1783af5c6bb38d4c968a7605ec397f89531c5cb187e786954f4c1f9c362add5b

Sharing

Copy URL Twitter E-mail

General

Target
1783af5c6bb38d4c968a7605ec397f89531c5cb187e786954f4c1f9c362add5b
Size 4.4MB
Sample261026-tyrc9ae181
SHA256 1783af5c6bb38d4c968a7605ec397f89531c5cb187e786954f4c1f9c362add5b
MD5 59eee5dbf6e713b3e5dafbbd3d41479a
SHA1 2746309fa78f415c990396142ff43005a0f67df7
SHA512 d349645bb0dc29ca63039bb77655a6f8d386fafe42b0a9c52709df809c5c6473a55cc390a19431b4dec7012862323b3a419d7b67b759ee72659ab2eb7e0feb42
SSDEEP 24576:n7q/EpU/xIOsCwhjCromwnn5s/rPPPPPPPPPPPPPPPPPPPPP:n7q9UCwCnW5s
TLSH
T16526B670A8984CDCFC46D55EC5F93818896CF22B67CA2492711FCF26B301AC5AB8B5D7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1783af5c6bb38d4c968a7605ec397f89531c5cb187e786954f4c1f9c362add5b

File Explorer

1783af5c6bb38d4c968a7605ec397f89531c5cb187e786954f4c1f9c362add5b

.exe 4.4MB

1783af5c6bb38d4c968a7605ec397f89531c5cb187e786954f4c1f9c362add5b

IMPHASH d66ad1a493099fbc4479a10d351284c3
SHA256 1783af5c6bb38d4c968a7605ec397f89531c5cb187e786954f4c1f9c362add5b
MD5 59eee5dbf6e713b3e5dafbbd3d41479a
SHA1 2746309fa78f415c990396142ff43005a0f67df7
SHA512 d349645bb0dc29ca63039bb77655a6f8d386fafe42b0a9c52709df809c5c6473a55cc390a19431b4dec7012862323b3a419d7b67b759ee72659ab2eb7e0feb42
SSDEEP 24576:n7q/EpU/xIOsCwhjCromwnn5s/rPPPPPPPPPPPPPPPPPPPPP:n7q9UCwCnW5s
TLSH
T16526B670A8984CDCFC46D55EC5F93818896CF22B67CA2492711FCF26B301AC5AB8B5D7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

167280

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

gdiplus

GdipFree GdiplusStartup GdipCloneImage GdipGetImageEncoders GdipGetImageEncodersSize GdipCreateBitmapFromHBITMAP GdipSaveImageToStream GdipDisposeImage GdipAlloc

bcrypt

BCryptOpenAlgorithmProvider BCryptGetProperty BCryptCloseAlgorithmProvider BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptCreateHash

kernel32

GetStartupInfoW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter IsProcessorFeaturePresent GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCurrentThreadId Sleep CreateDirectoryW CreateFileW WriteFile GetTempPathW CloseHandle GetLastError GetModuleHandleW LoadResource LockResource SizeofResource FindResourceW GetEnvironmentVariableW GetCurrentDirectoryW DeleteFileW FileTimeToLocalFileTime FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetFileSizeEx GetLogicalDriveStringsW ReadFile RemoveDirectoryW SetHandleInformation PeekNamedPipe WaitForSingleObject CreateMutexW GetCurrentProcessId TerminateProcess OpenProcess GetTickCount64 GetModuleFileNameW GetProcAddress LoadLibraryW GetPrivateProfileStringW CopyFileW MoveFileW GetComputerNameW FileTimeToSystemTime MultiByteToWideChar WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW K32GetProcessMemoryInfo

shell32

ShellExecuteW

ole32

CreateStreamOnHGlobal

msvcp140

?_Xbad_function_call@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Xout_of_range@std@@YAXPEBD@Z _Xtime_get_ticks _Query_perf_counter _Query_perf_frequency _Thrd_detach _Cnd_do_broadcast_at_thread_exit ?_Throw_Cpp_error@std@@YAXH@Z

vcruntime140

__std_exception_copy _CxxThrowException __current_exception_context memcpy memmove memset wcschr memcmp __C_specific_handler __current_exception __std_exception_destroy

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe _set_app_type _beginthreadex _configure_wide_argv _initialize_wide_environment _get_wide_winmain_command_line _initterm _initterm_e exit _exit _crt_atexit _cexit _c_exit _register_thread_local_exe_atexit_callback terminate _invoke_watson _initialize_onexit_table _register_onexit_function

api-ms-win-crt-string-l1-1-0

towlower iswspace wcscmp wcslen

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf_s _set_fmode __p__commode

api-ms-win-crt-convert-l1-1-0

_wtoi wcstol wcstoul

api-ms-win-crt-heap-l1-1-0

free _set_new_mode malloc _callnewh

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

1783af5c6bb38d4c968a7605ec397f89531c5cb187e786954f4c1f9c362add5b

gdiplus

bcrypt

kernel32

shell32

ole32

msvcp140

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic