEBG@Z ?GetNodeValue@XMLParse@@QEBAHPEAXPEBG@Z ?GetNodeValue@XMLParse@@QEBAPEBGPEAX@Z ?IsOpen@LogFile@@QEBAHXZ ?Load@XMLParse@@QEAAHPEBG@Z ?LoadXML@XMLParse@@QEAAHPEBG@Z ?Log@LogFile@@QEAAXPEBG@Z ?Open@LogFile@@QEAAHPEBGHHK@Z ?ReleaseNode@XMLCreate@@QEBAXPEAPEAX@Z ?ReleaseNode@XMLParse@@QEBAXPEAPEAX@Z ?Reset@XMLParse@@QEAAHXZ ?SaveXml@XMLCreate@@QEAAHPEBG@Z GetAppPath GetAppResourcePath GetAppSettingDeviceInfo GetAppSettingVendorID GetD3D11DeviceInfo GetD3D9DeviceInfo GetD3DLock GetDataMD5 GetFileMD5 GetFileMD5Ex GetFontCachePath GetGpuEncodeType GetIOFILE GetIOParams GetInterBackList GetLogPath GetNLECurrentOpenclWhichAPI GetOpenclD3D10Device GetOpenclD3D11Device GetOpenclD3D9Device GetTextPresetPublicProperties GetWinAtiVideoCardType LogFileCreate LogFileDestroy LogFileLog ReadLogFileBuffer ReleaseLogFileBuffer ReleaseTextPresetPublicProperties SetAppResourcePath SetBugSplatActiveDialog SetDumpFlg SetFontCachePath SetGpuEncodeType SetIOFILE SetIOParams SetInterBlackList SetLogPath SetNLECurrentOpenclWhichAPI SetOpenclD3D10Device SetOpenclD3D11Device SetOpenclD3D9Device SetWinAtiVideoCardType UseDefaultD3D9Ex WSBase64Decode WSBase64Encode WSLog WSLogEx WSLogInit WSLogUninit WSOutput WSOutputEx WSOutputImg

Sharing

General

Malware Config

Signatures

File Explorer

64bced2d5fa08934cd46558245d1c8ac8f2ce387405a550935693ab4b84bf360

bugsplat64

kernel32

user32

advapi32

winmm

generic