20e3b7d04d121321733b6eb698a09138

Sharing

Copy URL Twitter E-mail

General

Target
20e3b7d04d121321733b6eb698a09138
Size 164KB
Sample231231-aalcjsbgd3
SHA256 33578b9c002760c65df50edee28db75dab43e5e55019852cd63d77e5c870c06f
MD5 20e3b7d04d121321733b6eb698a09138
SHA1 5e1f1b0fb181c523db6d58ccc8eb91f43231457a
SHA512 52282718088e24a82aad2f084a64629004737f8f0569ddcb1128b629f6fba13686b48d48fa886ff0c6fe10d3c9a1b70835f7d0ba939297ff1b432e41fe27518f
SSDEEP 3072:iEBgM/gPzVNBoQxJbhzHZJ6uwNHNhqlHSSseyVIj42zCgwUzHLg:ij3PBoQRzHZr4hqVS6yVIU2X
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
20e3b7d04d121321733b6eb698a09138

File Explorer

20e3b7d04d121321733b6eb698a09138

.dll 164KB

20e3b7d04d121321733b6eb698a09138

IMPHASH ca0310f5952ba26baacaa23422e709e9
SHA256 33578b9c002760c65df50edee28db75dab43e5e55019852cd63d77e5c870c06f
MD5 20e3b7d04d121321733b6eb698a09138
SHA1 5e1f1b0fb181c523db6d58ccc8eb91f43231457a
SHA512 52282718088e24a82aad2f084a64629004737f8f0569ddcb1128b629f6fba13686b48d48fa886ff0c6fe10d3c9a1b70835f7d0ba939297ff1b432e41fe27518f
SSDEEP 3072:iEBgM/gPzVNBoQxJbhzHZJ6uwNHNhqlHSSseyVIj42zCgwUzHLg:ij3PBoQRzHZr4hqVS6yVIU2X
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

61456

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

GetProcessHeap HeapAlloc HeapReAlloc HeapFree HeapSize QueryFullProcessImageNameA FindNextStreamW ReadConsoleOutputAttribute RtlCaptureContext RemoveDirectoryA ReadConsoleInputA GetCurrentDirectoryA OpenThread LoadLibraryA GetProcAddress VirtualAlloc WriteConsoleW CreateFileW CloseHandle SetFilePointerEx GetConsoleMode GetConsoleCP FlushFileBuffers WriteFile SetStdHandle GetStringTypeW GetFileType VirtualFree VirtualProtect GetStdHandle LCMapStringW RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwindEx InterlockedFlushSList GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleHandleExW GetModuleFileNameA MultiByteToWideChar WideCharToMultiByte FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW RaiseException

user32

DdeSetQualityOfService RealGetWindowClassW IsIconic DialogBoxParamA InsertMenuItemW

ole32

OleRegGetUserType IsAccelerator ProgIDFromCLSID CLIPFORMAT_UserSize GetRunningObjectTable STGMEDIUM_UserSize CoUnmarshalInterface

gdi32

GetWindowExtEx D3DKMTGetPresentQueueEvent

shell32

ord716 DuplicateIcon ord19 ord154 ExtractIconA

Name

.text

Size

95KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

59KB

Virtual Size

58KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

148B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

512B

Virtual Size

376B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

20e3b7d04d121321733b6eb698a09138

kernel32

user32

ole32

gdi32

shell32

generic