5b9cd9c63585e09f746dfa1ad85815d6

Sharing

Copy URL Twitter E-mail

General

Target
5b9cd9c63585e09f746dfa1ad85815d6
Size 241KB
Sample240115-affz1sefc2
SHA256 61e8cf95fbf8f71abddc51dbf6452cbd69c8466a748ef226af6739c49c149d3b
MD5 5b9cd9c63585e09f746dfa1ad85815d6
SHA1 c0029b990d033e7828729a33b6c6252450c97157
SHA512 f5038944465d65b185c7c621c0528e9e0fd21fc9a9a6fbb834c0efea600b05b471afeae43de4f46aac62c4f6cb11ad8d9aad58e9e29146ef8c8720704a4d1ec4
SSDEEP 3072:qsD2ADkpFGkTXlDJA6ba2esDetNxVgbTGV9XVAXrRt8x6o7PivriFAACZb+BGObN:qplzpTVDVa2en/V6Mpa2TC
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5b9cd9c63585e09f746dfa1ad85815d6

File Explorer

5b9cd9c63585e09f746dfa1ad85815d6

.exe 241KB

5b9cd9c63585e09f746dfa1ad85815d6

IMPHASH dc1149822fd0425f33e3e63563b9da64
SHA256 61e8cf95fbf8f71abddc51dbf6452cbd69c8466a748ef226af6739c49c149d3b
MD5 5b9cd9c63585e09f746dfa1ad85815d6
SHA1 c0029b990d033e7828729a33b6c6252450c97157
SHA512 f5038944465d65b185c7c621c0528e9e0fd21fc9a9a6fbb834c0efea600b05b471afeae43de4f46aac62c4f6cb11ad8d9aad58e9e29146ef8c8720704a4d1ec4
SSDEEP 3072:qsD2ADkpFGkTXlDJA6ba2esDetNxVgbTGV9XVAXrRt8x6o7PivriFAACZb+BGObN:qplzpTVDVa2en/V6Mpa2TC
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

44874

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

wsock32

send closesocket gethostname inet_addr WSACleanup gethostbyname connect WSAStartup ioctlsocket htons recv socket

wininet

InternetReadFile InternetCloseHandle InternetOpenA InternetOpenUrlA

kernel32

LCMapStringW WriteConsoleW HeapReAlloc GetTimeZoneInformation FlushFileBuffers SetStdHandle CreateProcessA GetExitCodeProcess IsValidCodePage SetEvent ExitThread WaitForSingleObject Sleep CreateEventA CloseHandle CreateThread GetComputerNameA GetLocaleInfoA GetTickCount GetWindowsDirectoryA GetVolumeInformationA CopyFileA GetModuleFileNameA GetTempPathA ExitProcess WinExec CreateFileA Process32First WriteFile Module32First GetLastError GetStringTypeW Process32Next CreateToolhelp32Snapshot Module32Next GetCurrentProcessId SetFileAttributesA CreateMutexA FindResourceA FreeResource LoadResource SizeofResource LockResource GetOEMCP GetACP GetCPInfo GetConsoleMode GetConsoleCP QueryPerformanceCounter GetEnvironmentStringsW WideCharToMultiByte FreeEnvironmentStringsW GetModuleFileNameW InterlockedDecrement GetCurrentThreadId SetLastError InterlockedIncrement TlsFree TlsSetValue CompareStringW SetEnvironmentVariableA SetEndOfFile CreateFileW GetProcessHeap TlsGetValue TlsAlloc HeapFree DeleteFileA GetSystemTimeAsFileTime EncodePointer DecodePointer GetProcAddress GetModuleHandleW GetCommandLineA HeapSetInformation GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc IsProcessorFeaturePresent RaiseException HeapCreate GetFileAttributesA EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionAndSpinCount RtlUnwind MultiByteToWideChar ReadFile SetHandleCount GetStdHandle GetFileType DeleteCriticalSection SetFilePointer HeapSize LoadLibraryW

user32

TranslateMessage DispatchMessageA ToAscii GetKeyState CallNextHookEx GetKeyboardState MapVirtualKeyA SetWindowsHookExA GetForegroundWindow GetWindowTextA MessageBoxA GetLastInputInfo GetMessageA

shell32

SHGetSpecialFolderPathA ShellExecuteA

advapi32

GetUserNameA RegOpenKeyExA RegDeleteKeyA RegSetValueExA GetCurrentHwProfileA

urlmon

URLDownloadToFileA

Sharing

General

Malware Config

Signatures

File Explorer

5b9cd9c63585e09f746dfa1ad85815d6

wsock32

wininet

kernel32

user32

shell32

advapi32

urlmon

generic