793df85f287f06c4764a229b404e0a7f

Sharing

Copy URL Twitter E-mail

General

Target
793df85f287f06c4764a229b404e0a7f
Size 660KB
Sample240127-eskaeschg2
SHA256 823691284d6b7786dee73b7315b3cd146eac4160d5f7fca663cab821b66698fa
MD5 793df85f287f06c4764a229b404e0a7f
SHA1 454ad7fe4ede68aeffa2144dc95d22618a17a17e
SHA512 e20fce0797127f695247109fa01d39db3304fee14aa34441cc5f88c3ea38c18bf8d013b2207c57dd56b542dc9eaee0100a3c3c58c326be54677e760dd7f50c9f
SSDEEP 6144:Z34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:ZIKp/UWCZdCDh2IZDwAFRpR6Au
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
793df85f287f06c4764a229b404e0a7f

File Explorer

793df85f287f06c4764a229b404e0a7f

.dll 660KB

793df85f287f06c4764a229b404e0a7f

IMPHASH 6bd45a7f6736c7032f1cc8ae9fa751af
SHA256 823691284d6b7786dee73b7315b3cd146eac4160d5f7fca663cab821b66698fa
MD5 793df85f287f06c4764a229b404e0a7f
SHA1 454ad7fe4ede68aeffa2144dc95d22618a17a17e
SHA512 e20fce0797127f695247109fa01d39db3304fee14aa34441cc5f88c3ea38c18bf8d013b2207c57dd56b542dc9eaee0100a3c3c58c326be54677e760dd7f50c9f
SSDEEP 6144:Z34xznfAp4x+NWMqW/KZ1vCDTEpc2bysCZR6iwAtUnWKT5WK8Rpv1llfFfCRAuTF:ZIKp/UWCZdCDh2IZDwAFRpR6Au
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

19984

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

TTPnpins.pdb

??0VolumeFveStatus@@IEAA@XZ ??0VolumeFveStatus@@QEAA@K_KJW4_FVE_WIPING_STATE@@@Z ??4BuiVolume@@QEAAAEAV0@AEBV0@@Z ??4VolumeFveStatus@@QEAAAEAV0@$$QEAV0@@Z ??4VolumeFveStatus@@QEAAAEAV0@AEBV0@@Z ?FailedDryRun@VolumeFveStatus@@QEBA_NXZ ?GetExtendedFlags@VolumeFveStatus@@QEBA_KXZ ?GetLastConvertStatus@VolumeFveStatus@@QEBAJXZ ?GetStatusFlags@VolumeFveStatus@@QEBAKXZ ?HasExternalKey@VolumeFveStatus@@QEBA_NXZ ?HasPBKDF2RecoveryPassword@VolumeFveStatus@@QEBA_NXZ ?HasPassphraseProtector@VolumeFveStatus@@QEBA_NXZ ?HasPinProtector@VolumeFveStatus@@QEBA_NXZ ?HasRecoveryData@VolumeFveStatus@@QEBA_NXZ ?HasRecoveryPassword@VolumeFveStatus@@QEBA_NXZ ?HasSmartCardProtector@VolumeFveStatus@@QEBA_NXZ ?HasStartupKeyProtector@VolumeFveStatus@@QEBA_NXZ ?HasTpmProtector@VolumeFveStatus@@QEBA_NXZ ?IsConverting@VolumeFveStatus@@QEBA_NXZ ?IsCsvMetadataVolume@VolumeFveStatus@@QEBA_NXZ ?IsDEAutoProvisioned@VolumeFveStatus@@QEBA_NXZ ?IsDecrypted@VolumeFveStatus@@QEBA_NXZ ?IsDecrypting@VolumeFveStatus@@QEBA_NXZ ?IsDisabled@VolumeFveStatus@@QEBA_NXZ ?IsEDriveVolume@VolumeFveStatus@@QEBA_NXZ ?IsEncrypted@VolumeFveStatus@@QEBA_NXZ ?IsEncrypting@VolumeFveStatus@@QEBA_NXZ ?IsLocked@VolumeFveStatus@@QEBA_NXZ ?IsOn@VolumeFveStatus@@QEBA_NXZ ?IsOsCriticalVolume@VolumeFveStatus@@QEBA_NXZ ?IsOsVolume@VolumeFveStatus@@QEBA_NXZ ?IsPartiallyConverted@VolumeFveStatus@@QEBA_NXZ ?IsPaused@VolumeFveStatus@@QEBA_NXZ ?IsPreProvisioned@VolumeFveStatus@@QEBA_NXZ ?IsRoamingDevice@VolumeFveStatus@@QEBA_NXZ ?IsSecure@VolumeFveStatus@@QEBA_NXZ ?IsUnknownFveVersion@VolumeFveStatus@@QEBA_NXZ ?IsWiping@VolumeFveStatus@@QEBA_NXZ ?NO_DRIVE_LETTER@BuiVolume@@2IB ?NeedsRestart@VolumeFveStatus@@QEBA_NXZ FveuiWizard FveuipClearFveWizOnStartup

Name

.text

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

524KB

Virtual Size

520KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

68KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

312B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

28KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

4KB

Virtual Size

905B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

generic

count=52, id=225, productName=VS2013 UPD2 build 30501, version=30501,

count=308, id=122, productName=VS2005 build 50727, version=50727,

count=395, id=1, productName=Unmarked objects,

count=67, id=202, productName=VS2012 UPD1 build 51106, version=51106,

count=479, id=149, productName=VS2008 build 21022, version=21022,

count=192, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=405, id=259, productName=VS2015 [14.0] build 23026, version=23026,

count=147, id=220, productName=VS2013 build 21005, version=21005,

count=145, id=258, productName=VS2015 UPD1 build 23506, version=23506,

count=248, id=204, productName=VS2012 UPD3 build 60610, version=60610,

count=409, id=157, productName=VS2010 build 30319, version=30319,

count=250, id=131, productName=VS2008 SP1 build 30729, version=30729,

count=155, id=157, productName=VS2010 build 30319, version=30319,

count=314, id=222, productName=VS2013 UPD4 build 31101, version=31101,

count=197, id=225, productName=VS2013 build 21005, version=21005,

count=19, id=261, productName=VS2015 UPD3.1 build 24215, version=24215,

793df85f287f06c4764a229b404e0a7f

comdlg32

wininet

setupapi

advapi32

generic