7785a80765a12af43bbf43849dfb49be9017e3654d83a6f14a7b73d81e89805c

Sharing

Copy URL Twitter E-mail

General

Target
7785a80765a12af43bbf43849dfb49be9017e3654d83a6f14a7b73d81e89805c
Size 158KB
Sample261102-keq4psgt21
SHA256 7785a80765a12af43bbf43849dfb49be9017e3654d83a6f14a7b73d81e89805c
MD5 19c1d08d9e2831f87db53abf596843ae
SHA1 8724cd480438dd3845fb2df9ed7e8a7893e6ccaa
SHA512 201407076b716196282edc0c1a72f0ee2bde18f4c5eb966d57e66a2c1ecefbd4d3e8033d5fe43b8b67d551a0bece98f0f98b4e53115e3e8117d4dffa5ef0dc6f
SSDEEP 3072:KnrXA04kY2onNfAWkWev5Z4Up3wknLBPTD7KdkYIi:2PtoNoFfz4UdrBv6PI
TLSH
T17FF36B11B6ABA4FDE119C430832556A37E7170DA0F277AEF4294463D3E78AF42F39660
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7785a80765a12af43bbf43849dfb49be9017e3654d83a6f14a7b73d81e89805c

File Explorer

7785a80765a12af43bbf43849dfb49be9017e3654d83a6f14a7b73d81e89805c

.exe 158KB

7785a80765a12af43bbf43849dfb49be9017e3654d83a6f14a7b73d81e89805c

IMPHASH 6ec19483e26513297a289e3e5b51bff2
SHA256 7785a80765a12af43bbf43849dfb49be9017e3654d83a6f14a7b73d81e89805c
MD5 19c1d08d9e2831f87db53abf596843ae
SHA1 8724cd480438dd3845fb2df9ed7e8a7893e6ccaa
SHA512 201407076b716196282edc0c1a72f0ee2bde18f4c5eb966d57e66a2c1ecefbd4d3e8033d5fe43b8b67d551a0bece98f0f98b4e53115e3e8117d4dffa5ef0dc6f
SSDEEP 3072:KnrXA04kY2onNfAWkWev5Z4Up3wknLBPTD7KdkYIi:2PtoNoFfz4UdrBv6PI
TLSH
T17FF36B11B6ABA4FDE119C430832556A37E7170DA0F277AEF4294463D3E78AF42F39660
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

104444

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

app_worker.pdb

kernel32

HeapReAlloc GetProcessHeap GetCurrentProcessId GetSystemTimeAsFileTime SetThreadStackGuarantee InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind SetLastError AddVectoredExceptionHandler GetProcAddress GetModuleHandleA HeapAlloc MultiByteToWideChar CloseHandle IsDebuggerPresent WaitForSingleObject GetCurrentThread GetLastError GetCurrentThreadId UnhandledExceptionFilter VirtualQuery SetUnhandledExceptionFilter IsProcessorFeaturePresent GetModuleHandleW HeapFree QueryPerformanceCounter GetConsoleMode GetConsoleOutputCP WriteConsoleW GetStdHandle

winhttp

WinHttpConnect WinHttpAddRequestHeaders WinHttpSetStatusCallback WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpOpen WinHttpSetOption WinHttpReadData WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpReceiveResponse

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress WakeByAddressAll

ntdll

NtWriteFile RtlNtStatusToDosError

vcruntime140

__C_specific_handler __current_exception __current_exception_context __CxxFrameHandler3 _CxxThrowException

api-ms-win-crt-runtime-l1-1-0

_register_thread_local_exe_atexit_callback _c_exit _initialize_onexit_table _register_onexit_function __p___argv __p___argc _exit exit _initterm_e _initterm _get_initial_narrow_environment _configure_narrow_argv _crt_atexit terminate _set_app_type _cexit _seh_filter_exe _initialize_narrow_environment

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_set_new_mode free

Sharing

General

Malware Config

Signatures

File Explorer

7785a80765a12af43bbf43849dfb49be9017e3654d83a6f14a7b73d81e89805c

kernel32

winhttp

api-ms-win-core-synch-l1-2-0

ntdll

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic