be6c3cfe2883bce9885646bed2877cb1

Sharing

Copy URL Twitter E-mail

General

Target
be6c3cfe2883bce9885646bed2877cb1
Size 55KB
Sample240310-mylpfaah86
SHA256 9f406cec8484f404dc10861717110199b3798afd2ca12850657a4578ede2b39a
MD5 be6c3cfe2883bce9885646bed2877cb1
SHA1 42f79263198e32036eeefb1b70f2aaf44a4c2d7f
SHA512 8c09acf287e0fe3b8f5e0ca56b3fc10173df5a3ca6ee1a40fd5c5e3e6f831c2ff5b3593726138196078b7d1af677c404c00fc4fa16c9e4a57cb7ce02aeb7fb8b
SSDEEP 1536:A5fnGXYxKTUtmPe3cGsI+1bFZTpKnekq02WkpAufWIr:A2BIsbFR6Hq02WkD
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
be6c3cfe2883bce9885646bed2877cb1

File Explorer

be6c3cfe2883bce9885646bed2877cb1

.exe 55KB

be6c3cfe2883bce9885646bed2877cb1

IMPHASH 9dcbf6851631fcc0d50034d7282c766b
SHA256 9f406cec8484f404dc10861717110199b3798afd2ca12850657a4578ede2b39a
MD5 be6c3cfe2883bce9885646bed2877cb1
SHA1 42f79263198e32036eeefb1b70f2aaf44a4c2d7f
SHA512 8c09acf287e0fe3b8f5e0ca56b3fc10173df5a3ca6ee1a40fd5c5e3e6f831c2ff5b3593726138196078b7d1af677c404c00fc4fa16c9e4a57cb7ce02aeb7fb8b
SSDEEP 1536:A5fnGXYxKTUtmPe3cGsI+1bFZTpKnekq02WkpAufWIr:A2BIsbFR6Hq02WkD
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11816

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

wermgr.pdb

msvcrt

_acmdln _cexit _exit _XcptFilter _ismbblead wcsncmp _vsnprintf _vscwprintf _wcsnicmp _wcsicmp exit __getmainargs _initterm _amsg_exit __setusermatherr _adjust_fdiv __p__commode __p__fmode ??2@YAPAXI@Z ??3@YAXPAX@Z __CxxFrameHandler3 _wtoi64 _wtoi memset _vsnwprintf _onexit _lock __dllonexit _unlock _controlfp _except_handler4_common ?terminate@@YAXXZ __set_app_type

advapi32

RevertToSelf IsValidSid GetLengthSid CopySid RegGetValueW OpenProcessToken DuplicateToken AllocateAndInitializeSid CheckTokenMembership FreeSid GetTokenInformation CreateProcessAsUserW ImpersonateLoggedOnUser ConvertSidToStringSidW RegQueryValueExW TraceMessage GetTraceEnableFlags GetTraceEnableLevel GetTraceLoggerHandle RegisterTraceGuidsW UnregisterTraceGuids RegCloseKey RegSetValueExW RegCreateKeyExW RegDeleteValueW RegOpenKeyExW

kernel32

ReadProcessMemory InterlockedExchange Sleep InterlockedCompareExchange GetStartupInfoA SetUnhandledExceptionFilter GetModuleHandleA QueryPerformanceCounter GetTickCount GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime TerminateProcess GetCurrentProcess UnhandledExceptionFilter UnmapViewOfFile CloseHandle CreateProcessW SetEvent GetLastError MapViewOfFile Wow64RevertWow64FsRedirection GetSystemDirectoryW Wow64DisableWow64FsRedirection IsWow64Process GlobalFree GetCommandLineW HeapSetInformation DeleteFileW OpenProcess GetSystemDefaultLCID InterlockedIncrement lstrlenW InterlockedDecrement CreateEventW LocalFree OutputDebugStringA GetProcAddress OpenMutexW HeapFree OpenPrivateNamespaceW HeapAlloc GetProcessHeap WaitForSingleObject GetModuleHandleW OpenFileMappingW ClosePrivateNamespace CreateFileMappingW GetApplicationRecoveryCallback

ole32

StringFromGUID2 CoInitialize CoCreateInstance CoCreateGuid CoInitializeEx CoRegisterClassObject CoRevokeClassObject CoUninitialize

oleaut32

SysAllocString LoadRegTypeLi SysFreeString SysAllocStringLen LoadTypeLibEx

shell32

CommandLineToArgvW ShellExecuteExW

wer

WerpAddRegisteredDataToReport WerpSetCallBack WerReportSubmit WerReportCloseHandle WerReportAddDump WerpEnumerateStoreStart WerpEnumerateStoreNext WerpOpenMachineQueue WerpSubmitReportFromStore WerpOpenUserQueue WerpCloseStore WerpShowNXNotification WerpIsTransportAvailable WerpSetReportInformation WerpGetReportInformation WerpGetReportType WerpLoadReport

user32

CloseWindowStation GetUserObjectInformationW GetThreadDesktop GetProcessWindowStation CloseDesktop

ntdll

RtlAllocateAndInitializeSid RtlCreateBoundaryDescriptor RtlCreateServiceSid RtlAddSIDToBoundaryDescriptor RtlDeleteBoundaryDescriptor NtQueryInformationProcess RtlInitUnicodeString NtQueryInformationToken NtClose RtlFreeSid NtAlpcSendWaitReceivePort NtAlpcConnectPort

Sharing

General

Malware Config

Signatures

File Explorer

be6c3cfe2883bce9885646bed2877cb1

msvcrt

advapi32

kernel32

ole32

oleaut32

shell32

wer

user32

ntdll

generic