3cd20ea6315f61d14772c2dc8a4774750f95ebf6511989316e5f5bce906713f8

Sharing

Copy URL Twitter E-mail

General

Target
3cd20ea6315f61d14772c2dc8a4774750f95ebf6511989316e5f5bce906713f8
Size 786KB
Sample231008-ve19sagg97
SHA256 3cd20ea6315f61d14772c2dc8a4774750f95ebf6511989316e5f5bce906713f8
MD5 0f53a380234b0ff0b17f962dc4ea23be
SHA1 a72ac0a564f9034591c7120bdd44152e0855170d
SHA512 df15ff679fa73a187346cb88d0ac751491f490c903999d0328439f916c7ef4dec7771399dcd8e13907e7e98af4d6f1192d65c83877b5a6a38077f643384b6357
SSDEEP 12288:e3kuCgXOhtw8uJ03JINmbiQV22yNm+cK8DkkstNY3YaoZyDURc0xdTp2hlI1kQIK:btgXO3JW0DiMBOzZTKYaOVxdN2/I
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3cd20ea6315f61d14772c2dc8a4774750f95ebf6511989316e5f5bce906713f8

File Explorer

3cd20ea6315f61d14772c2dc8a4774750f95ebf6511989316e5f5bce906713f8

.exe 786KB

3cd20ea6315f61d14772c2dc8a4774750f95ebf6511989316e5f5bce906713f8

IMPHASH b5c6438640df57092a1d264477a39c24
SHA256 3cd20ea6315f61d14772c2dc8a4774750f95ebf6511989316e5f5bce906713f8
MD5 0f53a380234b0ff0b17f962dc4ea23be
SHA1 a72ac0a564f9034591c7120bdd44152e0855170d
SHA512 df15ff679fa73a187346cb88d0ac751491f490c903999d0328439f916c7ef4dec7771399dcd8e13907e7e98af4d6f1192d65c83877b5a6a38077f643384b6357
SSDEEP 12288:e3kuCgXOhtw8uJ03JINmbiQV22yNm+cK8DkkstNY3YaoZyDURc0xdTp2hlI1kQIK:btgXO3JW0DiMBOzZTKYaOVxdN2/I
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

20132

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetConsoleAliasesLengthW GetModuleHandleExA CommConfigDialogA FindResourceW OpenJobObjectA InterlockedDecrement SetDefaultCommConfigW QueryPerformanceCounter GetEnvironmentStringsW InterlockedCompareExchange WriteConsoleInputA OpenSemaphoreA CreateHardLinkA SetTapeParameters SetThreadUILanguage FindNextVolumeMountPointA ConvertFiberToThread ReadConsoleW GetCompressedFileSizeW GetConsoleAliasExesW WaitNamedPipeW WriteFile EnumTimeFormatsW GetCommandLineA GetDriveTypeA GetVolumePathNameW FindResourceExA GetConsoleCP GlobalAlloc LoadLibraryW GetConsoleMode GetLocaleInfoW ReadConsoleInputA CopyFileW GetCalendarInfoA SetConsoleCP DeleteVolumeMountPointW GetFileAttributesA EnumSystemCodePagesA SetConsoleMode WriteConsoleInputW IsDBCSLeadByte GetACP CreateMailslotW GetShortPathNameA GetNamedPipeHandleStateW GetConsoleAliasesW InterlockedExchange GetStartupInfoA GetLastError SetLastError ReadConsoleOutputCharacterA PeekConsoleInputW SetVolumeLabelW RemoveDirectoryA EnumSystemCodePagesW FreeUserPhysicalPages SetComputerNameA FindClose GetAtomNameA SetCalendarInfoW MoveFileA SetConsoleCtrlHandler AddAtomA HeapWalk SetCommMask GetPrivateProfileSectionNamesA FindNextFileA EnumDateFormatsA _lread GetModuleHandleA FreeEnvironmentStringsW GetStringTypeW VirtualProtect PeekConsoleInputA GetWindowsDirectoryW FindFirstVolumeW GetVolumeNameForVolumeMountPointW DeleteFileW WriteConsoleW GetComputerNameA GetTempFileNameW SetSystemPowerState GetCommandLineW WideCharToMultiByte HeapFree HeapAlloc GetProcAddress GetModuleHandleW ExitProcess DecodePointer HeapReAlloc HeapSetInformation GetStartupInfoW RaiseException GetCPInfo InterlockedIncrement GetOEMCP IsValidCodePage EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree GetCurrentThreadId UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess IsProcessorFeaturePresent HeapCreate GetStdHandle GetModuleFileNameW EnterCriticalSection LeaveCriticalSection SetFilePointer SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection CloseHandle GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LCMapStringW MultiByteToWideChar Sleep SetStdHandle FlushFileBuffers RtlUnwind HeapSize CreateFileW

user32

CharUpperA CharUpperBuffA

gdi32

GetTextFaceA

advapi32

RevertToSelf

winhttp

WinHttpWriteData