c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f

Sharing

Copy URL Twitter E-mail

General

Target
c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f
Size 644KB
Sample261103-e7a1asst6j
SHA256 c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f
MD5 8face27ecb631bfce468e0e41f9c781e
SHA1 03ff1a02b9ed26580a958ab08a42247c0e900d41
SHA512 29ec8417848422415ff88e97de219feeca51ec3133e69a26cee773fbdf3c7182bd9be8b4f93b874c6e8bb3dc577eaf8de436913975704100476c0c2f5f32aedc
SSDEEP 12288:iBz/9TpGx7xOvdodm3q74LQFnSHKFGK9E/5mV:+9T+7xOvdodmKlFGK9E/5mV
TLSH
T13BE4C68226DB0CFAEE932B7C61DB6336A739FE708B2A4B678144C1321C135D56D5EB50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f

File Explorer

c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f

.exe 644KB

c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f

IMPHASH c8492f9a896da1ea82bd492400c34da0
SHA256 c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f
MD5 8face27ecb631bfce468e0e41f9c781e
SHA1 03ff1a02b9ed26580a958ab08a42247c0e900d41
SHA512 29ec8417848422415ff88e97de219feeca51ec3133e69a26cee773fbdf3c7182bd9be8b4f93b874c6e8bb3dc577eaf8de436913975704100476c0c2f5f32aedc
SSDEEP 12288:iBz/9TpGx7xOvdodm3q74LQFnSHKFGK9E/5mV:+9T+7xOvdodmKlFGK9E/5mV
TLSH
T13BE4C68226DB0CFAEE932B7C61DB6336A739FE708B2A4B678144C1321C135D56D5EB50
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5216

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

GetTokenInformation OpenProcessToken

gdi32

CreateCompatibleDC CreateDCA CreateDIBSection SelectObject SetStretchBltMode StretchBlt

kernel32

CloseHandle CreateEventA CreateEventW CreateProcessA CreateSemaphoreA CreateThread CreateToolhelp32Snapshot DeleteCriticalSection DuplicateHandle EnterCriticalSection FindClose FindFirstFileW FindNextFileW FormatMessageA GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetFileAttributesW GetLastError GetModuleFileNameW GetModuleHandleA GetProcAddress GetProcessAffinityMask GetStartupInfoA GetSystemTimeAsFileTime GetThreadContext GetThreadPriority GetTickCount InitializeCriticalSection IsDBCSLeadByte IsProcessorFeaturePresent LeaveCriticalSection LocalFree MoveFileExW OpenProcess OutputDebugStringA Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReleaseSemaphore ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetEvent SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter SetVolumeLabelW Sleep SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject

api-ms-win-crt-convert-l1-1-0

mbrtowc mbsrtowcs strtoul wcrtomb

api-ms-win-crt-environment-l1-1-0

__p__environ getenv

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc realloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale localeconv

api-ms-win-crt-math-l1-1-0

__setusermatherr cosf fmodf sinf

api-ms-win-crt-private-l1-1-0

__intrinsic_setjmp longjmp memchr memcmp memcpy memmove strchr

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv __p__acmdln _assert _beginthreadex _cexit _configure_narrow_argv _crt_atexit _endthreadex _errno _exit _initialize_narrow_environment _seh_filter_exe _initterm _initterm_e _set_app_type _set_invalid_parameter_handler abort exit strerror

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf __stdio_common_vsprintf _read _write fflush fputc fputs fwrite setvbuf

api-ms-win-crt-string-l1-1-0

_strdup _wcsicmp memset strcmp strlen strncmp strnlen wcscmp wcslen wcsnlen

api-ms-win-crt-utility-l1-1-0

rand rand_s srand

shell32

ShellExecuteW

user32

DispatchMessageA DrawIconEx GetDC GetSystemMetrics LoadCursorA MessageBoxA PeekMessageA ReleaseDC TranslateMessage

winmm

timeBeginPeriod timeEndPeriod waveOutClose waveOutOpen waveOutPrepareHeader waveOutReset waveOutUnprepareHeader waveOutWrite

Name

.text

Size

192KB

Virtual Size

192KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

592B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

800B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

c9dd4fd3fe51784b9d2187bf9245ae0d57db1e39c1fa5a608e3f9c09cd3ac07f

advapi32

gdi32

kernel32

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

shell32

user32

winmm

generic