26bd4a40d12d5483b5cf8a0a2db0dddb151b0b3206079dcf2782834482a2c3b7

Sharing

Copy URL Twitter E-mail

General

Target
26bd4a40d12d5483b5cf8a0a2db0dddb151b0b3206079dcf2782834482a2c3b7
Size 684KB
Sample240112-225daaffcr
SHA256 26bd4a40d12d5483b5cf8a0a2db0dddb151b0b3206079dcf2782834482a2c3b7
MD5 d3d46d0339ceb24c85568e75f78846a7
SHA1 36f63066beba540453e1b93e6b1e282aed804234
SHA512 d669aaafddb658f88dd6d325883d7b568b9e6b6dc5914b0d7d9d01cf468f0e0521e05e5a7f46e0437e9389470f4f5ec751b416b94412956c2a208b0bccc8227c
SSDEEP 12288:vE1Gh9OfPNkHH1fl8Zjc38izOfdXacgGeOM0GejX6B:qM9ZZl4mGXjxeOMg4
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
26bd4a40d12d5483b5cf8a0a2db0dddb151b0b3206079dcf2782834482a2c3b7

File Explorer

26bd4a40d12d5483b5cf8a0a2db0dddb151b0b3206079dcf2782834482a2c3b7

.exe 684KB

26bd4a40d12d5483b5cf8a0a2db0dddb151b0b3206079dcf2782834482a2c3b7

IMPHASH 8e3dbf4dc3bd1abcd77059b0567f968f
SHA256 26bd4a40d12d5483b5cf8a0a2db0dddb151b0b3206079dcf2782834482a2c3b7
MD5 d3d46d0339ceb24c85568e75f78846a7
SHA1 36f63066beba540453e1b93e6b1e282aed804234
SHA512 d669aaafddb658f88dd6d325883d7b568b9e6b6dc5914b0d7d9d01cf468f0e0521e05e5a7f46e0437e9389470f4f5ec751b416b94412956c2a208b0bccc8227c
SSDEEP 12288:vE1Gh9OfPNkHH1fl8Zjc38izOfdXacgGeOM0GejX6B:qM9ZZl4mGXjxeOMg4
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

15379

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetComputerNameW BackupSeek GetModuleHandleW GetProcessHeap GetConsoleAliasesLengthA GetWindowsDirectoryA GetVolumePathNameW GlobalFindAtomA LoadLibraryW GetConsoleMode WriteConsoleW EnumResourceLanguagesA CreateFileW InterlockedExchange GetLastError SetLastError GetProcAddress VirtualAlloc SetComputerNameA OpenMutexA InterlockedIncrement DnsHostnameToComputerNameA CreateHardLinkW AddAtomW RemoveDirectoryW BeginUpdateResourceA GetCommMask OpenJobObjectW FindFirstVolumeMountPointA FindFirstChangeNotificationA GetStringTypeW GetVersionExA GetWindowsDirectoryW OpenFileMappingA SuspendThread lstrcpyA DebugActiveProcess LoadResource LocalAlloc InterlockedDecrement Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection GetStartupInfoW RaiseException RtlUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter HeapFree TerminateProcess GetCurrentProcess IsDebuggerPresent HeapAlloc ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime HeapSize HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage GetLocaleInfoA GetStringTypeA MultiByteToWideChar LoadLibraryA InitializeCriticalSectionAndSpinCount LCMapStringA WideCharToMultiByte LCMapStringW

user32

CharLowerBuffA

gdi32

GetDeviceGammaRamp

advapi32

BackupEventLogA

ole32

CoGetPSClsid

Sharing

General

Malware Config

Signatures

File Explorer

26bd4a40d12d5483b5cf8a0a2db0dddb151b0b3206079dcf2782834482a2c3b7

kernel32

user32

gdi32

advapi32

ole32

generic