8965dfcadd304941c740be5507f125d8

General

Target
8965dfcadd304941c740be5507f125d8
Size 223KB
Sample240202-nmyqasfabl
SHA256 668aaf0cba4aca7fd31a4782797d6a5cd2e26a0b9d0c0b51d8f009e867daf660
MD5 8965dfcadd304941c740be5507f125d8
SHA1 bf6d190c1019c35b1cc5997beda70567f62d94ca
SHA512 00282dfaf101da33c761a8b0a1ec95fcd0a96f361142270fe1cfe1fb09658cb40031bf751497439b9baf210ab23e403ae5ce29fef9c212921bd6b054016543e9
SSDEEP 6144:5riznhfhdb839nmx9TV7M1EU6V9n2xBlk:Ni9rY9ni7u4etk
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8965dfcadd304941c740be5507f125d8

File Explorer

8965dfcadd304941c740be5507f125d8

.exe 223KB

8965dfcadd304941c740be5507f125d8

IMPHASH 60f9a7e6fbdde91eba6e45845c98e4d2
SHA256 668aaf0cba4aca7fd31a4782797d6a5cd2e26a0b9d0c0b51d8f009e867daf660
MD5 8965dfcadd304941c740be5507f125d8
SHA1 bf6d190c1019c35b1cc5997beda70567f62d94ca
SHA512 00282dfaf101da33c761a8b0a1ec95fcd0a96f361142270fe1cfe1fb09658cb40031bf751497439b9baf210ab23e403ae5ce29fef9c212921bd6b054016543e9
SSDEEP 6144:5riznhfhdb839nmx9TV7M1EU6V9n2xBlk:Ni9rY9ni7u4etk
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

23671

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\fuhiwoxutapag93 pemowi de.pdb

kernel32

VerSetConditionMask GetProcAddress GlobalMemoryStatus LocalAlloc ExitProcess SetUnhandledExceptionFilter GetLastError DebugActiveProcessStop GetFileInformationByHandle CloseHandle GetHandleInformation SetHandleInformation GetNativeSystemInfo GetTickCount GetMailslotInfo lstrlenA GetModuleHandleA WriteConsoleW SetFilePointerEx SetStdHandle GetConsoleMode GetConsoleCP FlushFileBuffers GetStringTypeW OutputDebugStringW HeapReAlloc GetCPInfo GetOEMCP EncodePointer DecodePointer IsDebuggerPresent IsProcessorFeaturePresent RaiseException RtlUnwind GetCommandLineW HeapAlloc HeapFree GetModuleHandleExW MultiByteToWideChar WideCharToMultiByte HeapSize UnhandledExceptionFilter SetLastError InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetModuleHandleW GetCurrentThreadId GetProcessHeap GetStdHandle GetFileType DeleteCriticalSection GetModuleFileNameW WriteFile QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW EnterCriticalSection LeaveCriticalSection LoadLibraryExW IsValidCodePage GetACP CreateFileW

user32

AttachThreadInput GetMonitorInfoA

ole32

CoIsOle1Class

winhttp

WinHttpSetTimeouts WinHttpAddRequestHeaders WinHttpQueryHeaders WinHttpCloseHandle WinHttpSetOption

Name

.text

Size

62KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

98KB

Virtual Size

98KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

17KB

Virtual Size

448KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.noran

Size

512B

Virtual Size

512B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.mimode

Size

1KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

37KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

8965dfcadd304941c740be5507f125d8

kernel32

user32

ole32

winhttp

generic