0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b

Sharing

Copy URL Twitter E-mail

General

Target
0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b
Size 1.2MB
Sample261102-kjcf4sty7k
SHA256 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b
MD5 94dddde1a58961bedbecb8bcf4f73d9d
SHA1 c311a3fcd16504c435d6b1217ef0256d256e6651
SHA512 11f633f567e492a762f3607d0568453720e1055f4e1ed05935704d30a55a579c9cf0b11dda26eaadd7709ec9b36eeeb96701ee5f3153ab47b7729b52714e7e8e
SSDEEP 12288:RbguMWFuA62ZO0vzmEliO0vzmElvO0vzmElGO0vzmElNO0vzmElnO0vzmEl:BguMW/ZFzziFzzvFzzGFzzNFzznFzz
TLSH
T15745E10ADFDBCAD9D0BE94B9A4A560B7A261300E42D4DEDF3880915FDF719D06F28E50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b

File Explorer

0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b

.exe 1.2MB

0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b

IMPHASH fb7bace90d73db33c8ef9e85f4eab9b0
SHA256 0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b
MD5 94dddde1a58961bedbecb8bcf4f73d9d
SHA1 c311a3fcd16504c435d6b1217ef0256d256e6651
SHA512 11f633f567e492a762f3607d0568453720e1055f4e1ed05935704d30a55a579c9cf0b11dda26eaadd7709ec9b36eeeb96701ee5f3153ab47b7729b52714e7e8e
SSDEEP 12288:RbguMWFuA62ZO0vzmEliO0vzmElvO0vzmElGO0vzmElNO0vzmElnO0vzmEl:BguMW/ZFzziFzzvFzzGFzzNFzznFzz
TLSH
T15745E10ADFDBCAD9D0BE94B9A4A560B7A261300E42D4DEDF3880915FDF719D06F28E50
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1193472

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetTickCount64 LockResource QueryPerformanceFrequency FindResourceExW LoadResource GetOverlappedResult GetProcAddress DeleteCriticalSection FreeLibrary SleepEx QueryPerformanceCounter SetPriorityClass GetCurrentProcess GetCurrentThreadId ResumeThread WaitForSingleObjectEx GetLocalTime GetCurrentProcessId GetModuleHandleExW MultiByteToWideChar CreateEventW OpenProcess InitializeCriticalSection LeaveCriticalSection GetModuleFileNameW ExpandEnvironmentStringsW EnterCriticalSection GetFileInformationByHandleEx SizeofResource ReadFile GetModuleHandleW GetProcessHeap WriteConsoleW HeapAlloc CloseHandle GetThreadUILanguage GetLastError CreateFileW SetThreadUILanguage GetStdHandle GetCommandLineW SetLastError HeapFree ExitProcess Sleep TerminateProcess InitializeSListHead GetSystemTimeAsFileTime IsProcessorFeaturePresent SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext

advapi32

LookupPrivilegeValueW SetThreadToken CreateProcessAsUserW AdjustTokenPrivileges GetAce CloseServiceHandle OpenSCManagerW SetTokenInformation AllocateAndInitializeSid IsWellKnownSid AddAce OpenProcessToken CreateRestrictedToken FreeSid StartServiceW InitializeAcl OpenServiceW GetLengthSid DuplicateTokenEx AddAccessAllowedAce QueryServiceStatusEx GetTokenInformation

ole32

CoInitializeEx

userenv

DestroyEnvironmentBlock CreateEnvironmentBlock

wtsapi32

WTSEnumerateSessionsW WTSFreeMemory WTSEnumerateProcessesW WTSQueryUserToken

msvcrt

_CxxThrowException __C_specific_handler __setusermatherr _initterm _initterm_e _set_fmode __argc __argv _environ _errno _amsg_exit __getmainargs memset __DestructExceptionObject _msize __set_app_type abort ___mb_cur_max_func _commode ??3@YAXPEAX@Z ?terminate@@YAXXZ _XcptFilter realloc strncmp ??0exception@@QEAA@AEBV0@@Z ??1exception@@UEAA@XZ ?what@exception@@UEBAPEBDXZ ??2@YAPEAX_K@Z _wcsicmp __CxxFrameHandler3 ??0exception@@QEAA@AEBQEBD@Z _wcsnicmp wcsstr wcsrchr malloc free memcpy memmove __pctype_func tolower wcstol _mbtowc_l wcsnlen localeconv strrchr strcpy_s ceil log10 _clearfp memcmp

Name

.text

Size

66KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

23KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

42KB

Virtual Size

41KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1.0MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

0f8af1d9cd83aa357dc2b4addd388957f7dd2ff129b9c1d94d5f503db8bdfa7b

kernel32

advapi32

ole32

userenv

wtsapi32

msvcrt

generic