04facb300347f4d41633d6175965c8c5f2d83a87f1e12fedeb685daabe28f81b

General

Target
04facb300347f4d41633d6175965c8c5f2d83a87f1e12fedeb685daabe28f81b
Size 76KB
Sample261102-dz674aew7x
SHA256 04facb300347f4d41633d6175965c8c5f2d83a87f1e12fedeb685daabe28f81b
MD5 2022456340a338271372706e33f07ea2
SHA1 e640174538a8ebfc9c67624fda9e6f470c94875c
SHA512 449fb5af2fc7c473e3a873c7261d3bb513adc386fba1f06ab5fb1035419258a7a3ae686a1f8ce8645db5760280e53330d03cc46a942d67b67d37c96e36085800
SSDEEP 1536:okJ5j7Mx6p/G7xWJPlzI0gwKcrdD7BJnkoJ/3eKm34nz3:7J5jhxGVWJPlU4hpDvVKuz
TLSH
T1B573AE03AA9A90FDD06DC172837B2A37F3B5F4988A21234F13B467215E25E746F1E794
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
04facb300347f4d41633d6175965c8c5f2d83a87f1e12fedeb685daabe28f81b

File Explorer

04facb300347f4d41633d6175965c8c5f2d83a87f1e12fedeb685daabe28f81b

.exe 76KB

04facb300347f4d41633d6175965c8c5f2d83a87f1e12fedeb685daabe28f81b

IMPHASH fa749e3193ee75e1bafe4b8fe6490320
SHA256 04facb300347f4d41633d6175965c8c5f2d83a87f1e12fedeb685daabe28f81b
MD5 2022456340a338271372706e33f07ea2
SHA1 e640174538a8ebfc9c67624fda9e6f470c94875c
SHA512 449fb5af2fc7c473e3a873c7261d3bb513adc386fba1f06ab5fb1035419258a7a3ae686a1f8ce8645db5760280e53330d03cc46a942d67b67d37c96e36085800
SSDEEP 1536:okJ5j7Mx6p/G7xWJPlzI0gwKcrdD7BJnkoJ/3eKm34nz3:7J5jhxGVWJPlU4hpDvVKuz
TLSH
T1B573AE03AA9A90FDD06DC172837B2A37F3B5F4988A21234F13B467215E25E746F1E794
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

53232

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dog_agent_exe.pdb

kernel32

SetLastError GetProcAddress GetModuleHandleA HeapAlloc HeapFree IsProcessorFeaturePresent GetModuleHandleW WaitForSingleObject GetCurrentThreadId GetLastError VirtualQuery HeapReAlloc AddVectoredExceptionHandler GetProcessHeap MultiByteToWideChar GetCurrentThread SetThreadStackGuarantee GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStdHandle GetConsoleMode GetConsoleOutputCP WriteConsoleW QueryPerformanceCounter

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

ntdll

NtWriteFile RtlNtStatusToDosError

vcruntime140

__current_exception __current_exception_context __C_specific_handler

api-ms-win-crt-runtime-l1-1-0

__p___argc _c_exit _register_thread_local_exe_atexit_callback _initialize_onexit_table _register_onexit_function _exit _crt_atexit terminate __p___argv _seh_filter_exe _set_app_type _cexit _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

04facb300347f4d41633d6175965c8c5f2d83a87f1e12fedeb685daabe28f81b

kernel32

api-ms-win-core-synch-l1-2-0

ntdll

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic