8c9a1e6494f5b785fe8ef557ef51c78310d8d93516e690e546b48fd828f5dbbc

General

Target
8c9a1e6494f5b785fe8ef557ef51c78310d8d93516e690e546b48fd828f5dbbc
Size 170KB
Sample261030-e57w9av1ax
SHA256 8c9a1e6494f5b785fe8ef557ef51c78310d8d93516e690e546b48fd828f5dbbc
MD5 fb59376dec3fd0c803a7e3593a0d3b97
SHA1 16d29cc9e5adc68dc45fc72cf8e3b2605306117d
SHA512 bf7d180396a3f3239e8ccb11ceca6979f99e13af9a57a9f95ecc7c0bd6e7925b9a0bb09534db3ca78052023519e136e0e161c3c0f21c72d43da7a87ce9bfabaa
SSDEEP 3072:+WJfI6LA1fX58xKEQjWYAeTJTGYmsw+6Y57dLDbpuiZ:vypNpsC+sw56Z
TLSH
T199047D95B3A911F6E1A3823CC9954B06F77278260720DBEF03A44775AF272D19D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8c9a1e6494f5b785fe8ef557ef51c78310d8d93516e690e546b48fd828f5dbbc

File Explorer

8c9a1e6494f5b785fe8ef557ef51c78310d8d93516e690e546b48fd828f5dbbc

.exe 170KB

8c9a1e6494f5b785fe8ef557ef51c78310d8d93516e690e546b48fd828f5dbbc

IMPHASH 64115a6502b49ed8d1c8e39517f4992a
SHA256 8c9a1e6494f5b785fe8ef557ef51c78310d8d93516e690e546b48fd828f5dbbc
MD5 fb59376dec3fd0c803a7e3593a0d3b97
SHA1 16d29cc9e5adc68dc45fc72cf8e3b2605306117d
SHA512 bf7d180396a3f3239e8ccb11ceca6979f99e13af9a57a9f95ecc7c0bd6e7925b9a0bb09534db3ca78052023519e136e0e161c3c0f21c72d43da7a87ce9bfabaa
SSDEEP 3072:+WJfI6LA1fX58xKEQjWYAeTJTGYmsw+6Y57dLDbpuiZ:vypNpsC+sw56Z
TLSH
T199047D95B3A911F6E1A3823CC9954B06F77278260720DBEF03A44775AF272D19D3EB21
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

9200

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ws2_32

closesocket WSAGetLastError WSACleanup WSAStartup socket sendto recvfrom htons htonl bind

iphlpapi

GetAdaptersAddresses

advapi32

CreateServiceA StartServiceA QueryServiceStatus OpenServiceA OpenSCManagerA DeleteService RegOpenKeyExA ControlService CloseServiceHandle RegCloseKey

kernel32

GetConsoleMode GetFileSizeEx SetFilePointerEx CreateFileW HeapSize HeapReAlloc ReadFile ReadConsoleW SetEndOfFile WriteConsoleW RtlPcToFileHeader CloseHandle GetLastError WaitForSingleObject Sleep GetCurrentProcessId CreateThread CreateRemoteThread OpenProcess VirtualAlloc VirtualProtect VirtualFree VirtualAllocEx VirtualProtectEx WriteProcessMemory VirtualFreeEx QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetConsoleOutputCP RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlLookupFunctionEntry EncodePointer RaiseException GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetProcAddress GetCommandLineA GetCommandLineW IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree LoadLibraryExW CompareStringW LCMapStringW GetFileType FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW GetProcessHeap FlushFileBuffers

Name

.text

Size

111KB

Virtual Size

110KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

47KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

8c9a1e6494f5b785fe8ef557ef51c78310d8d93516e690e546b48fd828f5dbbc

ws2_32

iphlpapi

advapi32

kernel32

generic