18ea337af76858644fc72b07024dd20c71890ae1b5737f792a3380472058c9a3

Sharing

Copy URL Twitter E-mail

General

Target
18ea337af76858644fc72b07024dd20c71890ae1b5737f792a3380472058c9a3
Size 600KB
Sample261102-cxtzba115r
SHA256 18ea337af76858644fc72b07024dd20c71890ae1b5737f792a3380472058c9a3
MD5 c9ce24464112001ed8dfddcbd3560076
SHA1 5b2ba59872f522d074af57baedb275f800a39c4c
SHA512 78283dc75cb9e4a45644abb74b71a8014d8b14693bea084ee6026953c0b9f33f5bb6084acc78894e085fe694ebc6d1deb894946f796e35022e890fe2dcbadb8d
SSDEEP 12288:zjrOofHmYCAtXAqP8Y25sBymy2SG9mhUqTz:/rtfHmYCAtXAqP8Y25sBy/jN
TLSH
T177D45A13F29644E8D05DC1B5831A9633BB76B8CA0A3176FF47D466312E69EA06F3C718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
18ea337af76858644fc72b07024dd20c71890ae1b5737f792a3380472058c9a3

File Explorer

18ea337af76858644fc72b07024dd20c71890ae1b5737f792a3380472058c9a3

.exe 600KB

18ea337af76858644fc72b07024dd20c71890ae1b5737f792a3380472058c9a3

IMPHASH 6d51535588c7db25f2f8ad7235df154b
SHA256 18ea337af76858644fc72b07024dd20c71890ae1b5737f792a3380472058c9a3
MD5 c9ce24464112001ed8dfddcbd3560076
SHA1 5b2ba59872f522d074af57baedb275f800a39c4c
SHA512 78283dc75cb9e4a45644abb74b71a8014d8b14693bea084ee6026953c0b9f33f5bb6084acc78894e085fe694ebc6d1deb894946f796e35022e890fe2dcbadb8d
SSDEEP 12288:zjrOofHmYCAtXAqP8Y25sBymy2SG9mhUqTz:/rtfHmYCAtXAqP8Y25sBy/jN
TLSH
T177D45A13F29644E8D05DC1B5831A9633BB76B8CA0A3176FF47D466312E69EA06F3C718
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

430208

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

LoadLibraryA GetCurrentProcess lstrlenW GetCurrentProcessId CreateMutexA WideCharToMultiByte GetProcessHeap GetEnvironmentVariableW HeapAlloc CreateDirectoryW WaitForSingleObjectEx CreateFileW SetFileInformationByHandle GetFileInformationByHandle GetFileInformationByHandleEx GetModuleHandleW RtlVirtualUnwind GetSystemTimeAsFileTime SwitchToThread GetFileType ExitProcess UnhandledExceptionFilter GetFullPathNameW WriteConsoleW GetConsoleOutputCP LocalFree SetUnhandledExceptionFilter CloseHandle GetConsoleScreenBufferInfo SetConsoleTextAttribute SetConsoleMode GetConsoleMode GetStdHandle RtlLookupFunctionEntry RtlCaptureContext GetCurrentThreadId MultiByteToWideChar InitializeSListHead FindNextFileW FindFirstFileExW GetCurrentDirectoryW FindClose CopyFileExW GetExitCodeProcess FlushInstructionCache CreateProcessW GetProcAddress GetModuleHandleA HeapFree GetLastError SetLastError GetCommandLineW GetModuleFileNameW WaitForSingleObject IsDebuggerPresent SetFilePointerEx GetSystemTimePreciseAsFileTime HeapReAlloc GetCurrentThread SetThreadStackGuarantee FormatMessageW AddVectoredExceptionHandler ReleaseMutex GetTimeZoneInformationForYear QueryPerformanceCounter IsProcessorFeaturePresent

ntdll

NtReadFile RtlNtStatusToDosError NtWriteFile NtOpenFile

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

advapi32

RegOpenKeyExW RegCloseKey RegQueryValueExW

crypt32

CryptUnprotectData

vcruntime140

__CxxFrameHandler3 memcmp memset memcpy __C_specific_handler __current_exception_context __current_exception memmove

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _set_app_type _register_onexit_function _initialize_onexit_table terminate _register_thread_local_exe_atexit_callback _c_exit _cexit __p___argv __p___argc _configure_narrow_argv _exit exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _seh_filter_exe

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

18ea337af76858644fc72b07024dd20c71890ae1b5737f792a3380472058c9a3

kernel32

ntdll

api-ms-win-core-synch-l1-2-0

advapi32

crypt32

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic