6e942c1eadc664998a480f06fd32743ea09b573fd957d4e3a5d7cf8fe0ce308a

Sharing

Copy URL Twitter E-mail

General

Target
6e942c1eadc664998a480f06fd32743ea09b573fd957d4e3a5d7cf8fe0ce308a
Size 221KB
Sample261102-cxtzba115q
SHA256 6e942c1eadc664998a480f06fd32743ea09b573fd957d4e3a5d7cf8fe0ce308a
MD5 7d0d634dd6cccfd04285e59af9eeb24e
SHA1 b45dff3f06d341a7d139579cc55f46d418de5583
SHA512 5e246b6ef6b287b2af7a41cfce1a134f003ebc292439fe2da765a9195e5a470db70d20d13851beab88fd032cd6cd9e30ce74c2533a3b0f4ae9feb37ebe49e358
SSDEEP 3072:+gUwEzOHA4/bcyjQxcta2ltWTp/67lR4kfL4xHm/CrdT7yM33p:fU9zOgUQxuqkfL48Aznp
TLSH
T117248D03E9958CF8D41EC5718327A233E5B5F8898635B36F47E44A122E67B60FB1D398
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6e942c1eadc664998a480f06fd32743ea09b573fd957d4e3a5d7cf8fe0ce308a

File Explorer

6e942c1eadc664998a480f06fd32743ea09b573fd957d4e3a5d7cf8fe0ce308a

.exe 221KB

6e942c1eadc664998a480f06fd32743ea09b573fd957d4e3a5d7cf8fe0ce308a

IMPHASH 0cbbe9cadecf866ca39d20c3e3ff98ce
SHA256 6e942c1eadc664998a480f06fd32743ea09b573fd957d4e3a5d7cf8fe0ce308a
MD5 7d0d634dd6cccfd04285e59af9eeb24e
SHA1 b45dff3f06d341a7d139579cc55f46d418de5583
SHA512 5e246b6ef6b287b2af7a41cfce1a134f003ebc292439fe2da765a9195e5a470db70d20d13851beab88fd032cd6cd9e30ce74c2533a3b0f4ae9feb37ebe49e358
SSDEEP 3072:+gUwEzOHA4/bcyjQxcta2ltWTp/67lR4kfL4xHm/CrdT7yM33p:fU9zOgUQxuqkfL48Aznp
TLSH
T117248D03E9958CF8D41EC5718327A233E5B5F8898635B36F47E44A122E67B60FB1D398
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

173264

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dog_agent_exe.pdb

kernel32

CreateProcessW CloseHandle GetFileSizeEx GetFileAttributesW CreateFileW IsProcessorFeaturePresent SetLastError GetProcAddress GetModuleHandleA HeapAlloc SetThreadStackGuarantee GetCurrentThread GetModuleHandleW GetCurrentThreadId GetLastError VirtualQuery SetFilePointerEx ReadFile GetProcessHeap WaitForSingleObject CreatePipe MultiByteToWideChar SystemTimeToTzSpecificLocalTime FileTimeToSystemTime WriteFile FindClose HeapFree FindNextFileW SetUnhandledExceptionFilter FindFirstFileW HeapReAlloc GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter AddVectoredExceptionHandler QueryPerformanceCounter SetCurrentDirectoryW GetStdHandle GetConsoleMode GetConsoleOutputCP WriteConsoleW GetCurrentDirectoryW

advapi32

RegCloseKey RegQueryValueExW RegOpenKeyExW

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

ntdll

RtlNtStatusToDosError NtWriteFile

vcruntime140

__current_exception __current_exception_context __C_specific_handler

api-ms-win-crt-runtime-l1-1-0

_register_onexit_function _c_exit __p___argv __p___argc _exit _initialize_onexit_table _register_thread_local_exe_atexit_callback _initterm _get_initial_narrow_environment _crt_atexit _initialize_narrow_environment _configure_narrow_argv exit _seh_filter_exe terminate _initterm_e _cexit _set_app_type

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

6e942c1eadc664998a480f06fd32743ea09b573fd957d4e3a5d7cf8fe0ce308a

kernel32

advapi32

api-ms-win-core-synch-l1-2-0

ntdll

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic