fed4ba7531b2b794f037798cc87edac46c3b98b166e2e8822bce204301d7066b

General

Target
fed4ba7531b2b794f037798cc87edac46c3b98b166e2e8822bce204301d7066b
Size 330KB
Sample220213-phackshgc4
SHA256 fed4ba7531b2b794f037798cc87edac46c3b98b166e2e8822bce204301d7066b
MD5 fd53797716c706419a3d1bf347acbf8a
SHA1 3388dac6ab1e07733c007f06d53dbe6a0fbab429
SHA512 e12965fd52cbd450993192ab91aa16cdd263b3c35e3eeda72a29f0e49f12abdaf866e4e4229a13e9a0239365773f487943b19ca4cc81507a5499ae3186e15c5b
SSDEEP 6144:kaHmfMzDLNj/ZDxBtuF69J5SfvjAdhTWtQisQunfJatMh:kvMDLNj/ZNBIFW0UhTaQfQunRcA
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

fed4ba7531b2b794f037798cc87edac46c3b98b166e2e8822bce204301d7066b

.exe 330KB

fed4ba7531b2b794f037798cc87edac46c3b98b166e2e8822bce204301d7066b

IMPHASH 81b0a3ca037bc0586cdc6705514792c2
SHA256 fed4ba7531b2b794f037798cc87edac46c3b98b166e2e8822bce204301d7066b
MD5 fd53797716c706419a3d1bf347acbf8a
SHA1 3388dac6ab1e07733c007f06d53dbe6a0fbab429
SHA512 e12965fd52cbd450993192ab91aa16cdd263b3c35e3eeda72a29f0e49f12abdaf866e4e4229a13e9a0239365773f487943b19ca4cc81507a5499ae3186e15c5b
SSDEEP 6144:kaHmfMzDLNj/ZDxBtuF69J5SfvjAdhTWtQisQunfJatMh:kvMDLNj/ZNBIFW0UhTaQfQunRcA
MD5 SHA1 SHA512 SSDEEP

windows x64

Minor OS version

Major OS version

Entry point

92640

Magic Number

523

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetLastError SetLastError FormatMessageW GetFileType GetStdHandle WriteFile ReadFile FlushFileBuffers SetEndOfFile SetFilePointer SetFileTime CloseHandle CreateFileW CreateDirectoryW SetFileAttributesW GetFileAttributesW DeleteFileW MoveFileW FindClose FindFirstFileW FindNextFileW GetVersionExW GetCurrentDirectoryW GetFullPathNameW FoldStringW GetModuleFileNameW GetModuleHandleW FindResourceW FreeLibrary GetProcAddress GetCurrentProcessId ExitProcess SetThreadExecutionState Sleep LoadLibraryW GetSystemDirectoryW CompareStringW AllocConsole FreeConsole AttachConsole WriteConsoleW TzSpecificLocalTimeToSystemTime SystemTimeToFileTime FileTimeToLocalFileTime LocalFileTimeToFileTime FileTimeToSystemTime GetCPInfo IsDBCSLeadByte MultiByteToWideChar WideCharToMultiByte GlobalAlloc LockResource GlobalLock GlobalUnlock GlobalFree LoadResource SizeofResource SetCurrentDirectoryW GetExitCodeProcess WaitForSingleObject GetLocalTime GetTickCount MapViewOfFile UnmapViewOfFile CreateFileMappingW OpenFileMappingW GetCommandLineW SetEnvironmentVariableW ExpandEnvironmentStringsW GetTempPathW MoveFileExW GetLocaleInfoW GetTimeFormatW GetDateFormatW GetNumberFormatW SetFilePointerEx GetConsoleMode GetConsoleCP HeapSize SetStdHandle GetProcessHeap RaiseException GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW QueryPerformanceFrequency GetCurrentProcess TerminateProcess GetModuleHandleExW GetModuleFileNameA GetACP HeapFree HeapAlloc HeapReAlloc GetStringTypeW LCMapStringW FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW

gdiplus

GdiplusShutdown GdiplusStartup GdipCreateHBITMAPFromBitmap GdipCreateBitmapFromStream GdipDisposeImage GdipCloneImage GdipFree GdipAlloc

Name

.text

Size

161KB

Virtual Size

161KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

59KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

215KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

1024B

Virtual Size

712B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

18KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

fed4ba7531b2b794f037798cc87edac46c3b98b166e2e8822bce204301d7066b

kernel32

gdiplus