a8f3923f41e451a67c83fbadc61210cc485448a8477605dd5ba65c7e7364996b

Sharing

Copy URL Twitter E-mail

General

Target
a8f3923f41e451a67c83fbadc61210cc485448a8477605dd5ba65c7e7364996b
Size 2.0MB
Sample261018-tywmzagv21
SHA256 a8f3923f41e451a67c83fbadc61210cc485448a8477605dd5ba65c7e7364996b
MD5 623a38f87083ad695261d42a9ed4f805
SHA1 5f67740cc67960e07d92a336b461b1d883738f83
SHA512 5a77f76ebbfd58b1091ca523e5987c2c96297d6cecd8d7c6598f9761b92a186fbc1882e26adf5f471322e6c680840d36f7be51b0db9a724b52b3339b359060e7
SSDEEP 24576:pZIuh/EtOBFdHYOy3EkxXK5c9WFuLYBGaKAlRBM8qybuvYRThPmnO:pZIuh8ehYhbMYrT8qs6C4
TLSH
T107A56B1AA3A1DBDBC89FE73855CB6716B230BC901763ABDB425006312E537D65E3EB04
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a8f3923f41e451a67c83fbadc61210cc485448a8477605dd5ba65c7e7364996b

File Explorer

a8f3923f41e451a67c83fbadc61210cc485448a8477605dd5ba65c7e7364996b

.exe 2.0MB

a8f3923f41e451a67c83fbadc61210cc485448a8477605dd5ba65c7e7364996b

IMPHASH 91ea11339fe74049703a72054af55020
SHA256 a8f3923f41e451a67c83fbadc61210cc485448a8477605dd5ba65c7e7364996b
MD5 623a38f87083ad695261d42a9ed4f805
SHA1 5f67740cc67960e07d92a336b461b1d883738f83
SHA512 5a77f76ebbfd58b1091ca523e5987c2c96297d6cecd8d7c6598f9761b92a186fbc1882e26adf5f471322e6c680840d36f7be51b0db9a724b52b3339b359060e7
SSDEEP 24576:pZIuh/EtOBFdHYOy3EkxXK5c9WFuLYBGaKAlRBM8qybuvYRThPmnO:pZIuh8ehYhbMYrT8qs6C4
TLSH
T107A56B1AA3A1DBDBC89FE73855CB6716B230BC901763ABDB425006312E537D65E3EB04
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ole32

CoInitializeEx CoTaskMemFree CoUninitialize

shell32

CommandLineToArgvW IsUserAnAdmin SHGetKnownFolderPath ShellExecuteExW ShellExecuteW

bcrypt

BCryptCloseAlgorithmProvider BCryptCreateHash BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptOpenAlgorithmProvider

kernel32

AcquireSRWLockExclusive AreFileApisANSI CloseHandle CreateDirectoryW CreateFileW CreateHardLinkW CreateSymbolicLinkW DeleteCriticalSection DeviceIoControl EnterCriticalSection FindClose FindFirstFileW FindNextFileW FlsAlloc FlsGetValue FlsSetValue FormatMessageA FreeLibrary GetACP GetCommandLineW GetCurrentDirectoryW GetCurrentProcessId GetCurrentThreadId GetDiskFreeSpaceExW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFinalPathNameByHandleW GetLastError GetLocaleInfoEx GetModuleFileNameW GetModuleHandleW GetProcAddress GetStartupInfoW GetSystemTimeAsFileTime GetTempPathW GetThreadId GetTickCount64 InitOnceExecuteOnce InitializeCriticalSection LeaveCriticalSection LoadLibraryExW LocalFree MoveFileExW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlRestoreContext RtlUnwindEx RtlVirtualUnwind SetCurrentDirectoryW SetEndOfFile SetFileAttributesW SetFileInformationByHandle SetFilePointerEx SetFileTime SetLastError SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW SwitchToThread TryAcquireSRWLockExclusive TryEnterCriticalSection VirtualProtect VirtualQuery WaitForSingleObject WaitForSingleObjectEx WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte

user32

MessageBoxW

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vfwprintf __stdio_common_vsprintf _close _fseeki64 _ftelli64 _get_osfhandle _wfopen _wopen fclose fflush fopen fputc fputwc fread fseek fwrite getc setbuf setvbuf ungetc

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___wargv __p__wcmdln __sys_nerr _assert _beginthreadex _cexit _configure_wide_argv _crt_atexit _errno _exit _initialize_wide_environment _initterm _initterm_e _seh_filter_exe _set_app_type _set_invalid_parameter_handler abort exit strerror strerror_s

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func ___mb_cur_max_func __pctype_func _configthreadlocale _create_locale _free_locale localeconv setlocale

api-ms-win-crt-heap-l1-1-0

_aligned_free _aligned_malloc _set_new_mode calloc free malloc realloc

api-ms-win-crt-private-l1-1-0

memchr memcmp memcpy memmove

api-ms-win-crt-string-l1-1-0

_iswalpha_l _iswcntrl_l _iswdigit_l _iswlower_l _iswprint_l _iswpunct_l _iswspace_l _iswupper_l _iswxdigit_l _strcoll_l _strdup _strxfrm_l _tolower_l _toupper_l _towlower_l _towupper_l _wcscoll_l _wcsxfrm_l isdigit isspace isxdigit mbrlen memset strcmp strlen strnlen tolower toupper wcscmp wcscpy wcslen wcsncmp wcsnlen

api-ms-win-crt-convert-l1-1-0

_strtod_l mbrtowc mbsrtowcs strtod strtof strtol strtoll strtoul strtoull wcrtomb wcrtomb_s wcstod wcstol wcstoll wcstoul wcstoull

api-ms-win-crt-time-l1-1-0

_strftime_l

api-ms-win-crt-multibyte-l1-1-0

_mbtowc_l

api-ms-win-crt-math-l1-1-0

__setusermatherr _fdopen

api-ms-win-crt-environment-l1-1-0

__p__wenviron getenv

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

Name

.text

Size

707KB

Virtual Size

706KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

250KB

Virtual Size

249KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

512B

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

712B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/18

Size

512B

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/58

Size

153KB

Virtual Size

153KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

65KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/82

Size

128KB

Virtual Size

127KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/33

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/47

Size

131KB

Virtual Size

131KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

a8f3923f41e451a67c83fbadc61210cc485448a8477605dd5ba65c7e7364996b

ole32

shell32

bcrypt

kernel32

user32

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-multibyte-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

generic