08fcfe4ed3d7be52ec53e262469f3c6ad7a3152dd8a45d310c68632f290e95b9

Sharing

Copy URL Twitter E-mail

General

Target
08fcfe4ed3d7be52ec53e262469f3c6ad7a3152dd8a45d310c68632f290e95b9
Size 310KB
Sample261027-jaslasda23
SHA256 08fcfe4ed3d7be52ec53e262469f3c6ad7a3152dd8a45d310c68632f290e95b9
MD5 22190cb923be6a50b9758455bf38a5cc
SHA1 f2e5302c2c55c43c762efd8db3467c775cbd5969
SHA512 a82702b1f75756e82bced9c8e5fd6190db5ca532342cb55b84dad6e250bfd74df7a57103e25f739698212b4bcfe33ba320ac6abaeb421e470c37b8554da389fa
SSDEEP 6144:wASL6x7T56dnxvW+ruAere72a4kYK5NR9CIuYRTlG8:wAvxcRxvW+SA572fK5NCu0
TLSH
T18C646C53BAA199BDE196C074835691B3BB37B88A07327CBB13E486343F69D516F2C710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
08fcfe4ed3d7be52ec53e262469f3c6ad7a3152dd8a45d310c68632f290e95b9

File Explorer

08fcfe4ed3d7be52ec53e262469f3c6ad7a3152dd8a45d310c68632f290e95b9

.exe 310KB

08fcfe4ed3d7be52ec53e262469f3c6ad7a3152dd8a45d310c68632f290e95b9

IMPHASH 6142a658399466381ddcf51399a7ac6e
SHA256 08fcfe4ed3d7be52ec53e262469f3c6ad7a3152dd8a45d310c68632f290e95b9
MD5 22190cb923be6a50b9758455bf38a5cc
SHA1 f2e5302c2c55c43c762efd8db3467c775cbd5969
SHA512 a82702b1f75756e82bced9c8e5fd6190db5ca532342cb55b84dad6e250bfd74df7a57103e25f739698212b4bcfe33ba320ac6abaeb421e470c37b8554da389fa
SSDEEP 6144:wASL6x7T56dnxvW+ruAere72a4kYK5NR9CIuYRTlG8:wAvxcRxvW+SA572fK5NCu0
TLSH
T18C646C53BAA199BDE196C074835691B3BB37B88A07327CBB13E486343F69D516F2C710
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5088

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

kernel32

AddVectoredExceptionHandler CloseHandle CompareStringOrdinal CreateFileMappingA CreateFileW CreateProcessW CreateThread CreateToolhelp32Snapshot DeleteCriticalSection DuplicateHandle EnterCriticalSection FlsAlloc FlsFree FlsSetValue FormatMessageW FreeEnvironmentStringsW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetProcAddress GetProcessHeap GetStdHandle GetSystemDirectoryW GetWindowsDirectoryW HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete InitializeCriticalSection IsThreadAFiber LeaveCriticalSection MapViewOfFile Module32FirstW Module32NextW MultiByteToWideChar RaiseException ReadFileEx RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetFileInformationByHandle SetFileTime SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter Sleep SleepEx TlsAlloc TlsFree TlsGetValue TlsSetValue UnmapViewOfFile VirtualProtect VirtualQuery WaitForSingleObject WriteConsoleW WriteFileEx __C_specific_handler

msvcrt

__getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _cexit _commode _fmode _fpreset _initterm _onexit abort calloc exit fprintf free fwrite malloc memcmp memcpy memmove memset signal strlen strncmp vfprintf wcslen

ntdll

NtCreateNamedPipeFile NtOpenFile NtReadFile NtWriteFile RtlNtStatusToDosError

Name

.text

Size

249KB

Virtual Size

249KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

32KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

512B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1024B

Virtual Size

736B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

08fcfe4ed3d7be52ec53e262469f3c6ad7a3152dd8a45d310c68632f290e95b9

api-ms-win-core-synch-l1-2-0

kernel32

msvcrt

ntdll

generic