20c76665fc112173411027dec2164eb46d5db7a3e8f068f26486fe0056616adb

General

Target
20c76665fc112173411027dec2164eb46d5db7a3e8f068f26486fe0056616adb
Size 190KB
Sample261102-nktcssbv3l
SHA256 20c76665fc112173411027dec2164eb46d5db7a3e8f068f26486fe0056616adb
MD5 946a8e24b6f13876ea92fe06e5b190dd
SHA1 c464af018cdd476fdc80a88011d113b7fa0ccac8
SHA512 b35f5987edf80d449f59e1bfc4cef11682c64f19f73adbf32c50114ef9eb22c5006ad96dac727cc28c4b753637f2f157a9499322f4abfaebf2d4440ce1cb4cb3
SSDEEP 3072:SzU9QH8U58qd+aXi9TGlnUeRoqPJcIEZloAdqkfcuAg0FujogrMehKaBdH:SzU9oledgnfRoWkAOzQeFd
TLSH
T135146A11B4D280B2E572193108F4DAB59A2DFC314F24ADBBA7D9473E4F742D19A31EB2
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
20c76665fc112173411027dec2164eb46d5db7a3e8f068f26486fe0056616adb

File Explorer

20c76665fc112173411027dec2164eb46d5db7a3e8f068f26486fe0056616adb

.exe 190KB

20c76665fc112173411027dec2164eb46d5db7a3e8f068f26486fe0056616adb

IMPHASH c23a074b62758f22809fcf01740930cf
SHA256 20c76665fc112173411027dec2164eb46d5db7a3e8f068f26486fe0056616adb
MD5 946a8e24b6f13876ea92fe06e5b190dd
SHA1 c464af018cdd476fdc80a88011d113b7fa0ccac8
SHA512 b35f5987edf80d449f59e1bfc4cef11682c64f19f73adbf32c50114ef9eb22c5006ad96dac727cc28c4b753637f2f157a9499322f4abfaebf2d4440ce1cb4cb3
SSDEEP 3072:SzU9QH8U58qd+aXi9TGlnUeRoqPJcIEZloAdqkfcuAg0FujogrMehKaBdH:SzU9oledgnfRoWkAOzQeFd
TLSH
T135146A11B4D280B2E572193108F4DAB59A2DFC314F24ADBBA7D9473E4F742D19A31EB2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

14067

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\duomai\master\SilentRobot\QianNiu\Test\Release\Test.pdb

kernel32

MultiByteToWideChar LoadLibraryA GetProcAddress WideCharToMultiByte WriteConsoleW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW GetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection SetLastError InitializeCriticalSectionAndSpinCount SwitchToThread TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer DecodePointer CompareStringW LCMapStringW GetLocaleInfoW GetStringTypeW GetCPInfo RtlUnwind RaiseException FreeLibrary LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameA ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW GetACP HeapFree CloseHandle WaitForSingleObject GetExitCodeProcess CreateProcessA GetFileAttributesExW HeapAlloc FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA IsValidLocale GetUserDefaultLCID EnumSystemLocalesW SetStdHandle GetFileType GetProcessHeap FlushFileBuffers GetConsoleCP GetConsoleMode ReadFile ReadConsoleW SetFilePointerEx HeapReAlloc HeapSize CreateFileW

Sharing

General

Malware Config

Signatures

File Explorer

20c76665fc112173411027dec2164eb46d5db7a3e8f068f26486fe0056616adb

kernel32

generic