af9f07e4d9b54bfd74ae113e7839b34d

General

Target
af9f07e4d9b54bfd74ae113e7839b34d
Size 590KB
Sample240229-2c2absec6y
SHA256 d9d4e5718a63c9ef3c1234369e4306914f0cee944033559fb645fea5528367fc
MD5 af9f07e4d9b54bfd74ae113e7839b34d
SHA1 3131fe57670535a26d28e2328648694e1ab2fa15
SHA512 4b62ea3a5086555c1aa5283c0c3b3e244ceba9b3028a200d2ab7e4c8736c889841cb78dea33a32a90bb458f4204d85efa79116528658840058262817d8e0bbc3
SSDEEP 12288:TXrXai/ddu6xP2UzVjornshg6K+/wGahqxSXd77p1BIuL/:PX7RQUZkc3wGahQStHp1BP
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
af9f07e4d9b54bfd74ae113e7839b34d

File Explorer

af9f07e4d9b54bfd74ae113e7839b34d

.exe 590KB

af9f07e4d9b54bfd74ae113e7839b34d

IMPHASH 790ed2a101ffa52f01e32a348e567eff
SHA256 d9d4e5718a63c9ef3c1234369e4306914f0cee944033559fb645fea5528367fc
MD5 af9f07e4d9b54bfd74ae113e7839b34d
SHA1 3131fe57670535a26d28e2328648694e1ab2fa15
SHA512 4b62ea3a5086555c1aa5283c0c3b3e244ceba9b3028a200d2ab7e4c8736c889841cb78dea33a32a90bb458f4204d85efa79116528658840058262817d8e0bbc3
SSDEEP 12288:TXrXai/ddu6xP2UzVjornshg6K+/wGahqxSXd77p1BIuL/:PX7RQUZkc3wGahQStHp1BP
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

6368

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\ralok.pdb

kernel32

UnregisterWait GetFileSize GetNativeSystemInfo SetFilePointer GetConsoleAliasesLengthW CopyFileExW SetLocalTime InterlockedIncrement VerSetConditionMask InterlockedDecrement ZombifyActCtx CompareFileTime GetSystemWindowsDirectoryW SetEnvironmentVariableW GlobalLock SetConsoleScreenBufferSize WriteConsoleInputA SetComputerNameW FreeEnvironmentStringsA VirtualFree SetProcessPriorityBoost ActivateActCtx FindResourceExA GetConsoleAliasExesLengthW GetComputerNameExA CreateSemaphoreA GetFileAttributesW GetBinaryTypeA EnumResourceNamesW GetOverlappedResult CompareStringW lstrlenW InterlockedExchange SetCurrentDirectoryA GetStartupInfoA GetCPInfoExW OpenMutexW GetCurrentDirectoryW GetProcAddress CreateNamedPipeA WriteProfileSectionA ReadFileEx SetStdHandle DisableThreadLibraryCalls GetPrivateProfileStringA LoadLibraryA GetConsoleScreenBufferInfo LocalAlloc PostQueuedCompletionStatus FindAtomA WriteProfileStringW FatalAppExitA GetVersionExA TlsAlloc DeleteFileW LCMapStringW AreFileApisANSI ReadFile GetComputerNameA GetLastError MoveFileA GetCommandLineA HeapValidate IsBadReadPtr RaiseException EnterCriticalSection LeaveCriticalSection SetHandleCount GetStdHandle GetFileType DeleteCriticalSection TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetModuleFileNameW GetACP GetOEMCP GetCPInfo IsValidCodePage TlsGetValue GetModuleHandleW TlsSetValue GetCurrentThreadId TlsFree SetLastError QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime Sleep ExitProcess GetModuleFileNameA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW HeapDestroy HeapCreate HeapFree WriteFile HeapAlloc HeapSize HeapReAlloc VirtualAlloc RtlUnwind GetConsoleCP GetConsoleMode InitializeCriticalSectionAndSpinCount DebugBreak OutputDebugStringA WriteConsoleW OutputDebugStringW LoadLibraryW MultiByteToWideChar GetStringTypeA GetStringTypeW GetModuleHandleA LCMapStringA GetLocaleInfoA FlushFileBuffers WriteConsoleA GetConsoleOutputCP CloseHandle CreateFileA

gdi32

GetBoundsRect

winhttp

WinHttpOpen

Sharing

General

Malware Config

Signatures

File Explorer

af9f07e4d9b54bfd74ae113e7839b34d

kernel32

gdi32

winhttp

generic