a40b8f61420b24835c93f7974f39a23e

General

Target
a40b8f61420b24835c93f7974f39a23e
Size 1.2MB
Sample240225-r2gbcadh83
SHA256 f8c983fce1af5b6e17289a88d19a70fb5a67c6bc32d7aa4f3bc3ce1ffcddc282
MD5 a40b8f61420b24835c93f7974f39a23e
SHA1 bce1227b915b76825b3589c3b60ccc2e114f7dd2
SHA512 75b81661d3758b207b1f2dfc8d5dd40bd868934b931f0c0513e5d1f95ba665b7949b8db8528351d55b18f443a644094f57d07c85317510961b5f5a9a1353f95a
SSDEEP 24576:7xBaQMsE+VUxLY8VKUgln+NNTbhbY1oY2vTCtKz7HD53J:7N7yK5a6YTSe7V3J
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a40b8f61420b24835c93f7974f39a23e

File Explorer

a40b8f61420b24835c93f7974f39a23e

.exe 1.2MB

a40b8f61420b24835c93f7974f39a23e

IMPHASH d4acdf645025579e61b62a0ed0fb9285
SHA256 f8c983fce1af5b6e17289a88d19a70fb5a67c6bc32d7aa4f3bc3ce1ffcddc282
MD5 a40b8f61420b24835c93f7974f39a23e
SHA1 bce1227b915b76825b3589c3b60ccc2e114f7dd2
SHA512 75b81661d3758b207b1f2dfc8d5dd40bd868934b931f0c0513e5d1f95ba665b7949b8db8528351d55b18f443a644094f57d07c85317510961b5f5a9a1353f95a
SSDEEP 24576:7xBaQMsE+VUxLY8VKUgln+NNTbhbY1oY2vTCtKz7HD53J:7N7yK5a6YTSe7V3J
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

8848

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\rabonuhiyi\niri.pdb

kernel32

SetFilePointer lstrlenA CopyFileExW MapUserPhysicalPages FreeLibrary InterlockedIncrement GetCommState InterlockedDecrement ZombifyActCtx GetSystemWindowsDirectoryW GetNamedPipeHandleStateA GlobalLock SetComputerNameW GetComputerNameW FreeEnvironmentStringsA GetProcessPriorityBoost GetTickCount GetCommConfig GetConsoleAliasesLengthA GetWindowsDirectoryA GetConsoleAliasExesW TlsSetValue GetEnvironmentStrings FindResourceExA GlobalAlloc LoadLibraryW _hread GetCalendarInfoA GetSystemWow64DirectoryW GetSystemTimeAdjustment InitAtomTable GlobalFlags GetComputerNameExA GetBinaryTypeA GetAtomNameW ReadFile CompareStringW ExitThread VirtualUnlock LCMapStringA CreateDirectoryA ReleaseActCtx GetFileSizeEx GetStartupInfoA GetCurrentDirectoryW GetProcAddress VerLanguageNameA SetFirmwareEnvironmentVariableW CreateNamedPipeA SetStdHandle BuildCommDCBW GetLocalTime LoadLibraryA Process32FirstW CreateSemaphoreW SetConsoleCtrlHandler SetCurrentDirectoryW WriteProfileSectionW WriteProfileStringA SetConsoleTitleW VirtualProtect GetFileAttributesExW GetCPInfoExA _lopen FindAtomW GetVolumeNameForVolumeMountPointW DeleteFileW GetCurrentProcessId ReadConsoleOutputCharacterW GetProfileSectionW AreFileApisANSI CommConfigDialogW GetLastError WideCharToMultiByte GetCommandLineA HeapValidate IsBadReadPtr RaiseException TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleFileNameW GetACP GetOEMCP GetCPInfo IsValidCodePage TlsGetValue GetModuleHandleW TlsAlloc GetCurrentThreadId TlsFree SetLastError LeaveCriticalSection EnterCriticalSection GetFileType WriteFile GetConsoleCP GetConsoleMode DeleteCriticalSection QueryPerformanceCounter GetSystemTimeAsFileTime Sleep ExitProcess GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetStdHandle HeapDestroy HeapCreate HeapFree VirtualFree HeapAlloc HeapSize HeapReAlloc VirtualAlloc DebugBreak OutputDebugStringA WriteConsoleW OutputDebugStringW RtlUnwind MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA InitializeCriticalSectionAndSpinCount WriteConsoleA GetConsoleOutputCP CreateFileA CloseHandle FlushFileBuffers GetModuleHandleA

user32

GetMenuInfo GetListBoxInfo

Name

.text

Size

163KB

Virtual Size

163KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

52KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

942KB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

193B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

a40b8f61420b24835c93f7974f39a23e

kernel32

user32

generic