0e34d4198c8b933017a31033ca56f499

Sharing

Copy URL Twitter E-mail

General

Target
0e34d4198c8b933017a31033ca56f499
Size 33KB
Sample231230-exaa1sbddr
SHA256 9d7b53634f0fd0681d4793078638f35658f043aa8405fc61da39696312e99d81
MD5 0e34d4198c8b933017a31033ca56f499
SHA1 b58b4f549778df2aae29c2155bca0262ad4c7269
SHA512 75c912a1b86e094064eee5482ea27c1de014e562bc5c936962e5f771074e7017ddfc8a53534debd37fbefb9f8ff7d0c557933ffa84b29f668d9b8b5f5b629daa
SSDEEP 768:8VsoiMXuYJmZTgM8wVoB7k8DEit4TzWy4jsoAsJ7Km:8yKeplnGJkjOe3wAsJ2m
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

0e34d4198c8b933017a31033ca56f499

.exe 33KB

0e34d4198c8b933017a31033ca56f499

IMPHASH a37c87a82002be6f9febf2286118f6dd
SHA256 9d7b53634f0fd0681d4793078638f35658f043aa8405fc61da39696312e99d81
MD5 0e34d4198c8b933017a31033ca56f499
SHA1 b58b4f549778df2aae29c2155bca0262ad4c7269
SHA512 75c912a1b86e094064eee5482ea27c1de014e562bc5c936962e5f771074e7017ddfc8a53534debd37fbefb9f8ff7d0c557933ffa84b29f668d9b8b5f5b629daa
SSDEEP 768:8VsoiMXuYJmZTgM8wVoB7k8DEit4TzWy4jsoAsJ7Km:8yKeplnGJkjOe3wAsJ2m
MD5 SHA1 SHA512 SSDEEP

PE Signature issue

Digest

2e:90:90:1f:7c:ee:e0:8e:cd:e1:7a:d4:cd:93:ce:c5:ed:4a:0b:df

Digest Algorithm

sha1

PE Digests Matches

Trusted

Not trusted

Signing Certificate

NO CERTIFICATE

Chains

Jan 1, 0001

Minor OS version

Major OS version

Entry point

49152

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

ws2_32

WSASocketA htonl sendto inet_addr gethostbyname WSAIoctl socket htons connect send select __WSAFDIsSet recv shutdown setsockopt closesocket WSAStartup

kernel32

FreeLibrary GetProcAddress LoadLibraryA GetSystemDirectoryA GetStartupInfoA lstrcpyA Sleep GetTickCount ResumeThread CreateProcessA SetThreadPriority GetCurrentThread SetPriorityClass GetCurrentProcess lstrcatA GetShortPathNameA GetModuleFileNameA GetEnvironmentVariableA CloseHandle TerminateProcess OpenProcess DuplicateHandle CreateFileA GetLastError DeviceIoControl GlobalFree LoadLibraryExA GlobalAlloc GetModuleHandleA WriteFile ReadFile GetFileSize SetFileAttributesA ExitProcess CopyFileA lstrcmpiA MoveFileA SetErrorMode lstrlenA WaitForSingleObject CreateThread CreateMutexA DeleteFileA InterlockedExchange OutputDebugStringA GlobalMemoryStatusEx GetCurrentProcessId VirtualAlloc VirtualQueryEx ReadProcessMemory GetThreadContext SetThreadContext WriteProcessMemory VirtualProtectEx VirtualFree GetWindowsDirectoryA GetVersionExA

user32

wsprintfA ExitWindowsEx wvsprintfA

advapi32

RegOpenKeyExA RegQueryValueExA DeleteService CreateServiceA RegOpenKeyA RegSetValueExA RegCloseKey RegisterServiceCtrlHandlerA SetServiceStatus StartServiceCtrlDispatcherA ControlService OpenSCManagerA OpenServiceA StartServiceA CloseServiceHandle OpenProcessToken LookupPrivilegeValueA AdjustTokenPrivileges

msvcrt

_ui64toa strstr strcspn atoi sprintf memmove _exit _XcptFilter exit _acmdln __getmainargs _initterm __setusermatherr _adjust_fdiv __p__commode __p__fmode __set_app_type _controlfp _strlwr _strnicmp rand srand strncpy ??2@YAPAXI@Z printf puts ??3@YAXPAX@Z __CxxFrameHandler _except_handler3

shell32

ShellExecuteA

Name

FSnacu:A

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

e]=L)sbO

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

4KqPxs*)

Size

7KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

A9.Ye&t1

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

U-^uUNPl

Size

512B

Virtual Size

512B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

UFRq`o<.

Size

389B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

0e34d4198c8b933017a31033ca56f499

PE Signature issue

ws2_32

kernel32

user32

advapi32

msvcrt

shell32

generic