cbf31f1fef74030545ad520171d1a63b10f5333a8a990411572a6d67ce86ed5f

Sharing

Copy URL Twitter E-mail

General

Target
cbf31f1fef74030545ad520171d1a63b10f5333a8a990411572a6d67ce86ed5f
Size 2.2MB
Sample261113-rc4ekswv9j
SHA256 cbf31f1fef74030545ad520171d1a63b10f5333a8a990411572a6d67ce86ed5f
MD5 61e1f10c4be9089bbf078569555905bd
SHA1 51ae832f86be7be11afeaa22b026567e5b6bce82
SHA512 c313d5f7d9998bf0d9c65f19945f85fb3c5c927b2f2394523f2ead241fdfedcb2e28d40ace1ae6b8073e079dc172798c4ef1b71355cf1093024029c6d09d8c18
SSDEEP 49152:lzVx3m8/TzUEqnF7pmK/ndp7ICWJ7seS4QFk:sdp7cJ7seS4Ak
TLSH
T11AB58C533A6A628FF9D5523607F7E301E9B79CA44F958FCF50C181E1089A3736A9903B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
cbf31f1fef74030545ad520171d1a63b10f5333a8a990411572a6d67ce86ed5f

File Explorer

cbf31f1fef74030545ad520171d1a63b10f5333a8a990411572a6d67ce86ed5f

.dll 2.2MB

cbf31f1fef74030545ad520171d1a63b10f5333a8a990411572a6d67ce86ed5f

IMPHASH a1181a1107e3154c911997343b8229e7
SHA256 cbf31f1fef74030545ad520171d1a63b10f5333a8a990411572a6d67ce86ed5f
MD5 61e1f10c4be9089bbf078569555905bd
SHA1 51ae832f86be7be11afeaa22b026567e5b6bce82
SHA512 c313d5f7d9998bf0d9c65f19945f85fb3c5c927b2f2394523f2ead241fdfedcb2e28d40ace1ae6b8073e079dc172798c4ef1b71355cf1093024029c6d09d8c18
SSDEEP 49152:lzVx3m8/TzUEqnF7pmK/ndp7ICWJ7seS4QFk:sdp7cJ7seS4Ak
TLSH
T11AB58C533A6A628FF9D5523607F7E301E9B79CA44F958FCF50C181E1089A3736A9903B
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

93:1c:f4:70:78:1e:27:2c:db:35:67:46:74:ea:bd:d5:2e:eb:59:fe:33:02:f3:b9:65:e8:2b:a8:f2:cf:95:1c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

NO CERTIFICATE

Chains

Jan 1, 0001

Minor OS version

Major OS version

Entry point

300080

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

FormatMessageW Process32NextW DisableThreadLibraryCalls Process32FirstW CloseHandle FreeConsole GetProcAddress ExitProcess GetCurrentProcessId CreateProcessW GetModuleHandleW CopyFileW GetConsoleWindow IsDebuggerPresent CheckRemoteDebuggerPresent GetExitCodeProcess GetTickCount CreateDirectoryW ReadFile SizeofResource WriteProcessMemory VirtualProtect VirtualFree VirtualAlloc GetFileAttributesW Sleep LockResource CreateThread LoadResource FindResourceW GetThreadContext VirtualAllocEx LocalFree FreeLibrary WideCharToMultiByte GetSystemTimeAsFileTime SetThreadContext FlsFree FlsAlloc OutputDebugStringW RaiseException EnterCriticalSection LeaveCriticalSection SetEndOfFile SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA CreateToolhelp32Snapshot OpenProcess GetModuleHandleA ResumeThread CreateFileW WaitForSingleObject FindClose CreatePipe CreateJobObjectW GetModuleFileNameW TerminateProcess AssignProcessToJobObject DeviceIoControl GetModuleHandleExW WriteFile GetCurrentProcess FindNextFileW GetCommandLineW SetHandleInformation FindFirstFileW SetInformationJobObject IsBadStringPtrW GetProcessHeap DeleteCriticalSection WriteConsoleW DecodePointer HeapAlloc HeapReAlloc GetLastError HeapSize InitializeCriticalSectionEx GetStdHandle MultiByteToWideChar HeapFree GetTimeZoneInformation GetOEMCP GetACP IsValidCodePage ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetFileSizeEx GetFileType EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW RtlUnwind GetDateFormatW LoadLibraryExW UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext FreeLibraryAndExitThread ExitThread FlsSetValue FlsGetValue SetLastError InterlockedFlushSList RtlUnwindEx RtlLookupFunctionEntry IsProcessorFeaturePresent InitializeSListHead GetStartupInfoW SetUnhandledExceptionFilter GetCPInfo CompareStringEx LCMapStringEx EncodePointer FindFirstFileExW GetLocaleInfoEx SleepConditionVariableSRW WakeAllConditionVariable GetStringTypeW GetCurrentThreadId FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork QueryPerformanceCounter QueryPerformanceFrequency InitOnceComplete InitOnceBeginInitialize ReleaseSRWLockExclusive AcquireSRWLockExclusive

user32

ShowWindow SendMessageTimeoutW SetWindowPos

advapi32

CreateServiceW QueryServiceStatus StartServiceW RegOpenKeyExW RegQueryValueExW LookupPrivilegeValueW AdjustTokenPrivileges RegCloseKey RegCreateKeyExW ControlService RegSetValueExW OpenProcessToken ChangeServiceConfigW CloseServiceHandle OpenSCManagerW OpenServiceW QueryServiceStatusEx

ole32

CoSetProxyBlanket CoInitializeSecurity CoCreateInstance CoUninitialize CoInitializeEx

shell32

SHGetFolderPathW ShellExecuteW

oleaut32

SysFreeString SysAllocString SysStringLen VariantClear

shlwapi

StrStrIW

ws2_32

inet_addr send socket connect recv htons closesocket

ntdll

NtClose RtlPcToFileHeader

userenv

RefreshPolicyEx

winhttp

WinHttpSendRequest WinHttpCloseHandle WinHttpSetOption WinHttpOpenRequest WinHttpReadData WinHttpOpen WinHttpReceiveResponse WinHttpConnect

Name

.text

Size

541KB

Virtual Size

541KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

938KB

Virtual Size

938KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

296KB

Virtual Size

302KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

24KB

Virtual Size

23KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

434KB

Virtual Size

433KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

cbf31f1fef74030545ad520171d1a63b10f5333a8a990411572a6d67ce86ed5f

PE Signature issue

kernel32

user32

advapi32

ole32

shell32

oleaut32

shlwapi

ws2_32

ntdll

userenv

winhttp

generic