d4f8778ffe23a475dc8a831fcc4d82d3e040b47048cd6d990678f7e42775f281

General

Target
d4f8778ffe23a475dc8a831fcc4d82d3e040b47048cd6d990678f7e42775f281
Size 207KB
Sample230608-evatrsbh63
SHA256 d4f8778ffe23a475dc8a831fcc4d82d3e040b47048cd6d990678f7e42775f281
MD5 36116e4061142314c5e69c9168bc9f8b
SHA1 331f4bdf94af7e27d133e97a09223b142d5ed9a5
SHA512 be600b3f3fe21fc54fbe50f08aa71ef08cde36eab0af8c2ff0e8c094739acbb9e4044a3ec6de1983e9cc07cab9a9c2150a73c9c33a3792342e1eb19b82037d45
SSDEEP 3072:H/DmgskHbfHN+Pst60p0zuNmnKG7peNMQbuZAIqbey3lfbi:fDmfAfHN+wiuInRexuZAIij
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d4f8778ffe23a475dc8a831fcc4d82d3e040b47048cd6d990678f7e42775f281

File Explorer

d4f8778ffe23a475dc8a831fcc4d82d3e040b47048cd6d990678f7e42775f281

.exe 207KB

d4f8778ffe23a475dc8a831fcc4d82d3e040b47048cd6d990678f7e42775f281

IMPHASH f8cc61ade86cb7277d0ab974de6323cb
SHA256 d4f8778ffe23a475dc8a831fcc4d82d3e040b47048cd6d990678f7e42775f281
MD5 36116e4061142314c5e69c9168bc9f8b
SHA1 331f4bdf94af7e27d133e97a09223b142d5ed9a5
SHA512 be600b3f3fe21fc54fbe50f08aa71ef08cde36eab0af8c2ff0e8c094739acbb9e4044a3ec6de1983e9cc07cab9a9c2150a73c9c33a3792342e1eb19b82037d45
SSDEEP 3072:H/DmgskHbfHN+Pst60p0zuNmnKG7peNMQbuZAIqbey3lfbi:fDmfAfHN+wiuInRexuZAIij
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

87711

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetFileAttributesA CreateFileA CloseHandle GetSystemInfo CreateThread HeapAlloc GetThreadContext GetProcAddress VirtualAllocEx LocalFree GetLastError ReadProcessMemory GetProcessHeap CreateProcessA CreateDirectoryA SetThreadContext WriteConsoleW ReadConsoleW SetEndOfFile SetFilePointerEx GetTempPathA Sleep SetCurrentDirectoryA GetModuleHandleA GetComputerNameExW ResumeThread GetVersionExW CreateMutexA VirtualAlloc WriteFile VirtualFree HeapFree WriteProcessMemory GetModuleFileNameA RemoveDirectoryA ReadFile HeapReAlloc HeapSize GetTimeZoneInformation GetConsoleMode GetConsoleCP FlushFileBuffers GetStringTypeW SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW WideCharToMultiByte GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose SetStdHandle GetFullPathNameW GetCurrentDirectoryW DeleteFileW LCMapStringW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount DeleteCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW GetModuleHandleW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RaiseException SetLastError RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW CreateFileW GetDriveTypeW GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime GetModuleFileNameW GetStdHandle GetCommandLineA GetCommandLineW MultiByteToWideChar CompareStringW DecodePointer

advapi32

RegCloseKey RegQueryValueExA GetUserNameA RegSetValueExA RegOpenKeyExA ConvertSidToStringSidW GetUserNameW LookupAccountNameW

shell32

SHGetFolderPathA ShellExecuteA ord680 SHFileOperationA

wininet

HttpOpenRequestA InternetReadFile InternetConnectA HttpSendRequestA InternetCloseHandle InternetOpenA InternetOpenW InternetOpenUrlA

Sharing

General

Malware Config

Signatures

File Explorer

d4f8778ffe23a475dc8a831fcc4d82d3e040b47048cd6d990678f7e42775f281

kernel32

advapi32

shell32

wininet