9ddb2babdd893d02dab6dc5c6d3b485290e69d606027e26b84e06ad77d3a3361

Sharing

Copy URL Twitter E-mail

General

Target
9ddb2babdd893d02dab6dc5c6d3b485290e69d606027e26b84e06ad77d3a3361
Size 223KB
Sample261102-d3dd7aew9t
SHA256 9ddb2babdd893d02dab6dc5c6d3b485290e69d606027e26b84e06ad77d3a3361
MD5 125563beb26e4d1960ef0340204e6d6f
SHA1 455b46de777fe319e3d2c4c57db4778c282ec13b
SHA512 15be0748eb6355250f9ac1ec52bf5e16d96ebc00628bc2de04416638f158bb9fbf4febb7c8250150b8ba24438fee1d61f92c8857a526e13885c1b60370e26450
SSDEEP 3072:Qwba4PbSM6aFKKhc//scxuF4Yxs12ybZ1tp3ZQ+z4HCyazrms7Ca2MUy:lPSM1Kwcx8MZQ+z4zGv9jUy
TLSH
T173248D03E9968CF8D41EC57583679233E5B5F889CA35B31F47E44A122E27BA0BB1D394
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9ddb2babdd893d02dab6dc5c6d3b485290e69d606027e26b84e06ad77d3a3361

File Explorer

9ddb2babdd893d02dab6dc5c6d3b485290e69d606027e26b84e06ad77d3a3361

.exe 223KB

9ddb2babdd893d02dab6dc5c6d3b485290e69d606027e26b84e06ad77d3a3361

IMPHASH ff1487cdc8a1de61304a7ad80eb44f71
SHA256 9ddb2babdd893d02dab6dc5c6d3b485290e69d606027e26b84e06ad77d3a3361
MD5 125563beb26e4d1960ef0340204e6d6f
SHA1 455b46de777fe319e3d2c4c57db4778c282ec13b
SHA512 15be0748eb6355250f9ac1ec52bf5e16d96ebc00628bc2de04416638f158bb9fbf4febb7c8250150b8ba24438fee1d61f92c8857a526e13885c1b60370e26450
SSDEEP 3072:Qwba4PbSM6aFKKhc//scxuF4Yxs12ybZ1tp3ZQ+z4HCyazrms7Ca2MUy:lPSM1Kwcx8MZQ+z4zGv9jUy
TLSH
T173248D03E9968CF8D41EC57583679233E5B5F889CA35B31F47E44A122E27BA0BB1D394
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

174800

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dog_agent_exe.pdb

kernel32

CreateProcessW CloseHandle GetFileAttributesW CreateFileW FindClose GetFileSizeEx FindFirstFileW FindNextFileW IsProcessorFeaturePresent SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter GetModuleHandleA HeapAlloc HeapFree GetModuleHandleW GetCurrentThreadId GetLastError GetProcessHeap VirtualQuery SetFilePointerEx ReadFile WaitForSingleObject CreatePipe MultiByteToWideChar SystemTimeToTzSpecificLocalTime GetProcAddress FileTimeToSystemTime HeapReAlloc WriteFile GetCurrentThread GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter AddVectoredExceptionHandler QueryPerformanceCounter SetCurrentDirectoryW GetStdHandle GetConsoleMode GetConsoleOutputCP WriteConsoleW GetCurrentDirectoryW

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

ntdll

RtlNtStatusToDosError NtWriteFile

vcruntime140

__current_exception __current_exception_context __C_specific_handler

api-ms-win-crt-runtime-l1-1-0

_crt_atexit terminate _initialize_onexit_table _c_exit _cexit __p___argv __p___argc _exit exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _register_onexit_function _set_app_type _seh_filter_exe _register_thread_local_exe_atexit_callback _configure_narrow_argv

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

9ddb2babdd893d02dab6dc5c6d3b485290e69d606027e26b84e06ad77d3a3361

kernel32

api-ms-win-core-synch-l1-2-0

ntdll

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic