508bf2d66918746d8670a9fdd20ebf3b50ea43ecaf108bd5b27b122f415a326f

Sharing

Copy URL Twitter E-mail

General

Target
508bf2d66918746d8670a9fdd20ebf3b50ea43ecaf108bd5b27b122f415a326f
Size 1.2MB
Sample261111-l4deksgs5x
SHA256 508bf2d66918746d8670a9fdd20ebf3b50ea43ecaf108bd5b27b122f415a326f
MD5 ab827150c9767113378ad2ef0d30affc
SHA1 dc3ff19a053e0e8e9c9cb03abfb5b697782b2d2a
SHA512 5eb31bd5b898913936290c7fc123cb860fa98247a03d012632112163e9bfa222d3c765e69fca57063f850137093be36d85262563d9236bb4338b1a06a746b5c1
SSDEEP 24576:nJqtaMZ0VF+emse0DiIPhuKfgc5iQK+5RXhhNmZwb28upV3nH:nQ8MZ0Te03Pjgc5xN/hNmZC28EH
TLSH
T15C55F125FA9589FCC05AC0B4825B8A735A7274CE0B3169FF12D442383F699F66F3C618
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
508bf2d66918746d8670a9fdd20ebf3b50ea43ecaf108bd5b27b122f415a326f

File Explorer

508bf2d66918746d8670a9fdd20ebf3b50ea43ecaf108bd5b27b122f415a326f

.exe 1.2MB

508bf2d66918746d8670a9fdd20ebf3b50ea43ecaf108bd5b27b122f415a326f

IMPHASH 56b1618dfd5e2de954f66bc4102923c8
SHA256 508bf2d66918746d8670a9fdd20ebf3b50ea43ecaf108bd5b27b122f415a326f
MD5 ab827150c9767113378ad2ef0d30affc
SHA1 dc3ff19a053e0e8e9c9cb03abfb5b697782b2d2a
SHA512 5eb31bd5b898913936290c7fc123cb860fa98247a03d012632112163e9bfa222d3c765e69fca57063f850137093be36d85262563d9236bb4338b1a06a746b5c1
SSDEEP 24576:nJqtaMZ0VF+emse0DiIPhuKfgc5iQK+5RXhhNmZwb28upV3nH:nQ8MZ0Te03Pjgc5xN/hNmZC28EH
TLSH
T15C55F125FA9589FCC05AC0B4825B8A735A7274CE0B3169FF12D442383F699F66F3C618
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

250528

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

loader.pdb

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

kernel32

QueryPerformanceCounter SetUnhandledExceptionFilter InitializeSListHead GetSystemTimeAsFileTime CloseHandle GetProcessHeap HeapFree HeapReAlloc lstrlenW GetCurrentProcess GetProcAddress WideCharToMultiByte WaitForSingleObjectEx LoadLibraryA GetCurrentProcessId CreateMutexA ReleaseMutex SetFilePointerEx GetLastError SetFileInformationByHandle DuplicateHandle WaitForSingleObject AddVectoredExceptionHandler SetThreadStackGuarantee GetCurrentThread SetLastError GetCurrentDirectoryW GetEnvironmentStringsW GetEnvironmentVariableW GetCommandLineW GetFileInformationByHandleEx CreateFileW GetFileInformationByHandle DeleteFileW GetConsoleMode GetFullPathNameW GetCurrentThreadId GetModuleHandleA GetTempPathW GetModuleFileNameW GetModuleHandleW FormatMessageW ExitProcess ReadFileEx SleepEx HeapAlloc MultiByteToWideChar WriteConsoleW GetStdHandle GetConsoleOutputCP CreateThread FreeEnvironmentStringsW GetFileAttributesW CompareStringOrdinal GetSystemDirectoryW GetWindowsDirectoryW CreateProcessW WriteFileEx GetExitCodeProcess RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind

ntdll

NtOpenFile NtCreateNamedPipeFile NtReadFile NtWriteFile RtlNtStatusToDosError

vcruntime140

memcpy memmove __current_exception __C_specific_handler __current_exception_context memset _CxxThrowException __CxxFrameHandler3 memcmp

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _initialize_narrow_environment _set_app_type _seh_filter_exe _initterm _initterm_e exit _exit terminate __p___argc __p___argv _cexit _c_exit _get_initial_narrow_environment _register_thread_local_exe_atexit_callback _crt_atexit _initialize_onexit_table _register_onexit_function

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

_set_fmode __p__commode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _set_new_mode

Sharing

General

Malware Config

Signatures

File Explorer

508bf2d66918746d8670a9fdd20ebf3b50ea43ecaf108bd5b27b122f415a326f

api-ms-win-core-synch-l1-2-0

kernel32

ntdll

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic