e06ae8f7d80ef958686b2378d3936803

General

Target
e06ae8f7d80ef958686b2378d3936803
Size 11.8MB
Sample240327-bk4sbabf81
SHA256 0b971b889d6ff55f096419e35a24a5560f5085f2cba575d60e4629a51b8fa776
MD5 e06ae8f7d80ef958686b2378d3936803
SHA1 e09cc994f9c6a81600bcf4465d21ca2922c5d368
SHA512 482b3c4a83e57949a9f583f8b99f56c6046938487dc25507fe53feae6ab490872684ae838116966b76483166d161b74cc5357c8604b3a8e41f5c93db1ae3fd62
SSDEEP 49152:ogntttttttttttttttttttttttttttttttttttttttttttttttttttttttttttt9:o
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e06ae8f7d80ef958686b2378d3936803

File Explorer

e06ae8f7d80ef958686b2378d3936803

.exe 11.8MB

e06ae8f7d80ef958686b2378d3936803

IMPHASH d602588eb4c22b09aeb880c571ff25d6
SHA256 0b971b889d6ff55f096419e35a24a5560f5085f2cba575d60e4629a51b8fa776
MD5 e06ae8f7d80ef958686b2378d3936803
SHA1 e09cc994f9c6a81600bcf4465d21ca2922c5d368
SHA512 482b3c4a83e57949a9f583f8b99f56c6046938487dc25507fe53feae6ab490872684ae838116966b76483166d161b74cc5357c8604b3a8e41f5c93db1ae3fd62
SSDEEP 49152:ogntttttttttttttttttttttttttttttttttttttttttttttttttttttttttttt9:o
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

14745

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InterlockedIncrement GetConsoleAliasA SetMailslotInfo HeapFree GetModuleHandleExW LockFile ConnectNamedPipe FreeEnvironmentStringsA WriteFile TzSpecificLocalTimeToSystemTime GlobalAlloc GetLocaleInfoW SetSystemTimeAdjustment GetSystemTimeAdjustment InterlockedPopEntrySList HeapDestroy GetFileAttributesA GetTimeFormatW TerminateProcess IsDBCSLeadByte GetModuleFileNameW FindNextVolumeMountPointW ReplaceFileA GlobalUnlock WriteConsoleOutputCharacterA LCMapStringA CreateDirectoryA GetLastError GetProcAddress SetFileAttributesA DisableThreadLibraryCalls PrepareTape OpenWaitableTimerA GetAtomNameA LoadLibraryA UnhandledExceptionFilter SetConsoleOutputCP GetTapeParameters GlobalWire GetModuleHandleA GetCurrentDirectoryA ScrollConsoleScreenBufferA SetProcessShutdownParameters FindAtomW FileTimeToLocalFileTime DeleteTimerQueueTimer CompareStringW CompareStringA GetTimeZoneInformation SetEndOfFile SetLocalTime EnumDateFormatsExW VirtualUnlock HeapCompact GetCurrentProcess SetUnhandledExceptionFilter IsDebuggerPresent GetCommandLineA GetStartupInfoA RaiseException RtlUnwind HeapAlloc GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId InterlockedDecrement GetCurrentThread EnterCriticalSection LeaveCriticalSection Sleep ExitProcess GetStdHandle GetModuleFileNameA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime SetFilePointer GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage FatalAppExitA VirtualAlloc HeapReAlloc CloseHandle CreateFileA InitializeCriticalSectionAndSpinCount HeapSize SetConsoleCtrlHandler FreeLibrary InterlockedExchange SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW GetTimeFormatA GetDateFormatA GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale FlushFileBuffers GetProcessHeap ReadFile SetEnvironmentVariableA

user32

GetProcessDefaultLayout GetDesktopWindow

advapi32

AbortSystemShutdownA AddAccessDeniedAce EqualSid BackupEventLogA

Name

.text

Size

207KB

Virtual Size

207KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

40KB

Virtual Size

117KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.cucobe

Size

512B

Virtual Size

377B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

11.5MB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

e06ae8f7d80ef958686b2378d3936803

kernel32

user32

advapi32

generic