e1a43c5dade2825c2dfa9ef9c41c552709f15875174c9[.]exe

General

Target
e1a43c5dade2825c2dfa9ef9c41c552709f15875174c9.exe
Size 189KB
Sample231229-vcs6dsecfl
SHA256 e1a43c5dade2825c2dfa9ef9c41c552709f15875174c97af87d1884ca5575e2a
MD5 a489451e7885c377550df325bc4ca9ae
SHA1 21c72370f35211453e7a138a2e3aadf1f3c5fe1d
SHA512 5afb5e509f9825eee48e6f444d74ad8eada8ba8f7a6215748c6c984d5a4d0e52420d779f24ef9253754a1ce1f59a1d219d80441bb15cb11046ca75e48c414022
SSDEEP 3072:3WaSGPZLPR20g8j4b18685gHlQT63Naazy4i1WDCT6/z:GaS+LJBA585L63NaaUZT6
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e1a43c5dade2825c2dfa9ef9c41c552709f15875174c9.exe

File Explorer

e1a43c5dade2825c2dfa9ef9c41c552709f15875174c9.exe

.exe 189KB

e1a43c5dade2825c2dfa9ef9c41c552709f15875174c9.exe

IMPHASH 6ea8c534c28e2062536233b200d3f650
SHA256 e1a43c5dade2825c2dfa9ef9c41c552709f15875174c97af87d1884ca5575e2a
MD5 a489451e7885c377550df325bc4ca9ae
SHA1 21c72370f35211453e7a138a2e3aadf1f3c5fe1d
SHA512 5afb5e509f9825eee48e6f444d74ad8eada8ba8f7a6215748c6c984d5a4d0e52420d779f24ef9253754a1ce1f59a1d219d80441bb15cb11046ca75e48c414022
SSDEEP 3072:3WaSGPZLPR20g8j4b18685gHlQT63Naazy4i1WDCT6/z:GaS+LJBA585L63NaaUZT6
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

15936

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

LoadResource UpdateResourceA CreateJobObjectW SetComputerNameW GetComputerNameW CreateHardLinkA GetConsoleAliasesLengthA GetWindowsDirectoryA GlobalFindAtomA LoadLibraryW GetConsoleMode GetSystemWindowsDirectoryA GetVersionExW DnsHostnameToComputerNameW EnumResourceLanguagesA CreateFileW GetVolumePathNameA InterlockedExchange OpenMutexW GetLastError GetStringTypeA BackupRead GetProcAddress VirtualAlloc BeginUpdateResourceW RemoveDirectoryA WriteConsoleA InterlockedExchangeAdd LocalAlloc FindFirstVolumeMountPointW AddAtomW GetCommMask GetModuleHandleA FindFirstChangeNotificationA GetCurrentProcessId OpenFileMappingA SuspendThread lstrcpyA SetLastError HeapCompact InterlockedIncrement InterlockedDecrement Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW RaiseException RtlUnwind HeapFree GetModuleHandleW ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetCPInfo GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId TerminateProcess GetCurrentProcess IsDebuggerPresent HeapAlloc GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime HeapSize HeapReAlloc GetLocaleInfoA MultiByteToWideChar GetStringTypeW LoadLibraryA InitializeCriticalSectionAndSpinCount LCMapStringA WideCharToMultiByte LCMapStringW

user32

CharLowerBuffA

gdi32

GetDeviceGammaRamp

Sharing