be90048e55d6ad58aeb8b350e418eb9051334831348871bae6dc214a9ec90098

General

Target
be90048e55d6ad58aeb8b350e418eb9051334831348871bae6dc214a9ec90098
Size 800KB
Sample220523-ea6qpsfadp
SHA256 be90048e55d6ad58aeb8b350e418eb9051334831348871bae6dc214a9ec90098
MD5 ff9b19dd8567efa8b164d000a0ef9cd7
SHA1 3ce1b93b717e1e775bf837de8c36cb83686ca731
SHA512 f32074910e8eeeb3e1511323dcb8dc8e3a7b598bdca5a7bcb34f146145a925df975d073315ca81a0b0e955205ff7f980ab93e319d244a136cd2fa7b37136d9bf
SSDEEP 12288:+FOAhqfcEp3dTXBasVdkAy+s8VLpVnv50iz0xmtE/+w55kh4ALbKYLNRO:OkfckFXBnKmVp0stE/p55khLSYBRO
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

be90048e55d6ad58aeb8b350e418eb9051334831348871bae6dc214a9ec90098

.exe 800KB

be90048e55d6ad58aeb8b350e418eb9051334831348871bae6dc214a9ec90098

IMPHASH b677415c28d374ba2568025d7b47839b
SHA256 be90048e55d6ad58aeb8b350e418eb9051334831348871bae6dc214a9ec90098
MD5 ff9b19dd8567efa8b164d000a0ef9cd7
SHA1 3ce1b93b717e1e775bf837de8c36cb83686ca731
SHA512 f32074910e8eeeb3e1511323dcb8dc8e3a7b598bdca5a7bcb34f146145a925df975d073315ca81a0b0e955205ff7f980ab93e319d244a136cd2fa7b37136d9bf
SSDEEP 12288:+FOAhqfcEp3dTXBasVdkAy+s8VLpVnv50iz0xmtE/+w55kh4ALbKYLNRO:OkfckFXBnKmVp0stE/p55khLSYBRO
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

41168

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetFileSize lstrcmpA WriteConsoleInputW TryEnterCriticalSection WritePrivateProfileStructA GetConsoleAliasesLengthW CopyFileExW GetModuleHandleExA GetConsoleAliasExesA SetComputerNameExA GetDriveTypeW MoveFileExA DebugActiveProcessStop lstrcpynA GetConsoleAliasExesLengthA FindResourceW BuildCommDCBAndTimeoutsA LoadResource UpdateResourceA InterlockedIncrement _lwrite GetQueuedCompletionStatus VerSetConditionMask ReadConsoleA InterlockedDecrement ZombifyActCtx SetDefaultCommConfigW GetSystemWindowsDirectoryW GetNamedPipeHandleStateA GetProfileSectionA SetConsoleScreenBufferSize InterlockedCompareExchange WriteConsoleInputA GetComputerNameW GetModuleHandleW GetTickCount VirtualFree GetConsoleAliasesLengthA GetDllDirectoryW GetPrivateProfileStringW GetConsoleTitleA ReadConsoleOutputA GetDateFormatA GetCommandLineA CreateActCtxW EnumResourceTypesA SetProcessPriorityBoost GetDriveTypeA GetPriorityClass GetVolumePathNameW GlobalAlloc GetPrivateProfileIntA GetSystemDirectoryW SetFileShortNameW CopyFileW AssignProcessToJobObject GetCalendarInfoA ReadProcessMemory GetSystemWow64DirectoryW SetSystemTimeAdjustment GetSystemWindowsDirectoryA FormatMessageW GetVersionExW GetFileAttributesA SetConsoleMode GetConsoleAliasW GetWriteWatch VerifyVersionInfoA WriteConsoleW GetBinaryTypeA WritePrivateProfileSectionW TerminateProcess GetAtomNameW GetMailslotInfo GetCompressedFileSizeA GetTimeZoneInformation CreateFileW GetOverlappedResult GetACP lstrlenW FindNextVolumeMountPointW CreateMailslotW DisconnectNamedPipe DeactivateActCtx GetNamedPipeHandleStateW GetConsoleAliasesW ReleaseActCtx SetCurrentDirectoryA GetStartupInfoA GetCPInfoExW FillConsoleOutputCharacterW GetHandleInformation GetLastError GetLongPathNameW ReadConsoleOutputCharacterA CreateNamedPipeA EnumDateFormatsExA CreateTimerQueueTimer WriteProfileSectionA SetComputerNameA VerLanguageNameW GlobalGetAtomNameA DefineDosDeviceA ResetEvent OpenWaitableTimerA GetLocalTime LoadLibraryA UnhandledExceptionFilter InterlockedExchangeAdd SetCalendarInfoW WritePrivateProfileStringA MoveFileA SetConsoleOutputCP GetExitCodeThread AddAtomW GetProfileStringA HeapLock GetCommMask HeapWalk GetTapeParameters FoldStringA SetSystemTime GlobalWire GetModuleFileNameA GetPrivateProfileSectionNamesA GetOEMCP FindNextFileA EnumDateFormatsA CreateIoCompletionPort FindFirstChangeNotificationA lstrcatW FreeEnvironmentStringsW FindNextFileW GetStringTypeW BuildCommDCBA VirtualProtect OutputDebugStringA SetThreadAffinityMask EndUpdateResourceA GetVersion DeleteFileW GetCurrentProcessId MoveFileWithProgressW GetFileInformationByHandle DebugBreak FindActCtxSectionStringW SuspendThread lstrcpyA SetUnhandledExceptionFilter WideCharToMultiByte GetStartupInfoW HeapValidate IsBadReadPtr RaiseException Sleep GetProcAddress ExitProcess WriteFile GetStdHandle GetCurrentProcess IsDebuggerPresent GetModuleFileNameW GetCPInfo IsValidCodePage TlsGetValue TlsAlloc TlsSetValue GetCurrentThreadId TlsFree SetLastError EnterCriticalSection LeaveCriticalSection RtlUnwind DeleteCriticalSection SetHandleCount GetFileType QueryPerformanceCounter GetSystemTimeAsFileTime GetEnvironmentStringsW GetCommandLineW HeapDestroy HeapCreate HeapFree HeapAlloc HeapSize HeapReAlloc VirtualAlloc InitializeCriticalSectionAndSpinCount SetFilePointer GetConsoleCP GetConsoleMode OutputDebugStringW LoadLibraryW MultiByteToWideChar LCMapStringA LCMapStringW GetStringTypeA GetLocaleInfoA SetStdHandle WriteConsoleA GetConsoleOutputCP FlushFileBuffers CreateFileA CloseHandle DeleteFileA

Name

.text

Size

166KB

Virtual Size

165KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

585KB

Virtual Size

840KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tipab

Size

512B

Virtual Size

5B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.kutob

Size

512B

Virtual Size

75B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bulezi

Size

512B

Virtual Size

34B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

46KB

Virtual Size

46KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

be90048e55d6ad58aeb8b350e418eb9051334831348871bae6dc214a9ec90098

kernel32