1bc3faeb073db90f93a25aadaf0dc2ea6baf00a4349403d9274e2f27a8f7cab2

Sharing

Copy URL Twitter E-mail

General

Target
1bc3faeb073db90f93a25aadaf0dc2ea6baf00a4349403d9274e2f27a8f7cab2
Size 261KB
Sample261102-e7adrsea96
SHA256 1bc3faeb073db90f93a25aadaf0dc2ea6baf00a4349403d9274e2f27a8f7cab2
MD5 851c50ad8fb5a68dd42cdb494679f315
SHA1 0de8b867f4650c2b7851c3aa4c696494d46b2161
SHA512 2aa6beb219d100acdede54a5972c6cd78e82ce1c27e780852d775ec58b694403c590ebc5f35ee90f3d025d169067f4820430eb4d27712f15c0dddc9bdc274607
SSDEEP 3072:p07xvNAWYbCIYt4r8OatHwhwqQMhj4rhrc87lwNOff5pgW7tgugFIjr:WFekI8ptIQMhj45VAOf3zBgugFIj
TLSH
T10D447D03F6955CB8D84AC07883169673A672F4894B21F6EF17A446212F2BBE0BF2D715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1bc3faeb073db90f93a25aadaf0dc2ea6baf00a4349403d9274e2f27a8f7cab2

File Explorer

1bc3faeb073db90f93a25aadaf0dc2ea6baf00a4349403d9274e2f27a8f7cab2

.exe 261KB

1bc3faeb073db90f93a25aadaf0dc2ea6baf00a4349403d9274e2f27a8f7cab2

IMPHASH ef4f3f2e6a5336cf0cf1a2c7413d3fff
SHA256 1bc3faeb073db90f93a25aadaf0dc2ea6baf00a4349403d9274e2f27a8f7cab2
MD5 851c50ad8fb5a68dd42cdb494679f315
SHA1 0de8b867f4650c2b7851c3aa4c696494d46b2161
SHA512 2aa6beb219d100acdede54a5972c6cd78e82ce1c27e780852d775ec58b694403c590ebc5f35ee90f3d025d169067f4820430eb4d27712f15c0dddc9bdc274607
SSDEEP 3072:p07xvNAWYbCIYt4r8OatHwhwqQMhj4rhrc87lwNOff5pgW7tgugFIjr:WFekI8ptIQMhj45VAOf3zBgugFIj
TLSH
T10D447D03F6955CB8D84AC07883169673A672F4894B21F6EF17A446212F2BBE0BF2D715
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

200860

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dog_agent_exe.pdb

kernel32

GetModuleHandleA HeapAlloc RtlVirtualUnwind GetFileSizeEx CreateFileW GetFileAttributesW CloseHandle CreateProcessW GetCurrentThread SetThreadStackGuarantee WideCharToMultiByte ReleaseMutex CreateMutexA GetCurrentProcessId lstrlenW GetProcAddress LoadLibraryA WaitForSingleObjectEx RtlLookupFunctionEntry GetCurrentProcess RtlCaptureContext SetLastError GetLastError GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetModuleHandleW VirtualQuery HeapReAlloc HeapFree GetProcessHeap SetFilePointerEx ReadFile WaitForSingleObject CreatePipe MultiByteToWideChar SystemTimeToTzSpecificLocalTime FileTimeToSystemTime WriteFile FindClose FindNextFileW FindFirstFileW AddVectoredExceptionHandler SetCurrentDirectoryW WriteConsoleW GetConsoleOutputCP GetConsoleMode GetStdHandle GetEnvironmentVariableW QueryPerformanceCounter GetCurrentDirectoryW

winhttp

WinHttpReadData WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpSetOption WinHttpAddRequestHeaders WinHttpSendRequest WinHttpReceiveResponse WinHttpCloseHandle WinHttpSetStatusCallback WinHttpOpenRequest WinHttpConnect WinHttpOpen

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

ntdll

RtlNtStatusToDosError NtWriteFile

vcruntime140

__current_exception __current_exception_context memset __CxxFrameHandler3 memcpy __C_specific_handler memcmp memmove

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment _get_initial_narrow_environment _set_app_type _configure_narrow_argv _seh_filter_exe _initterm _register_onexit_function _initterm_e exit _exit terminate __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _initialize_onexit_table _crt_atexit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

1bc3faeb073db90f93a25aadaf0dc2ea6baf00a4349403d9274e2f27a8f7cab2

kernel32

winhttp

api-ms-win-core-synch-l1-2-0

ntdll

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic