e883823ab4a4e07f275dc9a4d30621170b85f860455894a8c8d3c8c9db87a04f

Sharing

Copy URL Twitter E-mail

General

Target
e883823ab4a4e07f275dc9a4d30621170b85f860455894a8c8d3c8c9db87a04f
Size 127KB
Sample261102-kee2fagt2x
SHA256 e883823ab4a4e07f275dc9a4d30621170b85f860455894a8c8d3c8c9db87a04f
MD5 28fc4702ec83f1a063a71aed52c513ef
SHA1 8a5f297a58f5379a7a7da91689935ea6c73fa089
SHA512 b442e080c86a589517a87d4c497386e9f44aaec34d224a0159de21aa5fc5cc6453e9d88a0705d87483d449414159c5f69c85eab74ded1d4e6e7ade60ca8ec257
SSDEEP 1536:LGnhjdj5p95eg/fE+VjdH/lJTrmJXgEKxxTXxA7IYO/keZkWkL+x0Oqih/eBpamb:qnhjvpf6wjXbKCx2joX46t7sZ
TLSH
T125D36B13F563A0F9D03DC13083667632BBB6B55647216BEF17A486322E60ED0AF39B54
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e883823ab4a4e07f275dc9a4d30621170b85f860455894a8c8d3c8c9db87a04f

File Explorer

e883823ab4a4e07f275dc9a4d30621170b85f860455894a8c8d3c8c9db87a04f

.exe 127KB

e883823ab4a4e07f275dc9a4d30621170b85f860455894a8c8d3c8c9db87a04f

IMPHASH e0459562cf00d41414d6173abf00d17f
SHA256 e883823ab4a4e07f275dc9a4d30621170b85f860455894a8c8d3c8c9db87a04f
MD5 28fc4702ec83f1a063a71aed52c513ef
SHA1 8a5f297a58f5379a7a7da91689935ea6c73fa089
SHA512 b442e080c86a589517a87d4c497386e9f44aaec34d224a0159de21aa5fc5cc6453e9d88a0705d87483d449414159c5f69c85eab74ded1d4e6e7ade60ca8ec257
SSDEEP 1536:LGnhjdj5p95eg/fE+VjdH/lJTrmJXgEKxxTXxA7IYO/keZkWkL+x0Oqih/eBpamb:qnhjvpf6wjXbKCx2joX46t7sZ
TLSH
T125D36B13F563A0F9D03DC13083667632BBB6B55647216BEF17A486322E60ED0AF39B54
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

89360

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

app_worker.pdb

kernel32

HeapReAlloc SetThreadStackGuarantee GetCurrentProcessId GetSystemTimeAsFileTime GetCurrentThread InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry SetLastError GetProcAddress AddVectoredExceptionHandler GetModuleHandleA HeapAlloc MultiByteToWideChar RtlVirtualUnwind WaitForSingleObject GetLastError GetCurrentThreadId GetProcessHeap IsDebuggerPresent VirtualQuery UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetModuleHandleW HeapFree QueryPerformanceCounter GetConsoleMode GetConsoleOutputCP WriteConsoleW GetStdHandle

winhttp

WinHttpSetStatusCallback WinHttpCloseHandle WinHttpOpenRequest WinHttpSendRequest WinHttpConnect WinHttpOpen WinHttpSetOption WinHttpReadData WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpReceiveResponse WinHttpAddRequestHeaders

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

ntdll

RtlNtStatusToDosError NtWriteFile

vcruntime140

__current_exception __current_exception_context __C_specific_handler

api-ms-win-crt-runtime-l1-1-0

_initialize_onexit_table _register_onexit_function _register_thread_local_exe_atexit_callback _cexit __p___argv __p___argc _exit exit _initterm_e _initterm _crt_atexit _get_initial_narrow_environment _configure_narrow_argv terminate _c_exit _set_app_type _initialize_narrow_environment _seh_filter_exe

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

e883823ab4a4e07f275dc9a4d30621170b85f860455894a8c8d3c8c9db87a04f

kernel32

winhttp

api-ms-win-core-synch-l1-2-0

ntdll

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic