54c6d2add8e3305ef20f8c2d2d720f5b

Sharing

Copy URL Twitter E-mail

General

Target
54c6d2add8e3305ef20f8c2d2d720f5b
Size 479KB
Sample231226-e9jp8agae9
SHA256 08a3a395a92a4bc50c2023dc3ab4b118beb8155e1fa2834113121b4d48b0702e
MD5 54c6d2add8e3305ef20f8c2d2d720f5b
SHA1 b394bb279053d97a2016d8aad1866916ee646dfd
SHA512 5f538829c4698bed8d0f2c62215e1cb7ef3e19210743c02871f649e8731a1dc3150a60a91f6d4b0cb07c4909a483b9910f1e90533888bb515850d4b8a798b140
SSDEEP 12288:rtOzkjUBvCkfmvz756FGtkeSUknzp7tRuvftbOb8:RwkjUV5a75G0OtXggb8
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
54c6d2add8e3305ef20f8c2d2d720f5b

File Explorer

54c6d2add8e3305ef20f8c2d2d720f5b

.exe 479KB

54c6d2add8e3305ef20f8c2d2d720f5b

IMPHASH 652eebd036ccccbae27ca0644be1652a
SHA256 08a3a395a92a4bc50c2023dc3ab4b118beb8155e1fa2834113121b4d48b0702e
MD5 54c6d2add8e3305ef20f8c2d2d720f5b
SHA1 b394bb279053d97a2016d8aad1866916ee646dfd
SHA512 5f538829c4698bed8d0f2c62215e1cb7ef3e19210743c02871f649e8731a1dc3150a60a91f6d4b0cb07c4909a483b9910f1e90533888bb515850d4b8a798b140
SSDEEP 12288:rtOzkjUBvCkfmvz756FGtkeSUknzp7tRuvftbOb8:RwkjUV5a75G0OtXggb8
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

31539

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

ws2_32

WSAStartup socket htonl gethostbyname htons connect send recv closesocket WSACleanup

kernel32

MapViewOfFile GetLastError OpenFileMappingW CreateThread WaitForSingleObject FreeLibrary GetProcAddress LoadLibraryW lstrcatW GetModuleHandleW DeleteFileW EnumResourceNamesW LocalFree lstrlenW GetModuleFileNameW GetCurrentProcessId SetCurrentDirectoryW UnmapViewOfFile ExitProcess TerminateThread FindResourceW SizeofResource WriteFile CreateFileW LockResource LoadResource GlobalFree GlobalAlloc GetVersionExW SetEvent GetCurrentDirectoryW CreateEventW GetExitCodeProcess GetProcessId CloseHandle CreateDirectoryW GetFileAttributesW RemoveDirectoryW FindNextFileW FindClose FindFirstFileW GetLongPathNameW GetTempFileNameW GetTempPathW ReadFile SetFilePointer GetCommandLineW GetCurrentProcess

user32

CreateWindowExW RegisterClassW PostMessageW LoadStringW MoveWindow SetLayeredWindowAttributes GetSystemMetrics SetForegroundWindow SetWindowPos GetWindowThreadProcessId EnumWindows TranslateMessage DispatchMessageW GetMessageW DestroyWindow UnregisterClassW DefWindowProcW

advapi32

RegCreateKeyW RegCloseKey RegDeleteKeyW RegOpenKeyExW GetTokenInformation OpenProcessToken DuplicateTokenEx ConvertStringSidToSidW GetLengthSid SetTokenInformation RegQueryValueExW CreateProcessAsUserW

shell32

CommandLineToArgvW SHFileOperationW ShellExecuteExW

Name

.text

Size

34KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.MAIN

Size

1024B

Virtual Size

524B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.SPLASH

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

434KB

Virtual Size

433KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

54c6d2add8e3305ef20f8c2d2d720f5b

ws2_32

kernel32

user32

advapi32

shell32

generic