a567c8f9febbe024bd579045b416ce373850900d5f238104ae552ee8ce30d744

Sharing

Copy URL Twitter E-mail

General

Target
a567c8f9febbe024bd579045b416ce373850900d5f238104ae552ee8ce30d744
Size 430KB
Sample261102-x8flaagb78
SHA256 a567c8f9febbe024bd579045b416ce373850900d5f238104ae552ee8ce30d744
MD5 ebd4d0e21b9f7f6c3a2b90c1a0d230db
SHA1 7da05261f676ef2da051051909cf665159affe4f
SHA512 ef5dfabc9f50284d272a31368c07f4cc9fc5d2fa396b85bbb868739aa6a0a4ac460f1c7b7199247efe00742d7102705d3c714a48849ce3b5144990b30a5802e1
SSDEEP 6144:YYj/tmE7GUlVtpl6H5pjdxey+KjEMgtExhnU1xzU0CLjrYIfIJaE5nQ:DjtmBURr6jdx8KZThUjCLHY7aE5nQ
TLSH
T158947DD2B6D55CEDF512C03D8212E177A63B76852332EBF31AA49D312F5AAC12F45B08
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a567c8f9febbe024bd579045b416ce373850900d5f238104ae552ee8ce30d744

File Explorer

a567c8f9febbe024bd579045b416ce373850900d5f238104ae552ee8ce30d744

.exe 430KB

a567c8f9febbe024bd579045b416ce373850900d5f238104ae552ee8ce30d744

IMPHASH b889cc674e0c306edf2c25e7622705d5
SHA256 a567c8f9febbe024bd579045b416ce373850900d5f238104ae552ee8ce30d744
MD5 ebd4d0e21b9f7f6c3a2b90c1a0d230db
SHA1 7da05261f676ef2da051051909cf665159affe4f
SHA512 ef5dfabc9f50284d272a31368c07f4cc9fc5d2fa396b85bbb868739aa6a0a4ac460f1c7b7199247efe00742d7102705d3c714a48849ce3b5144990b30a5802e1
SSDEEP 6144:YYj/tmE7GUlVtpl6H5pjdxey+KjEMgtExhnU1xzU0CLjrYIfIJaE5nQ:DjtmBURr6jdx8KZThUjCLHY7aE5nQ
TLSH
T158947DD2B6D55CEDF512C03D8212E177A63B76852332EBF31AA49D312F5AAC12F45B08
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5104

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

kernel32

AddVectoredExceptionHandler CloseHandle CompareStringOrdinal CreateFileMappingA CreateFileW CreateProcessW CreateThread CreateToolhelp32Snapshot DeleteCriticalSection DeviceIoControl DuplicateHandle EnterCriticalSection ExitProcess FlsAlloc FlsFree FlsSetValue FormatMessageW FreeEnvironmentStringsW GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetProcAddress GetProcessHeap GetStdHandle GetSystemDirectoryW GetWindowsDirectoryW HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete InitializeCriticalSection IsThreadAFiber LeaveCriticalSection MapViewOfFile Module32FirstW Module32NextW MultiByteToWideChar RaiseException ReadFileEx RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetConsoleCtrlHandler SetFileInformationByHandle SetFileTime SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter Sleep SleepEx TlsAlloc TlsFree TlsGetValue TlsSetValue UnmapViewOfFile VirtualProtect VirtualQuery WaitForSingleObject WriteConsoleW WriteFileEx __C_specific_handler

msvcrt

__getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _cexit _commode _fmode _fpreset _initterm abort atexit calloc exit fprintf free malloc memcmp memcpy memmove memset signal strlen strncmp vfprintf wcslen

ntdll

NtCreateNamedPipeFile NtOpenFile NtWriteFile RtlNtStatusToDosError

Name

.text

Size

260KB

Virtual Size

260KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

32KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

512B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

1024B

Virtual Size

732B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

a567c8f9febbe024bd579045b416ce373850900d5f238104ae552ee8ce30d744

api-ms-win-core-synch-l1-2-0

kernel32

msvcrt

ntdll

generic