e6c5e90b3a632f3c9cc42ea4155f0f68377433d994e8f021f50509d64e37d632

Sharing

Copy URL Twitter E-mail

General

Target
e6c5e90b3a632f3c9cc42ea4155f0f68377433d994e8f021f50509d64e37d632
Size 17KB
Sample240108-bd9d8aaee8
SHA256 e6c5e90b3a632f3c9cc42ea4155f0f68377433d994e8f021f50509d64e37d632
MD5 2f08915c494a728dfee8957e8c79b319
SHA1 c3ed6e4df99e76ab45dbfea9227e7a91d0cb5a3c
SHA512 6d2fa8e00206363d7ec0a92e68febbb7c92a1df83edb04b0082bc9ea52ce065f193eb63fcde6c3eabfa4e4d032b3d98150ee7c18127fda02c7ff18948f9bdcf7
SSDEEP 192:LFBkqyIfgm64++u6gzYMzZ0dqsEq65+O0I5L0pJ/WDvd0EtITbKH62RTs2/fX+b:LFfoQ+DfYMzKdPEsOuubuEG3KHM2/O
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e6c5e90b3a632f3c9cc42ea4155f0f68377433d994e8f021f50509d64e37d632

File Explorer

e6c5e90b3a632f3c9cc42ea4155f0f68377433d994e8f021f50509d64e37d632

.exe 17KB

e6c5e90b3a632f3c9cc42ea4155f0f68377433d994e8f021f50509d64e37d632

IMPHASH 20c3dae8b5858a3256f3a0cb80094852
SHA256 e6c5e90b3a632f3c9cc42ea4155f0f68377433d994e8f021f50509d64e37d632
MD5 2f08915c494a728dfee8957e8c79b319
SHA1 c3ed6e4df99e76ab45dbfea9227e7a91d0cb5a3c
SHA512 6d2fa8e00206363d7ec0a92e68febbb7c92a1df83edb04b0082bc9ea52ce065f193eb63fcde6c3eabfa4e4d032b3d98150ee7c18127fda02c7ff18948f9bdcf7
SSDEEP 192:LFBkqyIfgm64++u6gzYMzZ0dqsEq65+O0I5L0pJ/WDvd0EtITbKH62RTs2/fX+b:LFfoQ+DfYMzKdPEsOuubuEG3KHM2/O
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10645

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetDriveTypeW CreateProcessW GetLogicalDriveStringsW WriteFile ReadFile CreateFileW FlushFileBuffers GetLastError SetFilePointer FindClose LocalAlloc FindNextFileW LocalFree ExpandEnvironmentStringsW CreateThread DecodePointer IsDebuggerPresent FindFirstFileW CreateMutexW GetFileSize GetEnvironmentVariableW GetCurrentDirectoryW ExitProcess IsProcessorFeaturePresent GetTickCount64 GetSystemTimeAsFileTime GetCurrentThreadId QueryPerformanceCounter EncodePointer

user32

wsprintfW

advapi32

RegCloseKey CryptGenRandom RegCreateKeyW CryptAcquireContextW RegSetValueExW

shell32

ShellExecuteW

ntdll

NtClose RtlAdjustPrivilege NtDelayExecution

urlmon

URLDownloadToFileW URLOpenBlockingStreamW

msvcp110

?_Xlength_error@std@@YAXPBD@Z ?_Winerror_map@std@@YAPBDH@Z ?_Syserror_map@std@@YAPBDH@Z ?_Xbad_alloc@std@@YAXXZ ?_Xout_of_range@std@@YAXPBD@Z

msvcr110

memcpy __CxxFrameHandler3 _CxxThrowException memmove wcsstr _purecall ??3@YAXPAX@Z ??2@YAPAXI@Z _lock _unlock _calloc_crt __dllonexit _onexit _crt_debugger_hook __crtUnhandledException __crtTerminateProcess ??1type_info@@UAE@XZ _XcptFilter __crtGetShowWindowMode _amsg_exit __wgetmainargs __set_app_type exit _exit _cexit _configthreadlocale __setusermatherr _initterm_e _initterm _wcmdln _fmode _commode _except_handler4_common ?terminate@@YAXXZ __crtSetUnhandledExceptionFilter _invoke_watson _controlfp_s memset

Sharing

General

Malware Config

Signatures

File Explorer

e6c5e90b3a632f3c9cc42ea4155f0f68377433d994e8f021f50509d64e37d632

kernel32

user32

advapi32

shell32

ntdll

urlmon

msvcp110

msvcr110

generic