5860aa99f2728d1fe095387575f210cea1ca41a4a1c1d12f276ea7784413c186

General

Target
5860aa99f2728d1fe095387575f210cea1ca41a4a1c1d12f276ea7784413c186
Size 232KB
Sample220701-esbnaadcg2
SHA256 5860aa99f2728d1fe095387575f210cea1ca41a4a1c1d12f276ea7784413c186
MD5 433d6c179b52282f730f84bdf722f0dc
SHA1 9a4aab9d9c9cef5f1ac2c1135e49957e4f85befd
SHA512 0194168071a278982fb152fd0c63aa30def25db18edf6784163ba41617fab7fec368f391a40337efdbf305905c8d58c3202edcfd4e290c90509ea6a5f7a6de10
SSDEEP 3072:GLDQ0JrU31bwRKbPmP7W8D1uvb55PWTtRdYEEuU7P7EF6HG8YNZ:GnQ0loqj7Wg1qb4RdTEhw8G8A
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

5860aa99f2728d1fe095387575f210cea1ca41a4a1c1d12f276ea7784413c186

.exe 232KB

5860aa99f2728d1fe095387575f210cea1ca41a4a1c1d12f276ea7784413c186

IMPHASH 91786a46ffdd05d490759a08adf701a9
SHA256 5860aa99f2728d1fe095387575f210cea1ca41a4a1c1d12f276ea7784413c186
MD5 433d6c179b52282f730f84bdf722f0dc
SHA1 9a4aab9d9c9cef5f1ac2c1135e49957e4f85befd
SHA512 0194168071a278982fb152fd0c63aa30def25db18edf6784163ba41617fab7fec368f391a40337efdbf305905c8d58c3202edcfd4e290c90509ea6a5f7a6de10
SSDEEP 3072:GLDQ0JrU31bwRKbPmP7W8D1uvb55PWTtRdYEEuU7P7EF6HG8YNZ:GnQ0loqj7Wg1qb4RdTEhw8G8A
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

10606

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetThreadPriority GetLastError DisconnectNamedPipe GetCurrentProcess MapUserPhysicalPagesScatter FoldStringW AttachConsole AddConsoleAliasW GetBinaryTypeW GetShortPathNameA VirtualProtect AddAtomW GlobalAlloc UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW MultiByteToWideChar WideCharToMultiByte ExitProcess GetModuleHandleExW GetACP HeapFree HeapAlloc CloseHandle FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW SetStdHandle GetFileType GetStringTypeW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleCP GetConsoleMode SetFilePointerEx WriteConsoleW DecodePointer CreateFileW RaiseException

gdi32

GetEnhMetaFileHeader

advapi32

CreateProcessAsUserW DeleteService

Name

.text

Size

47KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

22KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

120KB

Virtual Size

49.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.but

Size

1KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

172B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

35KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

5860aa99f2728d1fe095387575f210cea1ca41a4a1c1d12f276ea7784413c186

kernel32

gdi32

advapi32