c528cf558507679674c265d5712ad2898518a9e2d381728610b2344aa78b3509

Sharing

Copy URL Twitter E-mail

General

Target
c528cf558507679674c265d5712ad2898518a9e2d381728610b2344aa78b3509
Size 437KB
Sample261107-qsbttsdv4m
SHA256 c528cf558507679674c265d5712ad2898518a9e2d381728610b2344aa78b3509
MD5 c939226cb7c3a602c708ac3e4803493f
SHA1 333034d0ed8cec2ad80ba8d7aa50f41c6cfd13f1
SHA512 e73c5f8244178af07da9879608670174dc775feb34c1e718686bb480bc02ec9012cf10899cd64690bc1967c12e6636a5c63306156985b31589ff814b36cc1f71
SSDEEP 3072:2cWgazVg5oAkrlzduBcRFe4eau5l9yVQ/+2B+yotPgihxRyzlrT:M2oHNdu6oH2hRt4qr2lrT
TLSH
T13694B49072E45CA3F616C33858E7E2313379B6515363CB1BC204993D1E3B7D36E9AA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c528cf558507679674c265d5712ad2898518a9e2d381728610b2344aa78b3509

File Explorer

c528cf558507679674c265d5712ad2898518a9e2d381728610b2344aa78b3509

.exe 437KB

c528cf558507679674c265d5712ad2898518a9e2d381728610b2344aa78b3509

IMPHASH d02a02c8ecedb70823a9d0178cd7b7fc
SHA256 c528cf558507679674c265d5712ad2898518a9e2d381728610b2344aa78b3509
MD5 c939226cb7c3a602c708ac3e4803493f
SHA1 333034d0ed8cec2ad80ba8d7aa50f41c6cfd13f1
SHA512 e73c5f8244178af07da9879608670174dc775feb34c1e718686bb480bc02ec9012cf10899cd64690bc1967c12e6636a5c63306156985b31589ff814b36cc1f71
SSDEEP 3072:2cWgazVg5oAkrlzduBcRFe4eau5l9yVQ/+2B+yotPgihxRyzlrT:M2oHNdu6oH2hRt4qr2lrT
TLSH
T13694B49072E45CA3F616C33858E7E2313379B6515363CB1BC204993D1E3B7D36E9AA1A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16736

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

ConvertSidToStringSidW GetTokenInformation GetUserNameW OpenProcessToken RegCloseKey RegCreateKeyExW RegCreateKeyW RegDeleteValueW RegEnumValueW RegOpenKeyExW RegOpenKeyW RegQueryInfoKeyW RegQueryValueExW RegSetValueExW

kernel32

CreateToolhelp32Snapshot DelayLoadFailureHook GetComputerNameW GetPrivateProfileSectionW GetProcAddress HeapReAlloc IsBadStringPtrA IsBadStringPtrW Process32FirstW Process32NextW ResolveDelayLoadedAPI

kernelbase

CloseHandle CreateEventW CreateFileA CreateFileW CreateProcessW DeleteFileW ExitProcess FindClose FindFirstFileW FindNextFileW GetCommandLineW GetExitCodeProcess GetModuleHandleW GetSystemDirectoryW GetSystemFirmwareTable GetSystemWow64Directory2W GetTickCount GetWindowsDirectoryW HeapAlloc IsWow64Process LocalFree MapViewOfFile MoveFileExW MultiByteToWideChar OpenProcess ReadFile RemoveDirectoryW ResetEvent SetComputerNameExA SetCurrentDirectoryW SetEvent Sleep TerminateProcess UnmapViewOfFile VerFindFileW WaitForMultipleObjects WaitForSingleObject Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection lstrcmpiW

ntdll

NtClose NtCreateDirectoryObject NtCreateEvent NtCreateSection NtCreateSymbolicLinkObject NtOpenFile NtOpenSection NtPowerInformation NtQuerySystemInformation NtQuerySystemInformationEx RtlGetSystemTimePrecise RtlGetVersion RtlImageDirectoryEntryToData RtlInitUnicodeString _vsnprintf

ucrtbase

__acrt_iob_func __p___argc __p___argv __stdio_common_vsprintf __stdio_common_vswprintf _chsize _close _configure_narrow_argv _errno _fstat64i32 _get_initial_narrow_environment _initialize_narrow_environment _lseek _putenv _read _set_app_type _strdup _stricmp _wcsicmp _wgetenv _wopen _write exit free fwrite getenv malloc memcmp memmove memset qsort realloc strchr strcmp strcpy strcspn strerror strlen strncmp strtoul wcscat wcschr wcscmp wcscpy wcslen wcsncmp wcsstr

ws2_32

gethostname freeaddrinfo getaddrinfo

Name

.text

Size

36KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

72KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

4KB

Virtual Size

696B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

4KB

Virtual Size

660B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

32KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

c528cf558507679674c265d5712ad2898518a9e2d381728610b2344aa78b3509

advapi32

kernel32

kernelbase

ntdll

ucrtbase

ws2_32

generic