b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877

General

Target
b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877
Size 811KB
Sample240114-2bwnfsecf9
SHA256 b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877
MD5 9244e8dafdb3baa6ebbf1eed741fc1bb
SHA1 ad7620174b2d4ac4461f1d8623e632e4b63fa867
SHA512 c5e79d0f52bf4cf374f86325d4be819573e9cbad4afe57d164c83ce2806095c76b81a7f34dbfe71a64b29563c289a4b872a61459fbc7d9da16308eb0798a10b8
SSDEEP 12288:QpoaBPg7lN6/RFLeoA03fdZh+UwvL1hd4JMuUzgAl8F5bLlt89SOUx5ruaBsi:OgR4XCXcsphd4JMh8vdt896xAaBs
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877

File Explorer

b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877

.exe 811KB

b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877

IMPHASH 8654fa195cb86078206129ad19ab9259
SHA256 b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877
MD5 9244e8dafdb3baa6ebbf1eed741fc1bb
SHA1 ad7620174b2d4ac4461f1d8623e632e4b63fa867
SHA512 c5e79d0f52bf4cf374f86325d4be819573e9cbad4afe57d164c83ce2806095c76b81a7f34dbfe71a64b29563c289a4b872a61459fbc7d9da16308eb0798a10b8
SSDEEP 12288:QpoaBPg7lN6/RFLeoA03fdZh+UwvL1hd4JMuUzgAl8F5bLlt89SOUx5ruaBsi:OgR4XCXcsphd4JMh8vdt896xAaBs
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

8059

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetConsoleAliasesLengthW GetLocaleInfoA SetComputerNameExA WriteConsoleOutputCharacterA FindResourceW InterlockedIncrement InterlockedCompareExchange GetComputerNameW SetCommBreak CreateHardLinkA GetTickCount GlobalFindAtomA LoadLibraryW WriteConsoleW GetConsoleFontSize GetStartupInfoW FindFirstChangeNotificationW SetLastError GetProcAddress VirtualAlloc SetComputerNameA LoadLibraryA LocalAlloc QueryDosDeviceW AddAtomA lstrcmpiW GetModuleHandleA CancelTimerQueueTimer DeleteFileW GetCurrentProcessId ResetWriteWatch SuspendThread SetThreadContext GetLastError GetComputerNameA GetModuleHandleW Sleep ExitProcess HeapAlloc HeapFree RaiseException TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId InterlockedDecrement WriteFile GetStdHandle GetModuleFileNameA DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSectionAndSpinCount GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA HeapCreate VirtualFree QueryPerformanceCounter GetSystemTimeAsFileTime HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage HeapSize RtlUnwind WideCharToMultiByte LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW

gdi32

GetCharABCWidthsFloatA DeleteDC

shell32

DuplicateIcon

Sharing

General

Malware Config

Signatures

File Explorer

b4292ca36e9f6f183fe330d0efa1980fb616cd7bbf1b9684079030894a3a2877

kernel32

gdi32

shell32

generic