39086d1cfb3c4a698958ff9430266db8500200609da2821620b1c54f109dd096

Sharing

Copy URL Twitter E-mail

General

Target
39086d1cfb3c4a698958ff9430266db8500200609da2821620b1c54f109dd096
Size 40KB
Sample261107-2dgbjsvzb1
SHA256 39086d1cfb3c4a698958ff9430266db8500200609da2821620b1c54f109dd096
MD5 27f825652edc920b85547116b6e02ba4
SHA1 510063163d3e7ccb44ea4053aa6d0c8d2178c2e3
SHA512 7c3da10116fd9dd4bbee0a26fac1cbf4f1956b337ba28615993782e2f81a7c9dc9b2933acde8f458dcfdc55a086b740c697e38de24c8b77eee6486f3b12b54c3
SSDEEP 768:A/5OI2rk/HPA5blKppqddHSgVpSA7VXxNKlsV5CKoYXaSQRah3Zq7y/XSkV7uryq:A/5Ozrk/HPA5blqOHSgfRV/WFsh2y/Xo
TLSH
T13013CA29DE1AE07BD35A8D78C5034C09DE337C968BD1B5CFA7414DE60E65B90EB2DA02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
39086d1cfb3c4a698958ff9430266db8500200609da2821620b1c54f109dd096

File Explorer

39086d1cfb3c4a698958ff9430266db8500200609da2821620b1c54f109dd096

.exe 40KB

39086d1cfb3c4a698958ff9430266db8500200609da2821620b1c54f109dd096

IMPHASH f6bf80682394d3ab85161bd485356612
SHA256 39086d1cfb3c4a698958ff9430266db8500200609da2821620b1c54f109dd096
MD5 27f825652edc920b85547116b6e02ba4
SHA1 510063163d3e7ccb44ea4053aa6d0c8d2178c2e3
SHA512 7c3da10116fd9dd4bbee0a26fac1cbf4f1956b337ba28615993782e2f81a7c9dc9b2933acde8f458dcfdc55a086b740c697e38de24c8b77eee6486f3b12b54c3
SSDEEP 768:A/5OI2rk/HPA5blKppqddHSgVpSA7VXxNKlsV5CKoYXaSQRah3Zq7y/XSkV7uryq:A/5Ozrk/HPA5blqOHSgfRV/WFsh2y/Xo
TLSH
T13013CA29DE1AE07BD35A8D78C5034C09DE337C968BD1B5CFA7414DE60E65B90EB2DA02
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

18040

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\Administrator\source\repos\GoneFishingLoader\x64\Release\GoneFishingLoader.pdb

kernel32

GetFileAttributesW OpenProcess CreateToolhelp32Snapshot GetExitCodeThread Sleep GetLastError Process32NextW Process32FirstW WaitForSingleObject Module32FirstW GetProcAddress VirtualAllocEx GetModuleHandleW CreateRemoteThread Module32NextW VirtualFreeEx SetConsoleTitleW RtlLookupFunctionEntry GetModuleFileNameW GetStdHandle GetCurrentProcess SetConsoleTextAttribute SetLastError CloseHandle WriteProcessMemory RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent RtlCaptureContext QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead

advapi32

AdjustTokenPrivileges AllocateAndInitializeSid OpenProcessToken FreeSid CheckTokenMembership LookupPrivilegeValueW

msvcp140

?good@ios_base@std@@QEBA_NXZ ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?uncaught_exception@std@@YA_NXZ ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?_Xlength_error@std@@YAXPEBD@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

_CxxThrowException __current_exception_context __current_exception memset memcpy __std_terminate __std_exception_copy __std_exception_destroy __C_specific_handler memmove

api-ms-win-crt-runtime-l1-1-0

_exit _crt_atexit __p___argc __p___wargv exit _initterm _get_initial_wide_environment _configure_wide_argv _c_exit _cexit _invoke_watson _seh_filter_exe _initialize_wide_environment _initterm_e _register_thread_local_exe_atexit_callback _register_onexit_function _initialize_onexit_table terminate _set_app_type

api-ms-win-crt-string-l1-1-0

_wcsicmp

api-ms-win-crt-stdio-l1-1-0

_set_fmode __stdio_common_vsprintf __p__commode

api-ms-win-crt-heap-l1-1-0

_callnewh malloc free _set_new_mode

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

Sharing

General

Malware Config

Signatures

File Explorer

39086d1cfb3c4a698958ff9430266db8500200609da2821620b1c54f109dd096

kernel32

advapi32

msvcp140

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

generic