4956d9e2059f8c196a5a8ff2e08233dad0fef8aca45e915116f1b5ef00b6ba44

Sharing

Copy URL Twitter E-mail

General

Target
4956d9e2059f8c196a5a8ff2e08233dad0fef8aca45e915116f1b5ef00b6ba44
Size 251KB
Sample261102-e5gp3aey7v
SHA256 4956d9e2059f8c196a5a8ff2e08233dad0fef8aca45e915116f1b5ef00b6ba44
MD5 1f83a3aa4c2c722becc1d9d801d622ac
SHA1 6dc5037e8b2587cecc1d8fa51c4bb4c5ae37a6bd
SHA512 cf9699adb9d2a2cf3dfb5aad7fded04920c75ca2081ca45507c9abbfbf2e9133f8f48e529f4309284b8f939b648447887673f86ae15b9b8c0600c61b9a611d0d
SSDEEP 3072:EXpvPUtfMt8gaeR6X2uDXQNhJjrwIYxnNvoznl0z8ucDo7k7pKa+:MpHYMRG2NNhJaxNvozzuLQ74a+
TLSH
T15E445C03F69098F8D80AC07983569633A676F4894B21F6FF17A446212F6BFA07F2D715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4956d9e2059f8c196a5a8ff2e08233dad0fef8aca45e915116f1b5ef00b6ba44

File Explorer

4956d9e2059f8c196a5a8ff2e08233dad0fef8aca45e915116f1b5ef00b6ba44

.exe 251KB

4956d9e2059f8c196a5a8ff2e08233dad0fef8aca45e915116f1b5ef00b6ba44

IMPHASH d74d620a2ac08aaaa5c5da2c2ad0a748
SHA256 4956d9e2059f8c196a5a8ff2e08233dad0fef8aca45e915116f1b5ef00b6ba44
MD5 1f83a3aa4c2c722becc1d9d801d622ac
SHA1 6dc5037e8b2587cecc1d8fa51c4bb4c5ae37a6bd
SHA512 cf9699adb9d2a2cf3dfb5aad7fded04920c75ca2081ca45507c9abbfbf2e9133f8f48e529f4309284b8f939b648447887673f86ae15b9b8c0600c61b9a611d0d
SSDEEP 3072:EXpvPUtfMt8gaeR6X2uDXQNhJjrwIYxnNvoznl0z8ucDo7k7pKa+:MpHYMRG2NNhJaxNvozzuLQ74a+
TLSH
T15E445C03F69098F8D80AC07983569633A676F4894B21F6FF17A446212F6BFA07F2D715
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

191964

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dog_agent_exe.pdb

kernel32

GetModuleHandleA HeapAlloc GetFileSizeEx CreateFileW GetFileAttributesW CloseHandle CreateProcessW GetCurrentThread SetThreadStackGuarantee RtlVirtualUnwind WideCharToMultiByte ReleaseMutex CreateMutexA GetCurrentProcessId lstrlenW GetProcAddress LoadLibraryA WaitForSingleObjectEx RtlLookupFunctionEntry GetCurrentProcess RtlCaptureContext SetLastError GetLastError GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetModuleHandleW VirtualQuery HeapReAlloc HeapFree GetProcessHeap SetFilePointerEx ReadFile WaitForSingleObject CreatePipe MultiByteToWideChar SystemTimeToTzSpecificLocalTime FileTimeToSystemTime WriteFile FindClose FindNextFileW FindFirstFileW AddVectoredExceptionHandler SetCurrentDirectoryW WriteConsoleW GetConsoleOutputCP GetConsoleMode GetStdHandle GetEnvironmentVariableW QueryPerformanceCounter GetCurrentDirectoryW

winhttp

WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpReadData WinHttpAddRequestHeaders WinHttpSendRequest WinHttpReceiveResponse WinHttpCloseHandle WinHttpSetOption WinHttpOpenRequest WinHttpConnect WinHttpOpen

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

ntdll

RtlNtStatusToDosError NtWriteFile

vcruntime140

__CxxFrameHandler3 memcpy memcmp memmove memset __current_exception_context __current_exception __C_specific_handler

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

_get_initial_narrow_environment _initterm _initterm_e _set_app_type exit _seh_filter_exe _initialize_narrow_environment _exit __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _initialize_onexit_table _register_onexit_function _crt_atexit terminate _configure_narrow_argv

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

4956d9e2059f8c196a5a8ff2e08233dad0fef8aca45e915116f1b5ef00b6ba44

kernel32

winhttp

api-ms-win-core-synch-l1-2-0

ntdll

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic