a3b0385fe29cc95cb0f4b234ad34d51352a6a64673edc40607c301817d777863

Sharing

Copy URL Twitter E-mail

General

Target
a3b0385fe29cc95cb0f4b234ad34d51352a6a64673edc40607c301817d777863
Size 253KB
Sample261102-e3l7rsey6x
SHA256 a3b0385fe29cc95cb0f4b234ad34d51352a6a64673edc40607c301817d777863
MD5 319236e13afddf85d90cbd21d48eb84c
SHA1 abf98388b656353e3090212d056aebad94e3154a
SHA512 40d687393043296f17dd707d54d3ec7a4a12d5d6cc1d2e5e8b48b6354139cec4bd11219631f310367cd302a49064c9133d7cfa6680087b4ea44325ad5a19c81a
SSDEEP 3072:RMavcUNRO2lCq6rU1Sc6VuYGehd+N4XlAyEpK+qzpOI7tZ/Mltq:KaUGA2yUQtnGeIoOyEpCZZZ0rq
TLSH
T124446B03F69048F8D84AC07983569633A676F4894B21F6FF17A446212F6BFA0BF2D715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a3b0385fe29cc95cb0f4b234ad34d51352a6a64673edc40607c301817d777863

File Explorer

a3b0385fe29cc95cb0f4b234ad34d51352a6a64673edc40607c301817d777863

.exe 253KB

a3b0385fe29cc95cb0f4b234ad34d51352a6a64673edc40607c301817d777863

IMPHASH 522f833dd23b22d2ff2878daf0de5b36
SHA256 a3b0385fe29cc95cb0f4b234ad34d51352a6a64673edc40607c301817d777863
MD5 319236e13afddf85d90cbd21d48eb84c
SHA1 abf98388b656353e3090212d056aebad94e3154a
SHA512 40d687393043296f17dd707d54d3ec7a4a12d5d6cc1d2e5e8b48b6354139cec4bd11219631f310367cd302a49064c9133d7cfa6680087b4ea44325ad5a19c81a
SSDEEP 3072:RMavcUNRO2lCq6rU1Sc6VuYGehd+N4XlAyEpK+qzpOI7tZ/Mltq:KaUGA2yUQtnGeIoOyEpCZZZ0rq
TLSH
T124446B03F69048F8D84AC07983569633A676F4894B21F6FF17A446212F6BFA0BF2D715
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

192620

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

app_worker.pdb

kernel32

GetModuleHandleA HeapAlloc RtlVirtualUnwind CloseHandle CreateProcessW HeapReAlloc HeapFree GetProcessHeap GetCurrentThread SetThreadStackGuarantee WideCharToMultiByte ReleaseMutex CreateMutexA GetCurrentProcessId lstrlenW GetProcAddress LoadLibraryA WaitForSingleObjectEx RtlLookupFunctionEntry GetCurrentProcess RtlCaptureContext SetLastError GetLastError GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetModuleHandleW VirtualQuery SetFilePointerEx ReadFile WaitForSingleObject CreatePipe MultiByteToWideChar SystemTimeToTzSpecificLocalTime FileTimeToSystemTime WriteFile FindClose FindNextFileW FindFirstFileW GetFileSizeEx CreateFileW GetFileAttributesW AddVectoredExceptionHandler SetCurrentDirectoryW WriteConsoleW GetConsoleOutputCP GetConsoleMode GetStdHandle GetEnvironmentVariableW QueryPerformanceCounter GetCurrentDirectoryW

winhttp

WinHttpReadData WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpSetOption WinHttpAddRequestHeaders WinHttpSendRequest WinHttpReceiveResponse WinHttpCloseHandle WinHttpSetStatusCallback WinHttpOpenRequest WinHttpConnect WinHttpOpen

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

ntdll

RtlNtStatusToDosError NtWriteFile

vcruntime140

__current_exception __current_exception_context memset __CxxFrameHandler3 memcpy __C_specific_handler memcmp memmove

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment _get_initial_narrow_environment _set_app_type _configure_narrow_argv _seh_filter_exe _initterm _register_onexit_function _initterm_e exit _exit terminate __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _initialize_onexit_table _crt_atexit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

a3b0385fe29cc95cb0f4b234ad34d51352a6a64673edc40607c301817d777863

kernel32

winhttp

api-ms-win-core-synch-l1-2-0

ntdll

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic