0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b

General

Target
0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b
Size 189KB
Sample221130-xt1b5sag2w
SHA256 0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b
MD5 84a6b69a72f274cde26972ae3ef0ff13
SHA1 bc30f84067ed408b34892e23a1916512010d7ee2
SHA512 b501438d74a2e744552165a5a0345993bd74512d659d86bf37f9d0d351e2a116d02bf85995126e89e48c468d5fc8e3c2c13f7f89bed62a42034764b7ed4b1a93
SSDEEP 3072:7gHJtiqAdeqgQS7RFAhADrXlJLzPb8R7Hi+xv+eSdu+g58QYwW/lioQ:7o6dgQeRlHXlJLzPK7P6Z+8QYn/l
MD5 SHA1 SHA512 SSDEEP

Score

N/A

Malware Config

Signatures

File Explorer

0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b

.exe 189KB

0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b

IMPHASH 5882541cb36768a47da59efaa4352cd0
SHA256 0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b
MD5 84a6b69a72f274cde26972ae3ef0ff13
SHA1 bc30f84067ed408b34892e23a1916512010d7ee2
SHA512 b501438d74a2e744552165a5a0345993bd74512d659d86bf37f9d0d351e2a116d02bf85995126e89e48c468d5fc8e3c2c13f7f89bed62a42034764b7ed4b1a93
SSDEEP 3072:7gHJtiqAdeqgQS7RFAhADrXlJLzPb8R7Hi+xv+eSdu+g58QYwW/lioQ:7o6dgQeRlHXlJLzPK7P6Z+8QYn/l
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

6160

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

crypt32

CertCompareCertificate CertDeleteCRLFromStore CertNameToStrA CertDuplicateCRLContext CertFindExtension CertCreateContext CryptFindOIDInfo CertControlStore CertSaveStore CertFindChainInStore CertAlgIdToOID CertCloseStore CertOpenStore CertFindCRLInStore CryptEnumOIDInfo CertFindAttribute CertDuplicateStore

shlwapi

UrlGetLocationA PathIsRootW UrlHashW UrlIsW PathCombineW UrlCanonicalizeW UrlCompareW UrlCreateFromPathW UrlEscapeW UrlCombineW UrlUnescapeW

shell32

StrChrA ShellAboutW DragQueryFileW DllUnregisterServer StrRChrA SHChangeNotify SHGetDiskFreeSpaceA ExtractIconW SHGetDataFromIDListA SHAlloc

kernel32

GetCommandLineA GetModuleHandleA GetTickCount CreateFileMappingW LoadLibraryExW VirtualAlloc TlsFree FindFirstFileW SetCurrentDirectoryA ResetEvent LoadLibraryA CloseHandle GetCurrentDirectoryW GetTempPathA SleepEx GetACP GetLongPathNameW HeapReAlloc

comsvcs

RecycleSurrogate CoLoadServices CoEnterServiceDomain

advapi32

GetUserNameA OpenEventLogW RegOpenKeyA RegUnLoadKeyA RegDeleteValueW RegEnumKeyA CryptSignHashA InitializeSid RegReplaceKeyW ReadEventLogA RegLoadKeyW RegRestoreKeyA RegSaveKeyW

dbnmpntw

ConnectionClose ConnectionWrite

Sharing

General

Malware Config

Signatures

File Explorer

0cf8b6b1643b6c1e9526b9c02e16eebf3ead39e41862c5b6b3cf6f11c7f2a38b

crypt32

shlwapi

shell32

kernel32

comsvcs

advapi32

dbnmpntw