ab256786befd9fad579a246a5e318755380557302f46cd3b22d3216f2824aaf1

Sharing

Copy URL Twitter E-mail

General

Target
ab256786befd9fad579a246a5e318755380557302f46cd3b22d3216f2824aaf1
Size 1.7MB
Sample231012-l96cjscf2s
SHA256 ab256786befd9fad579a246a5e318755380557302f46cd3b22d3216f2824aaf1
MD5 75daf33cf6978d298442b033a0b29fc2
SHA1 8c24586e9325afd175eff0414af26f52a304e54b
SHA512 4ab02047169f512aed0d59b87bc41dabb57cea9bf0fdfecdba60826b22e844f1fd3168dfaa55bc884c7f5fd878ba4343b42e0b888c19b73e8d6659f08b2f0640
SSDEEP 12288:I/BCWHrJveuseTKA9u7WoNfct4B4Hcl8SxzR6SQto8Jn:K51eA6WoNfo4Ghq6SQtoEn
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ab256786befd9fad579a246a5e318755380557302f46cd3b22d3216f2824aaf1

File Explorer

ab256786befd9fad579a246a5e318755380557302f46cd3b22d3216f2824aaf1

.exe 1.7MB

ab256786befd9fad579a246a5e318755380557302f46cd3b22d3216f2824aaf1

IMPHASH fe8ffd25d9017ca44a3e91b00462318b
SHA256 ab256786befd9fad579a246a5e318755380557302f46cd3b22d3216f2824aaf1
MD5 75daf33cf6978d298442b033a0b29fc2
SHA1 8c24586e9325afd175eff0414af26f52a304e54b
SHA512 4ab02047169f512aed0d59b87bc41dabb57cea9bf0fdfecdba60826b22e844f1fd3168dfaa55bc884c7f5fd878ba4343b42e0b888c19b73e8d6659f08b2f0640
SSDEEP 12288:I/BCWHrJveuseTKA9u7WoNfct4B4Hcl8SxzR6SQto8Jn:K51eA6WoNfo4Ghq6SQtoEn
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

133423

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

ntdll

RtlUnwind NtTerminateProcess NtSetInformationProcess RtlImageNtHeader

kernel32

GetCurrentThreadId ResumeThread GetThreadContext SetThreadContext FlushInstructionCache VirtualAlloc VirtualProtect VirtualFree VirtualQuery SetLastError FreeLibrary GetModuleHandleW GetProcAddress LoadLibraryExW LoadLibraryA GetCommandLineA GetCurrentProcess CloseHandle ReleaseMutex WaitForSingleObject CreateMutexA GetCurrentProcessId ExitProcess TerminateProcess GetModuleHandleA IsDebuggerPresent LocalFree FormatMessageA IsBadReadPtr GetLongPathNameA GetModuleFileNameA SetStdHandle GetProcessHeap GetLastError CreateFileW HeapSize SetEndOfFile QueryPerformanceCounter FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetOEMCP GetACP IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW WriteConsoleW GetSystemTimeAsFileTime InitializeSListHead WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx GetStringTypeW GetCPInfo RaiseException InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleExW GetModuleFileNameW GetStdHandle WriteFile HeapAlloc HeapFree LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage

user32

wsprintfA MessageBoxA

advapi32

RegQueryValueExA RegCreateKeyExA RegCloseKey RegSetValueExA

ws2_32

WSAStartup WSACleanup

Name

.text

Size

265KB

Virtual Size

265KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1.3MB

Virtual Size

1.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

176KB

Virtual Size

32.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.detourc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.detourd

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ