634f093318a36b7dd6e57776083e8c9d8d21d66eb490aed1ba181ee5e42770ca

Sharing

Copy URL Twitter E-mail

General

Target
634f093318a36b7dd6e57776083e8c9d8d21d66eb490aed1ba181ee5e42770ca
Size 1.2MB
Sample261104-3ftkbses2s
SHA256 634f093318a36b7dd6e57776083e8c9d8d21d66eb490aed1ba181ee5e42770ca
MD5 64e6b16a09ac0cae6f0d64f48c42f0c6
SHA1 8f3abfb95440abecdea97eed1dc13d7df0956444
SHA512 935045ac809597a16d99750e64b8146122f1722f85a5814bcd9188296f59ba35d394603670a731770113e3271749e5a2551ab3e52b7e14633f2ece6802152ec4
SSDEEP 24576:Q8MfuECgNL2EEBDO8GCDljvqph++11RQakVZQ:EmwNL5EBDOYD9b+11SaK
TLSH
T1AE458D96F29901FDE0B79078C9965617E7B2B81703209BDB43E48B663F13BE45B39312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
634f093318a36b7dd6e57776083e8c9d8d21d66eb490aed1ba181ee5e42770ca

File Explorer

634f093318a36b7dd6e57776083e8c9d8d21d66eb490aed1ba181ee5e42770ca

.exe 1.2MB

634f093318a36b7dd6e57776083e8c9d8d21d66eb490aed1ba181ee5e42770ca

IMPHASH 24221182cdc95c73280afb3e469c9e5a
SHA256 634f093318a36b7dd6e57776083e8c9d8d21d66eb490aed1ba181ee5e42770ca
MD5 64e6b16a09ac0cae6f0d64f48c42f0c6
SHA1 8f3abfb95440abecdea97eed1dc13d7df0956444
SHA512 935045ac809597a16d99750e64b8146122f1722f85a5814bcd9188296f59ba35d394603670a731770113e3271749e5a2551ab3e52b7e14633f2ece6802152ec4
SSDEEP 24576:Q8MfuECgNL2EEBDO8GCDljvqph++11RQakVZQ:EmwNL5EBDOYD9b+11SaK
TLSH
T1AE458D96F29901FDE0B79078C9965617E7B2B81703209BDB43E48B663F13BE45B39312
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

70028

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\YAMA\SimpleRemoter\x64\Release\TestRun.pdb

kernel32

LoadLibraryA GetNativeSystemInfo HeapAlloc GetProcAddress GetProcessHeap FreeLibrary IsBadReadPtr GetModuleFileNameA SetConsoleCtrlHandler MoveFileA WriteProcessMemory GetCurrentProcess TerminateProcess WaitForMultipleObjects GetEnvironmentVariableA WaitForSingleObject GetModuleHandleA Sleep GetLastError SetEvent DeleteFileA CloseHandle SetFileAttributesA VirtualAllocEx ExitProcess GetCurrentProcessId CreateRemoteThread CreateProcessA VirtualFreeEx CreateEventA GetPrivateProfileIntA GetPrivateProfileStringA IsWow64Process WriteConsoleW VirtualAlloc VirtualFree SetLastError HeapFree OpenProcess VirtualProtect SetEndOfFile HeapSize CreateFileW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetFileAttributesExW InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableCS SleepConditionVariableSRW InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx TryEnterCriticalSection DeleteCriticalSection GetCurrentThreadId WaitForSingleObjectEx GetExitCodeThread QueryPerformanceCounter FlsAlloc FlsGetValue FlsSetValue FlsFree GetSystemTimeAsFileTime GetModuleHandleW EncodePointer DecodePointer MultiByteToWideChar WideCharToMultiByte LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount ResetEvent CreateEventW InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx RtlPcToFileHeader RaiseException TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ReadFile CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW GetStdHandle WriteFile GetModuleFileNameW GetCommandLineA GetCommandLineW SetFilePointerEx GetConsoleMode ReadConsoleW GetFileType HeapReAlloc GetFileSizeEx GetTimeZoneInformation FlushFileBuffers GetConsoleOutputCP GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW RtlUnwind

advapi32

RegCloseKey LookupPrivilegeValueA RegSetValueExA OpenProcessToken RegOpenKeyExA AdjustTokenPrivileges

ws2_32

closesocket inet_pton getaddrinfo WSAStartup inet_addr send WSACleanup connect recv inet_ntop htons freeaddrinfo setsockopt socket

Name

.text

Size

222KB

Virtual Size

224KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

82KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

860KB

Virtual Size

868KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

634f093318a36b7dd6e57776083e8c9d8d21d66eb490aed1ba181ee5e42770ca

kernel32

advapi32

ws2_32

generic