f2466cfef92d690e45ad0291c533d8628a46d536708dc4c624f2155602118747

General

Target
f2466cfef92d690e45ad0291c533d8628a46d536708dc4c624f2155602118747
Size 80KB
Sample261102-d2p2last4j
SHA256 f2466cfef92d690e45ad0291c533d8628a46d536708dc4c624f2155602118747
MD5 a30883ca6a26bf99f57b0ea201c5690c
SHA1 b0a5e4c40adcf7a3a61c82e8bcddf6b3b991c3c6
SHA512 e61fd6dbca6a376641d250629cf0feafad53be4774d053c2267413451511e8ccad38b4b703d05971bafd41535b35e98d4c0ad872e27b650e7acd023ad63604e0
SSDEEP 1536:43Rj3UUbdQKcpDV1FuErZVI0gwKDrUkx3qgVP+DMLxyKm2x:ij3UK6JV3uErZy46ok9uM7z
TLSH
T13383AD13E6A690EDD06EC179C37B2626F3B5F4848622238F67A153011E29F64FF1E794
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f2466cfef92d690e45ad0291c533d8628a46d536708dc4c624f2155602118747

File Explorer

f2466cfef92d690e45ad0291c533d8628a46d536708dc4c624f2155602118747

.exe 80KB

f2466cfef92d690e45ad0291c533d8628a46d536708dc4c624f2155602118747

IMPHASH fa749e3193ee75e1bafe4b8fe6490320
SHA256 f2466cfef92d690e45ad0291c533d8628a46d536708dc4c624f2155602118747
MD5 a30883ca6a26bf99f57b0ea201c5690c
SHA1 b0a5e4c40adcf7a3a61c82e8bcddf6b3b991c3c6
SHA512 e61fd6dbca6a376641d250629cf0feafad53be4774d053c2267413451511e8ccad38b4b703d05971bafd41535b35e98d4c0ad872e27b650e7acd023ad63604e0
SSDEEP 1536:43Rj3UUbdQKcpDV1FuErZVI0gwKDrUkx3qgVP+DMLxyKm2x:ij3UK6JV3uErZy46ok9uM7z
TLSH
T13383AD13E6A690EDD06EC179C37B2626F3B5F4848622238F67A153011E29F64FF1E794
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

57232

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dog_agent_exe.pdb

kernel32

SetLastError GetProcAddress GetModuleHandleA HeapAlloc HeapFree IsProcessorFeaturePresent GetModuleHandleW WaitForSingleObject GetCurrentThreadId GetLastError VirtualQuery HeapReAlloc AddVectoredExceptionHandler GetProcessHeap MultiByteToWideChar GetCurrentThread SetThreadStackGuarantee GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStdHandle GetConsoleMode GetConsoleOutputCP WriteConsoleW QueryPerformanceCounter

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

ntdll

NtWriteFile RtlNtStatusToDosError

vcruntime140

__current_exception __current_exception_context __C_specific_handler

api-ms-win-crt-runtime-l1-1-0

__p___argc _c_exit _register_thread_local_exe_atexit_callback _initialize_onexit_table _register_onexit_function _exit _crt_atexit terminate __p___argv _seh_filter_exe _set_app_type _cexit _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

f2466cfef92d690e45ad0291c533d8628a46d536708dc4c624f2155602118747

kernel32

api-ms-win-core-synch-l1-2-0

ntdll

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic