0120cbfca6034db079bffb470b28d2d6

General

Target
0120cbfca6034db079bffb470b28d2d6
Size 158KB
Sample231229-xpharsaef4
SHA256 174fedef472738f40a4e642fdd6c21fa68c3d2058e80efc63b0c1a683486f6c2
MD5 0120cbfca6034db079bffb470b28d2d6
SHA1 95c417050c62a842c53b11987cfb044fe153899a
SHA512 b271255d79a5203ea9f924cac138130c9bbec82cc81f26ac7404cec18c5abf9d37b1f7b68597e82ee449138b1136bda227592b6c204657c3ab17a30adb5b3a7f
SSDEEP 3072:PwZDE3irQ+r+4rLczkGq9n7zCXCdFMYNzomI+pt79s2:9irQ+r+2aTq9CyYYNzo12
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0120cbfca6034db079bffb470b28d2d6

File Explorer

0120cbfca6034db079bffb470b28d2d6

.dll 158KB

0120cbfca6034db079bffb470b28d2d6

IMPHASH 7a8f5c045c96b48f56193a62510f2131
SHA256 174fedef472738f40a4e642fdd6c21fa68c3d2058e80efc63b0c1a683486f6c2
MD5 0120cbfca6034db079bffb470b28d2d6
SHA1 95c417050c62a842c53b11987cfb044fe153899a
SHA512 b271255d79a5203ea9f924cac138130c9bbec82cc81f26ac7404cec18c5abf9d37b1f7b68597e82ee449138b1136bda227592b6c204657c3ab17a30adb5b3a7f
SSDEEP 3072:PwZDE3irQ+r+4rLczkGq9n7zCXCdFMYNzomI+pt79s2:9irQ+r+2aTq9CyYYNzo12
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

68904

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

CreateFileA FindFirstFileA CreatePipe PeekNamedPipe GetLastError FindNextFileA GetTickCount GetProcessHeap LoadLibraryA GetProcAddress ReadFile ExitProcess QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW RtlUnwindEx InterlockedFlushSList RtlPcToFileHeader RaiseException SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetCurrentProcess TerminateProcess GetModuleHandleExW GetModuleFileNameA MultiByteToWideChar WideCharToMultiByte HeapFree HeapAlloc FindClose FindFirstFileExA IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW GetStdHandle GetFileType GetStringTypeW HeapSize HeapReAlloc SetStdHandle WriteFile FlushFileBuffers GetConsoleCP GetConsoleMode SetFilePointerEx WriteConsoleW CloseHandle CreateFileW

Name

.text

Size

103KB

Virtual Size

102KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

37KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

176B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

0120cbfca6034db079bffb470b28d2d6

kernel32

generic