0ac3a708a65b6599f12ae9a7be1bb435fcb7e6dc1654bec57265ecd42b28422e

Sharing

Copy URL Twitter E-mail

General

Target
0ac3a708a65b6599f12ae9a7be1bb435fcb7e6dc1654bec57265ecd42b28422e
Size 753KB
Sample261027-rwallsdy2x
SHA256 0ac3a708a65b6599f12ae9a7be1bb435fcb7e6dc1654bec57265ecd42b28422e
MD5 cc1a723c8881034c19f5f4bffed3bf30
SHA1 99d56da671658fe5b91f14ab47680408100bf1b5
SHA512 9dde9652b2d8c543f94bb733c61091f03937106e5b557a24482d6716c5e895b861b4e1ce456c4f3c15672a0d21117794052935cf3bcf3c6c9ebc9bc491325a2f
SSDEEP 12288:f6lvmxH4aTgZ+m+DbsGLQPF4NsBaCNip/T+sJZZKdChPfk:TxYaTgUm+ntLQcsBaKKasJZn
TLSH
T1DBF4AE217992A0FAC4126332652CF7751A3DBD120B204CD7C7D8BEF82AF56D11E3666B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0ac3a708a65b6599f12ae9a7be1bb435fcb7e6dc1654bec57265ecd42b28422e

File Explorer

0ac3a708a65b6599f12ae9a7be1bb435fcb7e6dc1654bec57265ecd42b28422e

.exe 753KB

0ac3a708a65b6599f12ae9a7be1bb435fcb7e6dc1654bec57265ecd42b28422e

IMPHASH 314da1a01d12d6826535da9cda37ed3a
SHA256 0ac3a708a65b6599f12ae9a7be1bb435fcb7e6dc1654bec57265ecd42b28422e
MD5 cc1a723c8881034c19f5f4bffed3bf30
SHA1 99d56da671658fe5b91f14ab47680408100bf1b5
SHA512 9dde9652b2d8c543f94bb733c61091f03937106e5b557a24482d6716c5e895b861b4e1ce456c4f3c15672a0d21117794052935cf3bcf3c6c9ebc9bc491325a2f
SSDEEP 12288:f6lvmxH4aTgZ+m+DbsGLQPF4NsBaCNip/T+sJZZKdChPfk:TxYaTgUm+ntLQcsBaKKasJZn
TLSH
T1DBF4AE217992A0FAC4126332652CF7751A3DBD120B204CD7C7D8BEF82AF56D11E3666B
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

479472

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\browser125\out\Release-x86\chrome_proxy.exe.pdb

advapi32

CreateProcessAsUserW RegCloseKey RegOpenKeyExW RegQueryValueExW

kernel32

AcquireSRWLockExclusive AssignProcessToJobObject CloseHandle CompareStringW CreateFileW CreateProcessW DecodePointer DeleteCriticalSection DeleteFileW DeleteProcThreadAttributeList EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExpandEnvironmentStringsW FindClose FindFirstFileExW FindNextFileW FlushFileBuffers FormatMessageW FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileSizeEx GetFileType GetFullPathNameW GetLastError GetLocalTime GetLocaleInfoW GetLogicalProcessorInformation GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHeap GetProcessId GetProductInfo GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemInfo GetSystemTimeAsFileTime GetTempPathW GetThreadPriority GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetVersionExW GetWindowsDirectoryW InitOnceExecuteOnce InitializeCriticalSectionAndSpinCount InitializeProcThreadAttributeList InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadLibraryW LocalFree MultiByteToWideChar OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency QueryThreadCycleTime RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive RtlCaptureStackBackTrace RtlUnwind SetEnvironmentVariableW SetFilePointerEx SetHandleInformation SetLastError SetStdHandle SetThreadInformation SetThreadPriority SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnhandledExceptionFilter UpdateProcThreadAttribute VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForSingleObject WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

user32

AllowSetForegroundWindow GetActiveWindow

shell32

CommandLineToArgvW SHGetFolderPathW SHGetKnownFolderPath ShellExecuteExW

userenv

CreateEnvironmentBlock DestroyEnvironmentBlock

winmm

timeGetTime

ole32

CoTaskMemFree

Name

.text

Size

609KB

Virtual Size

609KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

99KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

13KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

189B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

malloc_h

Size

512B

Virtual Size

243B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

prot

Size

512B

Virtual Size

112B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

26KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

0ac3a708a65b6599f12ae9a7be1bb435fcb7e6dc1654bec57265ecd42b28422e

advapi32

kernel32

user32

shell32

userenv

winmm

ole32

generic