49b7f939d4fa65e373e056eedd335830d3fa77db05b273c3b2f134000790d4cf

General

Target
49b7f939d4fa65e373e056eedd335830d3fa77db05b273c3b2f134000790d4cf
Size 206KB
Sample230607-y4fk6afe63
SHA256 49b7f939d4fa65e373e056eedd335830d3fa77db05b273c3b2f134000790d4cf
MD5 4b2e58f1c194f663b523bdce81c22163
SHA1 eb0b0800404a69c7f846a037b19025cd388d3fd3
SHA512 ae3ce646cc6197e682ac354803faff3f16b6d34ca384bdf86ee10977ba6808cba23ebbeb92f8f1a38578653c0cb0e6f806e0e667d33924323271d7a34d08b0f3
SSDEEP 3072:H/DmgskHbfHN+Pst60p0zuNmnKG7peNMQbuZAIqbey3lfbi:fDmfAfHN+wiuInRexuZAIij
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
49b7f939d4fa65e373e056eedd335830d3fa77db05b273c3b2f134000790d4cf

File Explorer

49b7f939d4fa65e373e056eedd335830d3fa77db05b273c3b2f134000790d4cf

.exe 206KB

49b7f939d4fa65e373e056eedd335830d3fa77db05b273c3b2f134000790d4cf

IMPHASH f8cc61ade86cb7277d0ab974de6323cb
SHA256 49b7f939d4fa65e373e056eedd335830d3fa77db05b273c3b2f134000790d4cf
MD5 4b2e58f1c194f663b523bdce81c22163
SHA1 eb0b0800404a69c7f846a037b19025cd388d3fd3
SHA512 ae3ce646cc6197e682ac354803faff3f16b6d34ca384bdf86ee10977ba6808cba23ebbeb92f8f1a38578653c0cb0e6f806e0e667d33924323271d7a34d08b0f3
SSDEEP 3072:H/DmgskHbfHN+Pst60p0zuNmnKG7peNMQbuZAIqbey3lfbi:fDmfAfHN+wiuInRexuZAIij
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

87711

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetFileAttributesA CreateFileA CloseHandle GetSystemInfo CreateThread HeapAlloc GetThreadContext GetProcAddress VirtualAllocEx LocalFree GetLastError ReadProcessMemory GetProcessHeap CreateProcessA CreateDirectoryA SetThreadContext WriteConsoleW ReadConsoleW SetEndOfFile SetFilePointerEx GetTempPathA Sleep SetCurrentDirectoryA GetModuleHandleA GetComputerNameExW ResumeThread GetVersionExW CreateMutexA VirtualAlloc WriteFile VirtualFree HeapFree WriteProcessMemory GetModuleFileNameA RemoveDirectoryA ReadFile HeapReAlloc HeapSize GetTimeZoneInformation GetConsoleMode GetConsoleCP FlushFileBuffers GetStringTypeW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose SetStdHandle GetFullPathNameW GetCurrentDirectoryW DeleteFileW LCMapStringW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetModuleHandleW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RaiseException SetLastError RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW CreateFileW GetDriveTypeW GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetModuleFileNameW GetStdHandle GetCommandLineA GetCommandLineW MultiByteToWideChar CompareStringW DecodePointer

advapi32

RegCloseKey RegQueryValueExA GetUserNameA RegSetValueExA RegOpenKeyExA ConvertSidToStringSidW GetUserNameW LookupAccountNameW

shell32

SHGetFolderPathA ShellExecuteA ord680 SHFileOperationA

wininet

HttpOpenRequestA InternetReadFile InternetConnectA HttpSendRequestA InternetCloseHandle InternetOpenA InternetOpenW InternetOpenUrlA

Sharing

General

Malware Config

Signatures

File Explorer

49b7f939d4fa65e373e056eedd335830d3fa77db05b273c3b2f134000790d4cf

kernel32

advapi32

shell32

wininet