fadf10b3ec4fd1bdc37866d4c5d2a9816d2a7541bc213ed0a123cb427ddbd581

General

Target
fadf10b3ec4fd1bdc37866d4c5d2a9816d2a7541bc213ed0a123cb427ddbd581
Size 832KB
Sample240115-fnhfpsagg4
SHA256 fadf10b3ec4fd1bdc37866d4c5d2a9816d2a7541bc213ed0a123cb427ddbd581
MD5 7e0c3507ccd7fa02823e5158f26b9fea
SHA1 308ce97fd7585c6623346a5c5623c5b441f79b62
SHA512 80f90eb5451c0d79f13d7db44683bcb349b0daa604b8ee280833d84acd1f99e3b17dde3ff68617c48fe2032040bba2fefff0e3c69b540542fc9600da7d3f894c
SSDEEP 12288:zBOvaA3lBcw8byxsNCESC58EFt7laSdyf6jiwGbF8lpKeAJMOib4MJ:QH36vAS53lh0yjitJ3eAJ/iMO
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fadf10b3ec4fd1bdc37866d4c5d2a9816d2a7541bc213ed0a123cb427ddbd581

File Explorer

fadf10b3ec4fd1bdc37866d4c5d2a9816d2a7541bc213ed0a123cb427ddbd581

.exe 832KB

fadf10b3ec4fd1bdc37866d4c5d2a9816d2a7541bc213ed0a123cb427ddbd581

IMPHASH ec5b1a58a209c77da7b27fe671efe367
SHA256 fadf10b3ec4fd1bdc37866d4c5d2a9816d2a7541bc213ed0a123cb427ddbd581
MD5 7e0c3507ccd7fa02823e5158f26b9fea
SHA1 308ce97fd7585c6623346a5c5623c5b441f79b62
SHA512 80f90eb5451c0d79f13d7db44683bcb349b0daa604b8ee280833d84acd1f99e3b17dde3ff68617c48fe2032040bba2fefff0e3c69b540542fc9600da7d3f894c
SSDEEP 12288:zBOvaA3lBcw8byxsNCESC58EFt7laSdyf6jiwGbF8lpKeAJMOib4MJ:QH36vAS53lh0yjitJ3eAJ/iMO
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

8918

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

HeapFree FreeEnvironmentStringsA GetModuleHandleW GetConsoleAliasesA TlsSetValue IsProcessInJob SetConsoleCP LeaveCriticalSection GetAtomNameW CreateJobObjectA LCMapStringA GetConsoleOutputCP GetLastError GetLongPathNameW SetLastError GetProcAddress CreateNamedPipeA SetFileAttributesA TryEnterCriticalSection OpenWaitableTimerW LocalAlloc AddAtomW SetCurrentDirectoryW VirtualLock FindNextChangeNotification GetModuleFileNameA LoadLibraryExA CreateWaitableTimerW EraseTape CompareStringA EnumCalendarInfoExA LocalFree CopyFileExA LocalFileTimeToFileTime CompareStringW GetTimeZoneInformation GetLocaleInfoW LoadLibraryA LocalUnlock GetStartupInfoW RaiseException RtlUnwind TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc TlsGetValue TlsAlloc TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement GetCurrentThread Sleep HeapSize ExitProcess WriteFile GetStdHandle GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA DeleteCriticalSection HeapCreate HeapDestroy VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime FatalAppExitA EnterCriticalSection VirtualAlloc HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage SetConsoleCtrlHandler FreeLibrary InterlockedExchange InitializeCriticalSectionAndSpinCount GetTimeFormatA GetDateFormatA GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeA MultiByteToWideChar GetStringTypeW WideCharToMultiByte LCMapStringW SetEnvironmentVariableA

user32

GetProcessDefaultLayout GetClassLongW

advapi32

GetAce

Name

.text

Size

710KB

Virtual Size

710KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

33KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

417B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tucehu

Size

512B

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.xibijot

Size

1024B

Virtual Size

777B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

69KB

Virtual Size

69KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

fadf10b3ec4fd1bdc37866d4c5d2a9816d2a7541bc213ed0a123cb427ddbd581

kernel32

user32

advapi32

generic