dcfd015c0e5690dcb11fa707f52030ba

General

Target
dcfd015c0e5690dcb11fa707f52030ba
Size 14.6MB
Sample240325-cm2amsdc98
SHA256 8b795f6fedee87d107c933dee81a87ce4acc9f1ec82f1b8bb69df2a87684547d
MD5 dcfd015c0e5690dcb11fa707f52030ba
SHA1 7af426f7a65a7a4ac6df8503222f0ce4b3e92001
SHA512 d2ba001589742c0234a9855bd6a5c14a3536e732705b1f5462c3bc993dfe5996c453f36d4ecb7899a3c8419f617af6f02ef99cbc5a87d04b75530e4107e89a3d
SSDEEP 12288:jRXQK44fy6111111111111111111111111111111111111111111111111111113:jRx2
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dcfd015c0e5690dcb11fa707f52030ba

File Explorer

dcfd015c0e5690dcb11fa707f52030ba

.exe 14.6MB

dcfd015c0e5690dcb11fa707f52030ba

IMPHASH 7799a59ba272e2d352ce8955d6600f5f
SHA256 8b795f6fedee87d107c933dee81a87ce4acc9f1ec82f1b8bb69df2a87684547d
MD5 dcfd015c0e5690dcb11fa707f52030ba
SHA1 7af426f7a65a7a4ac6df8503222f0ce4b3e92001
SHA512 d2ba001589742c0234a9855bd6a5c14a3536e732705b1f5462c3bc993dfe5996c453f36d4ecb7899a3c8419f617af6f02ef99cbc5a87d04b75530e4107e89a3d
SSDEEP 12288:jRXQK44fy6111111111111111111111111111111111111111111111111111113:jRx2
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

25156

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

C:\jev-yuxec.pdb

kernel32

ExpandEnvironmentStringsA GetNumaProcessorNode lstrlenA FindClose LocalAlloc ExitThread GetVolumePathNamesForVolumeNameA GetLastError LoadLibraryA lstrcatW GetCommState TerminateProcess GetProcessHeaps CreateThread GetCurrencyFormatW SetThreadIdealProcessor GetWindowsDirectoryW GetProcAddress ExitProcess TlsGetValue _lclose DosDateTimeToFileTime GetTickCount IsDebuggerPresent VirtualQueryEx GetNumberOfConsoleMouseButtons lstrcpyA GetHandleInformation UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetStartupInfoW GetModuleHandleW SetLastError RtlUnwind RaiseException EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsSetValue TlsFree FreeLibrary LoadLibraryExW GetStdHandle WriteFile GetModuleFileNameW MultiByteToWideChar WideCharToMultiByte GetModuleHandleExW GetACP HeapFree HeapAlloc CloseHandle FindFirstFileExW FindNextFileW IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW SetStdHandle GetFileType GetStringTypeW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleCP GetConsoleMode SetFilePointerEx WriteConsoleW DecodePointer CreateFileW

Name

.text

Size

75KB

Virtual Size

75KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

168KB

Virtual Size

47.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gfids

Size

512B

Virtual Size

176B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14.4MB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

dcfd015c0e5690dcb11fa707f52030ba

kernel32

generic