a5a2cbdf113a73092ec49b9c38cdcbd4c6b75546e5143176d1ba1122c4ad20c0

Sharing

Copy URL Twitter E-mail

General

Target
a5a2cbdf113a73092ec49b9c38cdcbd4c6b75546e5143176d1ba1122c4ad20c0
Size 246KB
Sample261102-e69r8ssw5n
SHA256 a5a2cbdf113a73092ec49b9c38cdcbd4c6b75546e5143176d1ba1122c4ad20c0
MD5 dbc1d69718816ac5298ea67a539a6836
SHA1 5031e015b1f3c1ee401e615eeaa7cabf85d85db5
SHA512 0187a7af6bf6d50c4a6733fee1cd2acfd164534803f8e25a0d8c1d02b055378a11f442b3704e4e298d3fec99e0efa33143157a43cea66018c9189981533d5ca1
SSDEEP 3072:62vuUDsdCkxqkbv8qy5QeuzHbOf9LEQ8NWqfYYVVH6l7MHg7ziSmB:622GsdFxgqxzHbO1qwqfH/G4A7Z
TLSH
T1F8346C03F68188F8D85AC07983569673A572F8894B22F6FF17A446212E67FE07F2D714
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a5a2cbdf113a73092ec49b9c38cdcbd4c6b75546e5143176d1ba1122c4ad20c0

File Explorer

a5a2cbdf113a73092ec49b9c38cdcbd4c6b75546e5143176d1ba1122c4ad20c0

.exe 246KB

a5a2cbdf113a73092ec49b9c38cdcbd4c6b75546e5143176d1ba1122c4ad20c0

IMPHASH ef4f3f2e6a5336cf0cf1a2c7413d3fff
SHA256 a5a2cbdf113a73092ec49b9c38cdcbd4c6b75546e5143176d1ba1122c4ad20c0
MD5 dbc1d69718816ac5298ea67a539a6836
SHA1 5031e015b1f3c1ee401e615eeaa7cabf85d85db5
SHA512 0187a7af6bf6d50c4a6733fee1cd2acfd164534803f8e25a0d8c1d02b055378a11f442b3704e4e298d3fec99e0efa33143157a43cea66018c9189981533d5ca1
SSDEEP 3072:62vuUDsdCkxqkbv8qy5QeuzHbOf9LEQ8NWqfYYVVH6l7MHg7ziSmB:622GsdFxgqxzHbO1qwqfH/G4A7Z
TLSH
T1F8346C03F68188F8D85AC07983569673A572F8894B22F6FF17A446212E67FE07F2D714
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

186556

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dog_agent_exe.pdb

kernel32

GetModuleHandleA HeapAlloc RtlVirtualUnwind GetFileSizeEx CreateFileW GetFileAttributesW CloseHandle CreateProcessW GetCurrentThread SetThreadStackGuarantee WideCharToMultiByte ReleaseMutex CreateMutexA GetCurrentProcessId lstrlenW GetProcAddress LoadLibraryA WaitForSingleObjectEx RtlLookupFunctionEntry GetCurrentProcess RtlCaptureContext SetLastError GetLastError GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetModuleHandleW VirtualQuery HeapReAlloc HeapFree GetProcessHeap SetFilePointerEx ReadFile WaitForSingleObject CreatePipe MultiByteToWideChar SystemTimeToTzSpecificLocalTime FileTimeToSystemTime WriteFile FindClose FindNextFileW FindFirstFileW AddVectoredExceptionHandler SetCurrentDirectoryW WriteConsoleW GetConsoleOutputCP GetConsoleMode GetStdHandle GetEnvironmentVariableW QueryPerformanceCounter GetCurrentDirectoryW

winhttp

WinHttpReadData WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpSetOption WinHttpAddRequestHeaders WinHttpSendRequest WinHttpReceiveResponse WinHttpCloseHandle WinHttpSetStatusCallback WinHttpOpenRequest WinHttpConnect WinHttpOpen

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

ntdll

RtlNtStatusToDosError NtWriteFile

vcruntime140

__current_exception __current_exception_context memset __CxxFrameHandler3 memcpy __C_specific_handler memcmp memmove

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment _get_initial_narrow_environment _set_app_type _configure_narrow_argv _seh_filter_exe _initterm _register_onexit_function _initterm_e exit _exit terminate __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _initialize_onexit_table _crt_atexit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

a5a2cbdf113a73092ec49b9c38cdcbd4c6b75546e5143176d1ba1122c4ad20c0

kernel32

winhttp

api-ms-win-core-synch-l1-2-0

ntdll

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic