8b9a2fcc72021b954008f334d08cd652477b3651af6322269b0218119bf5652a

Sharing

Copy URL Twitter E-mail

General

Target
8b9a2fcc72021b954008f334d08cd652477b3651af6322269b0218119bf5652a
Size 262KB
Sample261102-e7bltsey8w
SHA256 8b9a2fcc72021b954008f334d08cd652477b3651af6322269b0218119bf5652a
MD5 61f62d6d095b927f9ee0a669ad9a9275
SHA1 2c7990598ff53365b56cdcd5c46c75db01e6cb03
SHA512 c24e32ce126bf3019b80e0ac352894594000112d4c7e5e29dc81c3b5d4f38f0abcc2bec556ab392e1246e764fa3a430ec3d5fa71bdf6b3b9d98f9248c052ddb3
SSDEEP 3072:I6oPnG9/lG1XLgLwrxOOePTzSynu7JJAJ4bhVzxywl59xreqne7ggk7cfdd:+Oz+/TeLG7NJAJ4P4e9x5eMgk7
TLSH
T136446C03F6905CB8D80AC07983569673A676F4894B21F6EF17A446212F2BFE0BF2D715
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8b9a2fcc72021b954008f334d08cd652477b3651af6322269b0218119bf5652a

File Explorer

8b9a2fcc72021b954008f334d08cd652477b3651af6322269b0218119bf5652a

.exe 262KB

8b9a2fcc72021b954008f334d08cd652477b3651af6322269b0218119bf5652a

IMPHASH ef4f3f2e6a5336cf0cf1a2c7413d3fff
SHA256 8b9a2fcc72021b954008f334d08cd652477b3651af6322269b0218119bf5652a
MD5 61f62d6d095b927f9ee0a669ad9a9275
SHA1 2c7990598ff53365b56cdcd5c46c75db01e6cb03
SHA512 c24e32ce126bf3019b80e0ac352894594000112d4c7e5e29dc81c3b5d4f38f0abcc2bec556ab392e1246e764fa3a430ec3d5fa71bdf6b3b9d98f9248c052ddb3
SSDEEP 3072:I6oPnG9/lG1XLgLwrxOOePTzSynu7JJAJ4bhVzxywl59xreqne7ggk7cfdd:+Oz+/TeLG7NJAJ4P4e9x5eMgk7
TLSH
T136446C03F6905CB8D80AC07983569673A676F4894B21F6EF17A446212F2BFE0BF2D715
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

201484

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dog_agent_exe.pdb

kernel32

GetModuleHandleA HeapAlloc RtlVirtualUnwind GetFileSizeEx CreateFileW GetFileAttributesW CloseHandle CreateProcessW GetCurrentThread SetThreadStackGuarantee WideCharToMultiByte ReleaseMutex CreateMutexA GetCurrentProcessId lstrlenW GetProcAddress LoadLibraryA WaitForSingleObjectEx RtlLookupFunctionEntry GetCurrentProcess RtlCaptureContext SetLastError GetLastError GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetModuleHandleW VirtualQuery HeapReAlloc HeapFree GetProcessHeap SetFilePointerEx ReadFile WaitForSingleObject CreatePipe MultiByteToWideChar SystemTimeToTzSpecificLocalTime FileTimeToSystemTime WriteFile FindClose FindNextFileW FindFirstFileW AddVectoredExceptionHandler SetCurrentDirectoryW WriteConsoleW GetConsoleOutputCP GetConsoleMode GetStdHandle GetEnvironmentVariableW QueryPerformanceCounter GetCurrentDirectoryW

winhttp

WinHttpReadData WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpSetOption WinHttpAddRequestHeaders WinHttpSendRequest WinHttpReceiveResponse WinHttpCloseHandle WinHttpSetStatusCallback WinHttpOpenRequest WinHttpConnect WinHttpOpen

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

ntdll

RtlNtStatusToDosError NtWriteFile

vcruntime140

__current_exception __current_exception_context memset __CxxFrameHandler3 memcpy __C_specific_handler memcmp memmove

api-ms-win-crt-string-l1-1-0

strlen

api-ms-win-crt-runtime-l1-1-0

_initialize_narrow_environment _get_initial_narrow_environment _set_app_type _configure_narrow_argv _seh_filter_exe _initterm _register_onexit_function _initterm_e exit _exit terminate __p___argc __p___argv _cexit _c_exit _register_thread_local_exe_atexit_callback _initialize_onexit_table _crt_atexit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

8b9a2fcc72021b954008f334d08cd652477b3651af6322269b0218119bf5652a

kernel32

winhttp

api-ms-win-core-synch-l1-2-0

ntdll

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic