c6f99c3ed87ecaa828a0117f81e0c157ac08acfd55fb11868f4851e2dd92d3a8

Sharing

Copy URL Twitter E-mail

General

Target
c6f99c3ed87ecaa828a0117f81e0c157ac08acfd55fb11868f4851e2dd92d3a8
Size 7.1MB
Sample261020-ty883acc85
SHA256 c6f99c3ed87ecaa828a0117f81e0c157ac08acfd55fb11868f4851e2dd92d3a8
MD5 218af70e6fa5934afa78ba9dd4327e59
SHA1 c5cd0c0ff1d2429f1e1cc682ab6c31ae265cac5f
SHA512 493a4e955642e2ea64f921c25e21f94332901be26136f7caaf9b9e619b227a064f9d244ad8634b66a658589974de93f5b89e2690efb98f35c6b626ffddfe65bd
SSDEEP 196608:wdMLTuocghFWdOoGSxOKTpdN/fwGWnzMR12ZF1HP+Ra9ZVEGl:MQTdcliyFf50oR4jp+o9rEGl
TLSH
T1F376330292D2741CDD03CCB8E7C1B6B2B67D74C5879699E726E2E0F41D12EF065393AA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c6f99c3ed87ecaa828a0117f81e0c157ac08acfd55fb11868f4851e2dd92d3a8

File Explorer

c6f99c3ed87ecaa828a0117f81e0c157ac08acfd55fb11868f4851e2dd92d3a8

.exe 7.1MB

c6f99c3ed87ecaa828a0117f81e0c157ac08acfd55fb11868f4851e2dd92d3a8

IMPHASH 47bd88a464216d2fd6e4cd924e6066a6
SHA256 c6f99c3ed87ecaa828a0117f81e0c157ac08acfd55fb11868f4851e2dd92d3a8
MD5 218af70e6fa5934afa78ba9dd4327e59
SHA1 c5cd0c0ff1d2429f1e1cc682ab6c31ae265cac5f
SHA512 493a4e955642e2ea64f921c25e21f94332901be26136f7caaf9b9e619b227a064f9d244ad8634b66a658589974de93f5b89e2690efb98f35c6b626ffddfe65bd
SSDEEP 196608:wdMLTuocghFWdOoGSxOKTpdN/fwGWnzMR12ZF1HP+Ra9ZVEGl:MQTdcliyFf50oR4jp+o9rEGl
TLSH
T1F376330292D2741CDD03CCB8E7C1B6B2B67D74C5879699E726E2E0F41D12EF065393AA
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

108752

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

api-ms-win-crt-convert-l1-1-0

mbstowcs wcstol

api-ms-win-crt-filesystem-l1-1-0

_wrename

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-private-l1-1-0

wcschr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___wargv __p__wcmdln _cexit _configure_wide_argv _crt_atexit _errno _exit _initialize_wide_environment _initterm _initterm_e _seh_filter_exe _set_app_type _set_invalid_parameter_handler abort exit

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf __stdio_common_vswprintf fflush fwrite puts setvbuf

api-ms-win-crt-string-l1-1-0

iswctype _wcsdup _wcsicmp strcat strcpy strncpy wcscmp wcslen wcsncmp

kernel32

AddDllDirectory CloseHandle CopyFileW CreateDirectoryW CreateFileMappingW CreateFileW CreateProcessW DeleteCriticalSection DeleteFileW EnterCriticalSection FormatMessageA GetCommandLineW GetCurrentProcessId GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileSize GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleExA GetProcAddress GetShortPathNameW GetStartupInfoW GetStdHandle GetSystemTimeAsFileTime GetTempPathW InitializeCriticalSection K32GetModuleFileNameExW LeaveCriticalSection LoadLibraryExW MapViewOfFile OpenProcess QueryPerformanceCounter ReadFile SetConsoleCtrlHandler SetDllDirectoryW SetEnvironmentVariableW SetUnhandledExceptionFilter Sleep TerminateProcess TlsGetValue UnmapViewOfFile VirtualProtect VirtualQuery WaitForSingleObject WideCharToMultiByte WriteFile

shell32

CommandLineToArgvW SHFileOperationW SHGetFolderPathW

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-environment-l1-1-0

__p__wenviron

Name

.text

Size

153KB

Virtual Size

153KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

6.9MB

Virtual Size

6.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

178KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

116B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

c6f99c3ed87ecaa828a0117f81e0c157ac08acfd55fb11868f4851e2dd92d3a8

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

kernel32

shell32

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-environment-l1-1-0

generic