84630d3a3fce1c6a424a0a13f645fb995cb69c0829c4dde384806d08a6f8e94b

General

Target
84630d3a3fce1c6a424a0a13f645fb995cb69c0829c4dde384806d08a6f8e94b
Size 1.6MB
Sample230825-fezcvshc39
SHA256 84630d3a3fce1c6a424a0a13f645fb995cb69c0829c4dde384806d08a6f8e94b
MD5 7db9dd5aa17476727fa4321088a26fc3
SHA1 798e8db4d86bc714553ee5b715a2e49ae14887cc
SHA512 0b0e9bd7f45e0ed282058119e68c71f8d6b5ed35b573bd4969770dc8d845de1a3fdc834e7fa5ce98bbc1355b9797acd7ba3e2676d2019e1ea1fcdf8b5481ef7b
SSDEEP 49152:PRGqZwl190Zh2FotehTNa63fQfslf8j/:U0Zh2qtehQF
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
84630d3a3fce1c6a424a0a13f645fb995cb69c0829c4dde384806d08a6f8e94b

File Explorer

84630d3a3fce1c6a424a0a13f645fb995cb69c0829c4dde384806d08a6f8e94b

.exe 1.6MB

84630d3a3fce1c6a424a0a13f645fb995cb69c0829c4dde384806d08a6f8e94b

IMPHASH 0ec4a323102601b2420df41f5a796f75
SHA256 84630d3a3fce1c6a424a0a13f645fb995cb69c0829c4dde384806d08a6f8e94b
MD5 7db9dd5aa17476727fa4321088a26fc3
SHA1 798e8db4d86bc714553ee5b715a2e49ae14887cc
SHA512 0b0e9bd7f45e0ed282058119e68c71f8d6b5ed35b573bd4969770dc8d845de1a3fdc834e7fa5ce98bbc1355b9797acd7ba3e2676d2019e1ea1fcdf8b5481ef7b
SSDEEP 49152:PRGqZwl190Zh2FotehTNa63fQfslf8j/:U0Zh2qtehQF
MD5 SHA1 SHA512 SSDEEP

windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

198878

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

gdi32

GetViewportExtEx CreatePalette GetTextExtentPointI DeleteObject

user32

GetDC ReleaseDC SetForegroundWindow FindWindowA GetDesktopWindow LockWindowUpdate MapWindowPoints PaintDesktop UnregisterHotKey

ole32

OleInitialize OleUninitialize CoGetCancelObject CoGetObjectContext CreateDataAdviseHolder CoGetStdMarshalEx CoGetApartmentType

kernel32

CreateFileW HeapSize SetStdHandle OutputDebugStringW GetProcessHeap SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetTimeZoneInformation HeapReAlloc ReadConsoleW SetFilePointerEx GetCurrentThreadId Sleep RaiseException RtlCaptureStackBackTrace IsProcessorFeaturePresent GetLastError FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetModuleHandleExW MultiByteToWideChar InitializeConditionVariable WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW InitOnceComplete InitOnceBeginInitialize FormatMessageA GetStringTypeW InitializeSRWLock ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WideCharToMultiByte CloseHandle WaitForSingleObjectEx SwitchToThread GetExitCodeThread GetNativeSystemInfo QueryPerformanceCounter QueryPerformanceFrequency EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LocalFree GetLocaleInfoEx LCMapStringEx SetFileInformationByHandle GetTempPathW FlsAlloc FlsGetValue FlsSetValue FlsFree InitOnceExecuteOnce SleepConditionVariableCS CreateEventExW CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber GetSystemTimeAsFileTime GetTickCount64 CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait GetModuleHandleW GetProcAddress GetFileInformationByHandleEx CreateSymbolicLinkW CompareStringEx GetCPInfo InitializeCriticalSectionAndSpinCount SetEvent ResetEvent CreateEventW UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsDebuggerPresent GetStartupInfoW GetCurrentProcessId InitializeSListHead GetFileSizeEx RtlUnwind InterlockedPushEntrySList InterlockedFlushSList SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW CreateThread ExitThread ResumeThread FreeLibraryAndExitThread ExitProcess GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW SetConsoleCtrlHandler HeapAlloc HeapFree GetCurrentThread GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile WriteConsoleW

Name

.text

Size

554KB

Virtual Size

553KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

664KB

Virtual Size

664KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

22KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Caut

Size

384KB

Virtual Size

384KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

84630d3a3fce1c6a424a0a13f645fb995cb69c0829c4dde384806d08a6f8e94b

gdi32

user32

ole32

kernel32