urelas | 97aab0a912875f65ae91d3d67e5b4541

Sharing

Copy URL Twitter E-mail

General

Target
97aab0a912875f65ae91d3d67e5b4541
Size 441KB
Sample231222-qbtnbadfbp
SHA256 43a6dbabf9d91478c9763b315004b2066d4f8dd539c223a0813cbba409253c96
MD5 97aab0a912875f65ae91d3d67e5b4541
SHA1 dff953da77d139e9f7ecd6292d548d1df0cf46cf
SHA512 23c9033497f6337811e878f24b43a64f6e3065699d60d31b803b93796988ec186ecfe69c699b11da5322efe0e4f8da7cd5c4c198009db8149315f63f47e40714
SSDEEP 6144:oo3wBi+1Py3V0a2WkRNgi3caOHO5NjEwwiYWB5mV4Pzw9ygibGGMRJ2:rKf1PyKa2H3hOHOHz9JQ6zBGI
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

urelas

Malware Config

Signatures

Urelas family
urelas

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
97aab0a912875f65ae91d3d67e5b4541

File Explorer

97aab0a912875f65ae91d3d67e5b4541

.exe 441KB

97aab0a912875f65ae91d3d67e5b4541

IMPHASH b6852ed4e334147c4929ea4ff7285899
SHA256 43a6dbabf9d91478c9763b315004b2066d4f8dd539c223a0813cbba409253c96
MD5 97aab0a912875f65ae91d3d67e5b4541
SHA1 dff953da77d139e9f7ecd6292d548d1df0cf46cf
SHA512 23c9033497f6337811e878f24b43a64f6e3065699d60d31b803b93796988ec186ecfe69c699b11da5322efe0e4f8da7cd5c4c198009db8149315f63f47e40714
SSDEEP 6144:oo3wBi+1Py3V0a2WkRNgi3caOHO5NjEwwiYWB5mV4Pzw9ygibGGMRJ2:rKf1PyKa2H3hOHOHz9JQ6zBGI
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

50522

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetFileSizeEx CloseHandle GetSystemDirectoryW GetTempPathW GetFileAttributesW GetTickCount GetLastError ReadFile SetFilePointer WriteFile FlushFileBuffers CreateFileA DeviceIoControl Sleep SetFileAttributesW DeleteFileW GetCurrentProcessId TerminateProcess GetProcAddress GetTempPathA GetModuleFileNameA SystemTimeToFileTime GetCurrentDirectoryW LocalFileTimeToFileTime WideCharToMultiByte CreateFileW OpenEventW CreateEventW CreateThread SetEndOfFile HeapReAlloc LoadLibraryW SetStdHandle WriteConsoleW HeapSize GetSystemTimeAsFileTime QueryPerformanceCounter GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW GetVersionExW MultiByteToWideChar FreeResource LockResource LoadResource SizeofResource GetModuleFileNameW FindResourceW IsProcessorFeaturePresent DeleteCriticalSection GetFileType SetHandleCount GetStringTypeW IsValidCodePage GetOEMCP GetACP GetCPInfo HeapCreate GetStdHandle GetConsoleMode GetConsoleCP RtlUnwind InitializeCriticalSectionAndSpinCount LeaveCriticalSection EnterCriticalSection RaiseException GetModuleHandleW ExitProcess InterlockedDecrement GetCurrentThreadId HeapAlloc HeapFree GetCommandLineW HeapSetInformation GetStartupInfoW GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer DecodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement SetLastError GetProcessHeap

user32

LoadCursorW RegisterClassExW LoadStringW wsprintfW LoadIconW CreateWindowExW EndDialog PostQuitMessage EndPaint BeginPaint DefWindowProcW DestroyWindow DialogBoxParamW

advapi32

RegQueryValueExW RegCloseKey RegSetValueExW RegOpenKeyExW

shell32

ShellExecuteA ShellExecuteW

ws2_32

htonl gethostbyaddr WSAStartup socket gethostbyname inet_addr htons connect closesocket send recv WSAGetLastError

iphlpapi

GetAdaptersInfo