1e3f34f35c7965dfdb4cd19f20a43eee4007a7b4c96b21129971b7765882e7d9

General

Target
1e3f34f35c7965dfdb4cd19f20a43eee4007a7b4c96b21129971b7765882e7d9
Size 713KB
Sample230216-cyd99afd35
SHA256 1e3f34f35c7965dfdb4cd19f20a43eee4007a7b4c96b21129971b7765882e7d9
MD5 51a95db2a6288c2e11a3925e5c3538b5
SHA1 2f7b29cbd861129b6e56b0652fe551d88f1a5fe6
SHA512 de329157e9e8e5de46f320a6ebfd9c0854c8787e534e5bf88f6c3aaddb94870292e481c929c8b37bbbe501095a60b2a3214bc080c889e178c2083a45030591a6
SSDEEP 12288:ErD6i4ccx1svhmky5X7mV0W0zQzclKJsnBEnBG4r0II1am4OW46x:ErB4cisSBWWicU4EnBzYhaN
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

1e3f34f35c7965dfdb4cd19f20a43eee4007a7b4c96b21129971b7765882e7d9

.exe 713KB

1e3f34f35c7965dfdb4cd19f20a43eee4007a7b4c96b21129971b7765882e7d9

IMPHASH e4a81217ceeca700511172936e540786
SHA256 1e3f34f35c7965dfdb4cd19f20a43eee4007a7b4c96b21129971b7765882e7d9
MD5 51a95db2a6288c2e11a3925e5c3538b5
SHA1 2f7b29cbd861129b6e56b0652fe551d88f1a5fe6
SHA512 de329157e9e8e5de46f320a6ebfd9c0854c8787e534e5bf88f6c3aaddb94870292e481c929c8b37bbbe501095a60b2a3214bc080c889e178c2083a45030591a6
SSDEEP 12288:ErD6i4ccx1svhmky5X7mV0W0zQzclKJsnBEnBG4r0II1am4OW46x:ErB4cisSBWWicU4EnBzYhaN
MD5 SHA1 SHA512 SSDEEP

windows x86

Minor OS version

Major OS version

Entry point

44455

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleHandleA CreateFileA FindActCtxSectionGuid WriteConsoleInputA GetWindowsDirectoryA FindFirstVolumeMountPointA CreateDirectoryExW GlobalFlags WaitForSingleObject ReadConsoleInputA VerifyVersionInfoW GetVersionExA GetCurrentProcess OpenEventW CreateFileMappingA GetLocaleInfoW GetProcAddress LoadLibraryA GlobalAlloc DeleteTimerQueueTimer GetConsoleTitleA CopyFileA FindResourceA SetPriorityClass SetLastError GetProfileSectionW WriteProfileStringW GetConsoleAliasA WritePrivateProfileSectionA SetVolumeMountPointW EnumResourceLanguagesW TransactNamedPipe _hread EnumDateFormatsW ActivateActCtx DeleteVolumeMountPointA WritePrivateProfileStringA GetSystemDirectoryA GetStringTypeA GetLongPathNameA FindNextFileW EnumCalendarInfoA LocalAlloc ReleaseActCtx SetCriticalSectionSpinCount SetFilePointer WriteConsoleW LoadLibraryW FlushFileBuffers GetConsoleMode GetConsoleCP InterlockedIncrement InterlockedDecrement Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection EncodePointer DecodePointer GetLastError HeapFree RtlUnwind RaiseException DeleteFileA GetCommandLineW HeapSetInformation GetStartupInfoW WideCharToMultiByte LCMapStringW MultiByteToWideChar GetCPInfo HeapAlloc IsProcessorFeaturePresent HeapCreate TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW GetCurrentThreadId GetACP GetOEMCP IsValidCodePage UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess CloseHandle ExitProcess WriteFile GetStdHandle GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetStringTypeW HeapReAlloc HeapSize GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale SetStdHandle CreateFileW

user32

GetMenuBarInfo GetMessageTime

shell32

FindExecutableA

ole32

CoGetInstanceFromIStorage

Name

.text

Size

96KB

Virtual Size

96KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

585KB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rovir

Size

512B

Virtual Size

5B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.kobozot

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.napopo

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.wek

Size

512B

Virtual Size

150B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

1e3f34f35c7965dfdb4cd19f20a43eee4007a7b4c96b21129971b7765882e7d9

kernel32

user32

shell32

ole32