0faa7c27d8cedbb19af0586a236ce4eca6b151509e526bedcc970606e391ce74

General

Target
0faa7c27d8cedbb19af0586a236ce4eca6b151509e526bedcc970606e391ce74
Size 311KB
Sample240112-2qdfesgaf3
SHA256 0faa7c27d8cedbb19af0586a236ce4eca6b151509e526bedcc970606e391ce74
MD5 cf5a70c2f7978229efebcca70f6d2053
SHA1 b2eb3eb28b89c31ccd4f4c89edaa1ed6d5a233a4
SHA512 7f16690701912b9d043113783827dfbfd2b89fee0b74e4a0bc38ee73535bd7a4bc23014eee1632196926109d4b5e37cb076df975149b422df7719db0af8f000b
SSDEEP 3072:eQLtli/LX0eRJibugK7Onq8zVvV6nnOh7wZPO6VmRZcJfTK7KVDrc+B5f239+9Uz:eQLtwk47Oqq36nnwZKfTgYn79oUq
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0faa7c27d8cedbb19af0586a236ce4eca6b151509e526bedcc970606e391ce74

File Explorer

0faa7c27d8cedbb19af0586a236ce4eca6b151509e526bedcc970606e391ce74

.exe 311KB

0faa7c27d8cedbb19af0586a236ce4eca6b151509e526bedcc970606e391ce74

IMPHASH 41664c42ec8e82b6bc77023fb19fd70a
SHA256 0faa7c27d8cedbb19af0586a236ce4eca6b151509e526bedcc970606e391ce74
MD5 cf5a70c2f7978229efebcca70f6d2053
SHA1 b2eb3eb28b89c31ccd4f4c89edaa1ed6d5a233a4
SHA512 7f16690701912b9d043113783827dfbfd2b89fee0b74e4a0bc38ee73535bd7a4bc23014eee1632196926109d4b5e37cb076df975149b422df7719db0af8f000b
SSDEEP 3072:eQLtli/LX0eRJibugK7Onq8zVvV6nnOh7wZPO6VmRZcJfTK7KVDrc+B5f239+9Uz:eQLtwk47Oqq36nnwZKfTgYn79oUq
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

8581

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CopyFileExW FreeLibrary CreateJobObjectW HeapFree FreeEnvironmentStringsA GetModuleHandleW TlsSetValue IsProcessInJob WriteConsoleOutputA SetConsoleCP LeaveCriticalSection DnsHostnameToComputerNameW SetMessageWaitingIndicator LocalHandle GetCompressedFileSizeA GetTimeZoneInformation GetConsoleAliasesLengthW SetCurrentDirectoryA GetLastError SetLastError GetProcAddress GetLongPathNameA CreateNamedPipeA OpenWaitableTimerA LoadLibraryA LocalAlloc SetConsoleOutputCP VirtualLock AddAtomA CreateWaitableTimerW LocalFree SetFileAttributesW LCMapStringW CompareStringW TryEnterCriticalSection GetStartupInfoW RaiseException RtlUnwind TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection TlsGetValue TlsAlloc TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement GetCurrentThread HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime FatalAppExitA EnterCriticalSection VirtualAlloc HeapReAlloc HeapSize SetConsoleCtrlHandler InterlockedExchange InitializeCriticalSectionAndSpinCount GetCPInfo GetACP GetOEMCP IsValidCodePage GetLocaleInfoW GetLocaleInfoA WideCharToMultiByte GetTimeFormatA GetDateFormatA GetUserDefaultLCID EnumSystemLocalesA IsValidLocale GetStringTypeA MultiByteToWideChar GetStringTypeW LCMapStringA CompareStringA SetEnvironmentVariableA

advapi32

CreateServiceA

Name

.text

Size

162KB

Virtual Size

162KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

33KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

417B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.meboxo

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.dodewa

Size

1024B

Virtual Size

577B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

96KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

0faa7c27d8cedbb19af0586a236ce4eca6b151509e526bedcc970606e391ce74

kernel32

advapi32

generic