882fc8f981b34f939d5b9749604724c414e9921ef2a449fa8320c2530f2d8bc6

Sharing

Copy URL Twitter E-mail

General

Target
882fc8f981b34f939d5b9749604724c414e9921ef2a449fa8320c2530f2d8bc6
Size 101KB
Sample261102-e7ecqaey8y
SHA256 882fc8f981b34f939d5b9749604724c414e9921ef2a449fa8320c2530f2d8bc6
MD5 f57686df9ec5dd80c43d6a2025e848c7
SHA1 e163be0125593e14427dc4f1def1cb5f70501902
SHA512 62ad48e36e635078f2c44494f81158f199459873dd4159be30b5412860c3717ba8020de8632c4e2684f3b7856c51b5c227ae2120ee0eefeb34e9a5b52f1500f6
SSDEEP 1536:hJxdZd3NV0uDpKB+lpDrOtahmI0gwKhrn8Yzz0cwH+xVWKmB/jNFVk:DxdZZVQBqpDr2ahP4wL8Ykqa7l
TLSH
T185A3BE03F99590F9D06DC171C37BA222E3B6F4998631639F07E046116E2AB687F1F798
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
882fc8f981b34f939d5b9749604724c414e9921ef2a449fa8320c2530f2d8bc6

File Explorer

882fc8f981b34f939d5b9749604724c414e9921ef2a449fa8320c2530f2d8bc6

.exe 101KB

882fc8f981b34f939d5b9749604724c414e9921ef2a449fa8320c2530f2d8bc6

IMPHASH f99fef483f0f86a8844a5f37302dda9f
SHA256 882fc8f981b34f939d5b9749604724c414e9921ef2a449fa8320c2530f2d8bc6
MD5 f57686df9ec5dd80c43d6a2025e848c7
SHA1 e163be0125593e14427dc4f1def1cb5f70501902
SHA512 62ad48e36e635078f2c44494f81158f199459873dd4159be30b5412860c3717ba8020de8632c4e2684f3b7856c51b5c227ae2120ee0eefeb34e9a5b52f1500f6
SSDEEP 1536:hJxdZd3NV0uDpKB+lpDrOtahmI0gwKhrn8Yzz0cwH+xVWKmB/jNFVk:DxdZZVQBqpDr2ahP4wL8Ykqa7l
TLSH
T185A3BE03F99590F9D06DC171C37BA222E3B6F4998631639F07E046116E2AB687F1F798
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

63984

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

dog_agent_exe.pdb

kernel32

GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry AddVectoredExceptionHandler RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetThreadStackGuarantee GetProcAddress GetCurrentThread GetModuleHandleA HeapAlloc HeapFree MultiByteToWideChar SetUnhandledExceptionFilter WaitForSingleObject GetCurrentThreadId SetLastError GetLastError VirtualQuery HeapReAlloc GetProcessHeap IsProcessorFeaturePresent GetModuleHandleW GetCurrentProcessId QueryPerformanceCounter GetConsoleMode GetConsoleOutputCP WriteConsoleW GetStdHandle

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpSendRequest WinHttpReceiveResponse WinHttpSetStatusCallback WinHttpOpenRequest WinHttpQueryDataAvailable WinHttpAddRequestHeaders WinHttpOpen WinHttpSetOption WinHttpReadData WinHttpQueryHeaders

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll WaitOnAddress

ntdll

RtlNtStatusToDosError NtWriteFile

vcruntime140

__current_exception __current_exception_context __C_specific_handler

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _register_thread_local_exe_atexit_callback _c_exit __p___argv _register_onexit_function _exit exit _initterm_e _initterm terminate _get_initial_narrow_environment _configure_narrow_argv __p___argc _set_app_type _seh_filter_exe _initialize_onexit_table _cexit _initialize_narrow_environment

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

882fc8f981b34f939d5b9749604724c414e9921ef2a449fa8320c2530f2d8bc6

kernel32

winhttp

api-ms-win-core-synch-l1-2-0

ntdll

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic