3c7ac2a911930ac971faef8f76731bb189a219bc3ae264100ebf465ae5327498

Sharing

Copy URL Twitter E-mail

General

Target
3c7ac2a911930ac971faef8f76731bb189a219bc3ae264100ebf465ae5327498
Size 335KB
Sample261102-lfansastc1
SHA256 3c7ac2a911930ac971faef8f76731bb189a219bc3ae264100ebf465ae5327498
MD5 6abfd652f712799546c13fb75993350f
SHA1 1c59e5b2aab9eb8056bc5f34d12845cc70148541
SHA512 3ee10dfbbc1e85b0b7a6a30d945a9723957194ffe0b8f4103c6c75081aaf211e74a9a8324685068514af8ef67ac52c4e7e7edd018c0950539efd61a99cc3b2fd
SSDEEP 6144:CpWN72UmTXiUNdgYvX/uLGGnlgBgRh+isyF55paCkj7+11:CYZmTXiUNdgYv+Fh+u+61
TLSH
T108743B02BE892CA9E089CC7483178A635E2574CF0B26B5FF12D541253F7EBB5AF29315
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3c7ac2a911930ac971faef8f76731bb189a219bc3ae264100ebf465ae5327498

File Explorer

3c7ac2a911930ac971faef8f76731bb189a219bc3ae264100ebf465ae5327498

.dll 335KB

3c7ac2a911930ac971faef8f76731bb189a219bc3ae264100ebf465ae5327498

IMPHASH 5028f2a376328081442b4e531b866d41
SHA256 3c7ac2a911930ac971faef8f76731bb189a219bc3ae264100ebf465ae5327498
MD5 6abfd652f712799546c13fb75993350f
SHA1 1c59e5b2aab9eb8056bc5f34d12845cc70148541
SHA512 3ee10dfbbc1e85b0b7a6a30d945a9723957194ffe0b8f4103c6c75081aaf211e74a9a8324685068514af8ef67ac52c4e7e7edd018c0950539efd61a99cc3b2fd
SSDEEP 6144:CpWN72UmTXiUNdgYvX/uLGGnlgBgRh+isyF55paCkj7+11:CYZmTXiUNdgYv+Fh+u+61
TLSH
T108743B02BE892CA9E089CC7483178A635E2574CF0B26B5FF12D541253F7EBB5AF29315
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

230140

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

dog_agent.pdb

kernel32

LoadLibraryA GetProcAddress lstrlenW GetCurrentProcessId CreateMutexA WriteFile WideCharToMultiByte RtlVirtualUnwind InterlockedFlushSList HeapAlloc FindClose SetLastError FindNextFileW RtlPcToFileHeader FindFirstFileW GetFileSizeEx CreateFileW GetFileAttributesW GetProcessHeap CloseHandle WaitForSingleObjectEx HeapReAlloc RtlUnwindEx RtlLookupFunctionEntry GetLastError SystemTimeToTzSpecificLocalTime GetCurrentThreadId EncodePointer DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW MultiByteToWideChar GetCurrentProcess VirtualQuery SetFilePointerEx ReadFile HeapFree RtlCaptureContext CreateProcessW FileTimeToSystemTime WaitForSingleObject RaiseException CreatePipe ReleaseMutex GetSystemTimeAsFileTime DisableThreadLibraryCalls InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent TerminateProcess GetConsoleMode GetCurrentDirectoryW SetCurrentDirectoryW WriteConsoleW GetConsoleOutputCP GetStdHandle GetEnvironmentVariableW QueryPerformanceCounter

winhttp

WinHttpReadData WinHttpQueryDataAvailable WinHttpQueryHeaders WinHttpSetOption WinHttpAddRequestHeaders WinHttpSendRequest WinHttpReceiveResponse WinHttpCloseHandle WinHttpSetStatusCallback WinHttpOpenRequest WinHttpConnect WinHttpOpen

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WakeByAddressSingle WaitOnAddress

ntdll

RtlNtStatusToDosError NtWriteFile

api-ms-win-crt-string-l1-1-0

strcpy_s strlen wcsncmp

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv abort _seh_filter_dll _initterm_e terminate _cexit _execute_onexit_table _initialize_onexit_table _initialize_narrow_environment _initterm

api-ms-win-crt-heap-l1-1-0

free malloc calloc

Sharing

General

Malware Config

Signatures

File Explorer

3c7ac2a911930ac971faef8f76731bb189a219bc3ae264100ebf465ae5327498

kernel32

winhttp

api-ms-win-core-synch-l1-2-0

ntdll

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic