478ccc46a2b0207db57d7dae329d0dba4311500d928d8ee491116922504f6dd0[.]bin

Sharing

Copy URL Twitter E-mail

General

Target
478ccc46a2b0207db57d7dae329d0dba4311500d928d8ee491116922504f6dd0.bin
Size 1.7MB
Sample261110-l23lpaed93
SHA256 478ccc46a2b0207db57d7dae329d0dba4311500d928d8ee491116922504f6dd0
MD5 823906f5fc261e917af8d6b428999f34
SHA1 bb6c05d795836a24d2fe1c40b376182b7a033857
SHA512 6c7e20b84dc0e1c6857d7ac6b9421940409719ac04c479c58c547af6f65add2e95c490d5f68705369fc27287cb9f2b2b8fcde39516e8a509e17a57c527043cb3
SSDEEP 49152:CFdRlmXhlMe9F3V6q3Py4nrwgoKWAhYv1QFTSFQr:aluVpo99QFE
TLSH
T181854A43F6B2A0B8C166C135936A7232FB217C4E45367AB72BD88A343FA5F40671DB54
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Signatures

Contains code to disable Windows Defender 1 IoCs

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

resource	yara_rule
sample	disable_win_def

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
478ccc46a2b0207db57d7dae329d0dba4311500d928d8ee491116922504f6dd0.bin

File Explorer

478ccc46a2b0207db57d7dae329d0dba4311500d928d8ee491116922504f6dd0.bin

.exe 1.7MB

478ccc46a2b0207db57d7dae329d0dba4311500d928d8ee491116922504f6dd0.bin

IMPHASH c38a26565aee5e0a095f7de02a0b6267
SHA256 478ccc46a2b0207db57d7dae329d0dba4311500d928d8ee491116922504f6dd0
MD5 823906f5fc261e917af8d6b428999f34
SHA1 bb6c05d795836a24d2fe1c40b376182b7a033857
SHA512 6c7e20b84dc0e1c6857d7ac6b9421940409719ac04c479c58c547af6f65add2e95c490d5f68705369fc27287cb9f2b2b8fcde39516e8a509e17a57c527043cb3
SSDEEP 49152:CFdRlmXhlMe9F3V6q3Py4nrwgoKWAhYv1QFTSFQr:aluVpo99QFE
TLSH
T181854A43F6B2A0B8C166C135936A7232FB217C4E45367AB72BD88A343FA5F40671DB54
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Contains code to disable Windows Defender

A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5120

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

ntdll

NtCreateNamedPipeFile NtQueryInformationProcess NtQuerySystemInformation RtlGetVersion NtOpenFile NtReadFile NtWriteFile RtlNtStatusToDosError

mpr

WNetAddConnection2W

netapi32

DsGetDcNameW NetApiBufferFree

ole32

CoTaskMemFree

oleaut32

GetErrorInfo SysFreeString SysStringLen

pdh

PdhAddEnglishCounterW PdhCloseQuery PdhCollectQueryData PdhGetFormattedCounterValue PdhOpenQueryA PdhRemoveCounter

powrprof

CallNtPowerInformation

psapi

GetModuleFileNameExW GetProcessMemoryInfo

shell32

CommandLineToArgvW SHChangeNotify SHGetFolderPathW SHGetKnownFolderPath

user32

SendMessageTimeoutW ShowWindow

wldap32

ldap_add_sW ldap_bind_sW ldap_first_attributeW ldap_first_entry ldap_get_valuesW ldap_initW ldap_modify_sW ldap_msgfree ldap_next_attributeW ldap_next_entry ldap_search_sW ldap_set_optionW ldap_unbind ldap_value_freeW

bcryptprimitives

ProcessPrng

advapi32

AdjustTokenPrivileges AllocateAndInitializeSid CheckTokenMembership CopySid DuplicateTokenEx EqualSid FreeSid GetLengthSid GetTokenInformation GetUserNameW IsValidSid LookupPrivilegeValueW OpenProcessToken SetThreadToken SystemFunction036 CloseServiceHandle ControlService OpenSCManagerW OpenServiceW QueryServiceStatusEx RegCloseKey RegCreateKeyExW RegOpenKeyExW RegSetValueExW

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcrypt

BCryptGenRandom

iphlpapi

GetAdaptersAddresses GetAdaptersInfo GetIpForwardTable

kernel32

AttachConsole CancelIo CloseHandle CopyFileExW CreateDirectoryW CreateEventW CreateFileMappingA CreateFileW CreateProcessW CreateThread CreateWaitableTimerExW DeleteFileW DuplicateHandle ExitProcess FindClose FindFirstFileExW FindNextFileW FormatMessageW FreeConsole FreeLibrary GetComputerNameExW GetConsoleMode GetConsoleOutputCP GetConsoleWindow GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDriveTypeA GetExitCodeProcess GetFileAttributesW GetFileInformationByHandle GetFileInformationByHandleEx GetFinalPathNameByHandleW GetFullPathNameW GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleW GetOverlappedResult GetProcAddress GetProcessHeap GetProcessId GetProcessIoCounters GetProcessTimes GetStdHandle GetSystemDirectoryW GetSystemInfo GetSystemTimePreciseAsFileTime GetSystemTimes GetTempPathW GetVersionExW GetWindowsDirectoryW GlobalMemoryStatusEx HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete LoadLibraryExA LocalFree MapViewOfFile MoveFileExW OpenProcess ReadFile ReadFileEx ReadProcessMemory RemoveDirectoryW RtlLookupFunctionEntry SetConsoleMode SetFileInformationByHandle SetFilePointerEx SetFileTime SetHandleInformation SetLastError SetPriorityClass SetStdHandle SetThreadAffinityMask SetThreadStackGuarantee SetWaitableTimer Sleep SleepEx SwitchToThread TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnmapViewOfFile VirtualQueryEx WaitForMultipleObjects WaitForSingleObject WriteConsoleW WriteFileEx AddVectoredExceptionHandler CompareStringOrdinal CreateToolhelp32Snapshot DeleteCriticalSection EnterCriticalSection FreeEnvironmentStringsW GetCommandLineW GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW InitializeCriticalSection K32GetPerformanceInfo LeaveCriticalSection Module32FirstW Module32NextW MultiByteToWideChar Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency RaiseException RtlCaptureContext RtlUnwindEx RtlVirtualUnwind SetUnhandledExceptionFilter VirtualProtect VirtualQuery __C_specific_handler lstrlenW

ws2_32

WSACleanup WSAGetLastError WSASocketW WSAStartup closesocket connect getsockopt ioctlsocket select

msvcrt

__getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _cexit _commode _fmode _fpreset _initterm abort atexit calloc exit fprintf free malloc memcmp memcpy memmove memset signal strlen strncmp vfprintf wcslen

Name

.text

Size

1.4MB

Virtual Size

1.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

226KB

Virtual Size

226KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

35KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

478ccc46a2b0207db57d7dae329d0dba4311500d928d8ee491116922504f6dd0.bin

ntdll

mpr

netapi32

ole32

oleaut32

pdh

powrprof

psapi

shell32

user32

wldap32

bcryptprimitives

advapi32

api-ms-win-core-synch-l1-2-0

bcrypt

iphlpapi

kernel32

ws2_32

msvcrt

generic