4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c

General

Target
4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c
Size 1.2MB
Sample240316-xranpsbe74
SHA256 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c
MD5 81d240d47cba4083c48f6ff1ba48dbae
SHA1 d84fdeeeb3e219272e7f7bd7776ab47b86017389
SHA512 7bfc5380f4c7692c4740dfc69b59dfb2820ed0381fc9352d85c755b0377e0d5f0322f59ccb32f19983966c9688fb9ac062a20e370d9262dd36560912ea080548
SSDEEP 24576:bqo1V4IDQ1rThff+r/ibJIRYP6h95S+VlLExqWXTHRyWtv4r6PS8:bqoTDerQKwS+vExqWXTxyWF4r6PS8
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c

File Explorer

4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c

.exe 1.2MB

4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c

IMPHASH dfdd67e59dbfb26ed608ae692b819ab4
SHA256 4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c
MD5 81d240d47cba4083c48f6ff1ba48dbae
SHA1 d84fdeeeb3e219272e7f7bd7776ab47b86017389
SHA512 7bfc5380f4c7692c4740dfc69b59dfb2820ed0381fc9352d85c755b0377e0d5f0322f59ccb32f19983966c9688fb9ac062a20e370d9262dd36560912ea080548
SSDEEP 24576:bqo1V4IDQ1rThff+r/ibJIRYP6h95S+VlLExqWXTHRyWtv4r6PS8:bqoTDerQKwS+vExqWXTxyWF4r6PS8
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

660788

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\git_code\CommonPlatform\Helper2345\bin\Win32\Release\pdb\Helper_2345.pdb

kernel32

LoadLibraryW GetProcAddress LocalFree FreeLibrary CreateMutexW WaitForSingleObject ReleaseMutex Sleep GetLastError CloseHandle ExpandEnvironmentStringsW GetFileAttributesW GetModuleHandleW FindFirstFileW GetLongPathNameW CreateFileW GetFileAttributesExW HeapFree GetCurrentThreadId GetVersionExW GetComputerNameExW OpenProcess HeapAlloc GetProcessHeap lstrlenW lstrcmpiW ReadFile WriteFile SetFilePointer SetEndOfFile DeleteFileW GetFileSizeEx EnterCriticalSection LeaveCriticalSection GetModuleFileNameW DeleteCriticalSection FindNextFileW FindClose SetFileTime GetFileSize GetFileTime CreateDirectoryW GetFullPathNameW RemoveDirectoryW GetTempPathW SetFileAttributesW GetCurrentDirectoryW GetWindowsDirectoryW MoveFileExW GetTempFileNameW MoveFileW LockResource GetSystemInfo LoadResource FindResourceW QueryDosDeviceW GetCurrentProcess WaitForMultipleObjects GetCurrentProcessId CreateProcessW GetExitCodeProcess GetLogicalDriveStringsW FormatMessageW FileTimeToSystemTime SetEvent GetTickCount GetACP GlobalMemoryStatusEx InterlockedExchange SetLastError InterlockedExchangeAdd InitializeCriticalSectionAndSpinCount SwitchToThread GetCommandLineW ExitThread FreeLibraryAndExitThread GetTimeZoneInformation InitializeCriticalSection DeviceIoControl ResetEvent CreateEventW ResumeThread GetEnvironmentVariableW UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead RtlUnwind RaiseException EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW ExitProcess GetModuleHandleExW MultiByteToWideChar WideCharToMultiByte GetStdHandle GetFileType GetStringTypeW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FindFirstFileExW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA OutputDebugStringW CreateThread SetStdHandle FlushFileBuffers GetConsoleCP GetConsoleMode HeapSize HeapReAlloc SetFilePointerEx WriteConsoleW DecodePointer

shell32

CommandLineToArgvW SHGetFolderPathW SHGetSpecialFolderPathW

Sharing

General

Malware Config

Signatures

File Explorer

4247b7a46b63412f8c54f15c00b9f7ca6e50d40b323d28fb68bf4004824eb36c

kernel32

shell32

generic