b210001226c8fe41dfa544cedbe13f1cd943809c99898c0adbfa1a12f8731d42

General

Target
b210001226c8fe41dfa544cedbe13f1cd943809c99898c0adbfa1a12f8731d42
Size 125KB
Sample261102-dz674ast3m
SHA256 b210001226c8fe41dfa544cedbe13f1cd943809c99898c0adbfa1a12f8731d42
MD5 34c99f3d71567edee8eb80aa26df29e3
SHA1 2b550a18f053afa06b74ab99f003168a7bef439b
SHA512 df6c6c01e82b609cc7a2883d02c718257cf860fb5c0e5b9e00e49224777498c0e2d9d2968ed288f2a7bbefb635dc049630e9e86d36cc36ab8c4b28e26b205321
SSDEEP 1536:p5zUV++qmMEocRK2CkMpHVrhSSpixJapzI0gwKrLbasCcKSVq7eTuKmu/jNF4Ja:7zUlHBwDdV9SSp+YpU4OfaQMql7p
TLSH
T17DC39D03F5A590F9D05DC27183BBA132E376F4998A35339F17B056216E66BA07F1E388
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b210001226c8fe41dfa544cedbe13f1cd943809c99898c0adbfa1a12f8731d42

File Explorer

b210001226c8fe41dfa544cedbe13f1cd943809c99898c0adbfa1a12f8731d42

.exe 125KB

b210001226c8fe41dfa544cedbe13f1cd943809c99898c0adbfa1a12f8731d42

IMPHASH fa749e3193ee75e1bafe4b8fe6490320
SHA256 b210001226c8fe41dfa544cedbe13f1cd943809c99898c0adbfa1a12f8731d42
MD5 34c99f3d71567edee8eb80aa26df29e3
SHA1 2b550a18f053afa06b74ab99f003168a7bef439b
SHA512 df6c6c01e82b609cc7a2883d02c718257cf860fb5c0e5b9e00e49224777498c0e2d9d2968ed288f2a7bbefb635dc049630e9e86d36cc36ab8c4b28e26b205321
SSDEEP 1536:p5zUV++qmMEocRK2CkMpHVrhSSpixJapzI0gwKrLbasCcKSVq7eTuKmu/jNF4Ja:7zUlHBwDdV9SSp+YpU4OfaQMql7p
TLSH
T17DC39D03F5A590F9D05DC27183BBA132E376F4998A35339F17B056216E66BA07F1E388
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

85728

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dog_agent_exe.pdb

kernel32

SetLastError GetProcAddress GetModuleHandleA HeapAlloc HeapFree IsProcessorFeaturePresent GetModuleHandleW WaitForSingleObject GetCurrentThreadId GetLastError VirtualQuery HeapReAlloc AddVectoredExceptionHandler GetProcessHeap MultiByteToWideChar GetCurrentThread SetThreadStackGuarantee GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStdHandle GetConsoleMode GetConsoleOutputCP WriteConsoleW QueryPerformanceCounter

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

ntdll

NtWriteFile RtlNtStatusToDosError

vcruntime140

__current_exception __current_exception_context __C_specific_handler

api-ms-win-crt-runtime-l1-1-0

__p___argc _c_exit _register_thread_local_exe_atexit_callback _initialize_onexit_table _register_onexit_function _exit _crt_atexit terminate __p___argv _seh_filter_exe _set_app_type _cexit _configure_narrow_argv _initialize_narrow_environment _get_initial_narrow_environment _initterm _initterm_e exit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

b210001226c8fe41dfa544cedbe13f1cd943809c99898c0adbfa1a12f8731d42

kernel32

api-ms-win-core-synch-l1-2-0

ntdll

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic