a9ea7961681c2635909599912182850cdb43f706695370cc124a1877dd84793d

Sharing

Copy URL Twitter E-mail

General

Target
a9ea7961681c2635909599912182850cdb43f706695370cc124a1877dd84793d
Size 4.4MB
Sample261027-yav4rawxas
SHA256 a9ea7961681c2635909599912182850cdb43f706695370cc124a1877dd84793d
MD5 8bbdb521b4996aabcfcfd718fef51b48
SHA1 f7521ea5bd1ff4012d1e0b36933778ddeae18687
SHA512 269e3d5e40e91a7d86a1f8ca82daf42606e7588960952cb958531416822a38a3fb111be11af69e78cf708234cee306498ea96c511310a468a3910a4add4c09b7
SSDEEP 24576:nqnbSqj5xIOsCwhjCromwnn5s/rPPPPPPPPPPPPPPPPPPPPP:nqb1UCwCnW5s
TLSH
T17626B670A4984CDCFC46D55EC5F93818896CF22BA7CA2492711FCF26B301AC5AB8B5D7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a9ea7961681c2635909599912182850cdb43f706695370cc124a1877dd84793d

File Explorer

a9ea7961681c2635909599912182850cdb43f706695370cc124a1877dd84793d

.exe 4.4MB

a9ea7961681c2635909599912182850cdb43f706695370cc124a1877dd84793d

IMPHASH ab86015899302db1c21e2427f0e32594
SHA256 a9ea7961681c2635909599912182850cdb43f706695370cc124a1877dd84793d
MD5 8bbdb521b4996aabcfcfd718fef51b48
SHA1 f7521ea5bd1ff4012d1e0b36933778ddeae18687
SHA512 269e3d5e40e91a7d86a1f8ca82daf42606e7588960952cb958531416822a38a3fb111be11af69e78cf708234cee306498ea96c511310a468a3910a4add4c09b7
SSDEEP 24576:nqnbSqj5xIOsCwhjCromwnn5s/rPPPPPPPPPPPPPPPPPPPPP:nqb1UCwCnW5s
TLSH
T17626B670A4984CDCFC46D55EC5F93818896CF22BA7CA2492711FCF26B301AC5AB8B5D7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

174800

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

gdiplus

GdipGetImageEncodersSize GdipFree GdiplusStartup GdipCloneImage GdipDisposeImage GdipSaveImageToStream GdipGetImageEncoders GdipAlloc GdipCreateBitmapFromHBITMAP

bcrypt

BCryptOpenAlgorithmProvider BCryptGetProperty BCryptCloseAlgorithmProvider BCryptCreateHash BCryptHashData BCryptDestroyHash BCryptFinishHash

kernel32

CreateMutexW LocalFree GetStartupInfoW IsDebuggerPresent InitializeSListHead GetSystemTimeAsFileTime QueryPerformanceCounter IsProcessorFeaturePresent GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCurrentThreadId CreateDirectoryW CreateFileW WriteFile GetTempPathW CloseHandle GetLastError GetModuleHandleW GetProcAddress LoadResource LockResource SizeofResource FindResourceW LoadLibraryW GetEnvironmentVariableW GetCurrentDirectoryW DeleteFileW FileTimeToLocalFileTime FindClose FindFirstFileW FindNextFileW GetFileAttributesW GetFileSizeEx GetLogicalDriveStringsW ReadFile RemoveDirectoryW SetHandleInformation PeekNamedPipe WaitForSingleObject GetCurrentProcessId TerminateProcess OpenProcess GetLocalTime GetTickCount64 GetModuleFileNameW GetPrivateProfileStringW CopyFileW MoveFileW GetComputerNameW FileTimeToSystemTime MultiByteToWideChar WideCharToMultiByte CreateToolhelp32Snapshot Process32FirstW Process32NextW K32GetProcessMemoryInfo Sleep

shell32

ShellExecuteW

ole32

CoCreateInstance CoInitializeEx CoUninitialize CreateStreamOnHGlobal

oleaut32

VariantClear VariantInit SysFreeString SysAllocString

msvcp140

?_Xbad_function_call@std@@YAXXZ _Query_perf_counter ?_Throw_Cpp_error@std@@YAXH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach _Query_perf_frequency _Xtime_get_ticks ?_Xout_of_range@std@@YAXPEBD@Z ?_Xlength_error@std@@YAXPEBD@Z

winhttp

WinHttpQueryHeaders

vcruntime140

_CxxThrowException __std_exception_destroy __std_exception_copy memcpy memmove memset wcschr wcsrchr memcmp __C_specific_handler __current_exception __current_exception_context __std_terminate

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-runtime-l1-1-0

_set_app_type terminate _configure_wide_argv _initialize_wide_environment _get_wide_winmain_command_line _initterm _initterm_e exit _exit _crt_atexit _cexit _c_exit _register_thread_local_exe_atexit_callback _beginthreadex _invoke_watson _seh_filter_exe _initialize_onexit_table _register_onexit_function

api-ms-win-crt-string-l1-1-0

towlower iswspace wcslen wcscmp wcscat_s

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vswprintf_s _set_fmode __p__commode __stdio_common_vsnprintf_s

api-ms-win-crt-convert-l1-1-0

wcstol wcstoul _wtoi

api-ms-win-crt-heap-l1-1-0

malloc _set_new_mode free _callnewh

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

a9ea7961681c2635909599912182850cdb43f706695370cc124a1877dd84793d

gdiplus

bcrypt

kernel32

shell32

ole32

oleaut32

msvcp140

winhttp

vcruntime140

vcruntime140_1

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic