a36ebfb2e229494919fffd76be0a199da415fe826f0ead7a5766d44cfd6ab579

General

Target
a36ebfb2e229494919fffd76be0a199da415fe826f0ead7a5766d44cfd6ab579
Size 515KB
Sample240226-1m1wwagg95
SHA256 a36ebfb2e229494919fffd76be0a199da415fe826f0ead7a5766d44cfd6ab579
MD5 ee91b04ce7d49a76c987c4aa4e269300
SHA1 9ebae6f3c883c8d8d7f6c8b6b886105d910f9c1a
SHA512 a150d9d688a0f6a6c2c52e75b62fd2c4bdcd4f1e432b27b090bcd458272de4c6f73e5adbf50acbe82b21aa99593efdd92354d47a7c24515d115a4e35311c7303
SSDEEP 12288:2VLOLbYx29jcKY/1Yj70xFqSgzHkuyEFDOwK:Syy2K120/bgzEuyEFC
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

a36ebfb2e229494919fffd76be0a199da415fe826f0ead7a5766d44cfd6ab579

.dll 515KB

a36ebfb2e229494919fffd76be0a199da415fe826f0ead7a5766d44cfd6ab579

IMPHASH cc2c95b842cf453a10e40489eddeb9ee
SHA256 a36ebfb2e229494919fffd76be0a199da415fe826f0ead7a5766d44cfd6ab579
MD5 ee91b04ce7d49a76c987c4aa4e269300
SHA1 9ebae6f3c883c8d8d7f6c8b6b886105d910f9c1a
SHA512 a150d9d688a0f6a6c2c52e75b62fd2c4bdcd4f1e432b27b090bcd458272de4c6f73e5adbf50acbe82b21aa99593efdd92354d47a7c24515d115a4e35311c7303
SSDEEP 12288:2VLOLbYx29jcKY/1Yj70xFqSgzHkuyEFDOwK:Syy2K120/bgzEuyEFC
MD5 SHA1 SHA512 SSDEEP

regsvr32 windows:6 windows x86 arch:x86

PE Signature issue

Digest

34:32:5e:ab:f4:27:36:6b:21:df:b9:f6:c1:e6:af:46:7a:c3:66:5d:0e:04:c6:89:6e:fc:26:3d:8f:d2:8c:b0

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=VALENTE SP Z O O,O=VALENTE SP Z O O,ST=Śląskie,C=PL

Chains

Feb 23, 2024

Minor OS version

0

Major OS version

6

Entry point

28182

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

usp10

ScriptGetFontAlternateGlyphs ScriptItemizeOpenType ScriptPlaceOpenType ScriptCacheGetHeight ScriptShape ScriptFreeCache

rasapi32

RasGetProjectionInfoW RasDeleteSubEntryW RasGetEapUserIdentityA RasSetEapUserDataA RasGetCredentialsA RasDeleteEntryA RasGetCountryInfoW RasSetEntryDialParamsA RasEditPhonebookEntryW RasDialA

kernel32

ExitProcess DecodePointer WriteConsoleW CloseHandle CreateFileW SetFilePointerEx GetConsoleMode GetConsoleCP WriteFile FlushFileBuffers SetStdHandle HeapReAlloc HeapSize GetStringTypeW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW GetCurrentProcess TerminateProcess InterlockedFlushSList RtlUnwind GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW RaiseException GetProcessHeap GetModuleHandleExW GetModuleFileNameW HeapAlloc HeapFree FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW GetStdHandle GetFileType LCMapStringW

Name

.text

Size

65KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.zflop

Size

394KB

Virtual Size

393KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

a36ebfb2e229494919fffd76be0a199da415fe826f0ead7a5766d44cfd6ab579

PE Signature issue

usp10

rasapi32

kernel32

generic