c6d94e3d489d87fa30ba084cc9243e126de48b3dc4b89e950d98b87bfdf3a342

General

Target
c6d94e3d489d87fa30ba084cc9243e126de48b3dc4b89e950d98b87bfdf3a342
Size 99KB
Sample261102-d2216aew8z
SHA256 c6d94e3d489d87fa30ba084cc9243e126de48b3dc4b89e950d98b87bfdf3a342
MD5 f6b0bf5d2a8aba59990ff7772e0128b7
SHA1 86ea2730aa0c718ead1ded622f3394f028e53ed8
SHA512 065250649a3b53c17703f0216477a3bdb70a03a3f121a1b1c5512b37267475b8add05e206d8a3d23b9716b5227e1820dd05c86c3a53b99b09b28967e71013c5d
SSDEEP 1536:iOp8EfTtbcxzxpUGSRfmrTCYdJI0gwKHrzusjaJiSg06aKmN/jNFyq:xp8EklmG6fmrWYd24evuirG7iq
TLSH
T186A3AE03E59550FAD06DC2328377B626F3B6F0958722236F13A096216E66B687F1F3D4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c6d94e3d489d87fa30ba084cc9243e126de48b3dc4b89e950d98b87bfdf3a342

File Explorer

c6d94e3d489d87fa30ba084cc9243e126de48b3dc4b89e950d98b87bfdf3a342

.exe 99KB

c6d94e3d489d87fa30ba084cc9243e126de48b3dc4b89e950d98b87bfdf3a342

IMPHASH fa749e3193ee75e1bafe4b8fe6490320
SHA256 c6d94e3d489d87fa30ba084cc9243e126de48b3dc4b89e950d98b87bfdf3a342
MD5 f6b0bf5d2a8aba59990ff7772e0128b7
SHA1 86ea2730aa0c718ead1ded622f3394f028e53ed8
SHA512 065250649a3b53c17703f0216477a3bdb70a03a3f121a1b1c5512b37267475b8add05e206d8a3d23b9716b5227e1820dd05c86c3a53b99b09b28967e71013c5d
SSDEEP 1536:iOp8EfTtbcxzxpUGSRfmrTCYdJI0gwKHrzusjaJiSg06aKmN/jNFyq:xp8EklmG6fmrWYd24evuirG7iq
TLSH
T186A3AE03E59550FAD06DC2328377B626F3B6F0958722236F13A096216E66B687F1F3D4
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

63280

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dog_agent_exe.pdb

kernel32

SetLastError GetProcAddress GetModuleHandleA HeapAlloc HeapFree IsProcessorFeaturePresent GetModuleHandleW WaitForSingleObject GetCurrentThreadId GetLastError VirtualQuery HeapReAlloc AddVectoredExceptionHandler GetProcessHeap MultiByteToWideChar GetCurrentThread SetThreadStackGuarantee GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStdHandle GetConsoleMode GetConsoleOutputCP WriteConsoleW QueryPerformanceCounter

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

ntdll

NtWriteFile RtlNtStatusToDosError

vcruntime140

__current_exception __current_exception_context __C_specific_handler

api-ms-win-crt-runtime-l1-1-0

__p___argc _c_exit _register_thread_local_exe_atexit_callback _initialize_onexit_table _register_onexit_function _exit _crt_atexit terminate __p___argv _seh_filter_exe _set_app_type _cexit _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

c6d94e3d489d87fa30ba084cc9243e126de48b3dc4b89e950d98b87bfdf3a342

kernel32

api-ms-win-core-synch-l1-2-0

ntdll

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic