e13dccc93268b6ecfa5ec147bc81de7e

General

Target
e13dccc93268b6ecfa5ec147bc81de7e
Size 10.1MB
Sample240327-khk2vsge34
SHA256 bab713fc344881c8e7a7b30a23b43fc8a2b0d21039b36c1691874d35a30dc24d
MD5 e13dccc93268b6ecfa5ec147bc81de7e
SHA1 af120c84e56bcc74a3b93be96f76cc40804ca701
SHA512 c26a7b4f05fe681d39be48c35d65a6956aa4b4a47e4ce03cb40da7de3726ab00bf66bcfc0b7996c86dfd1c99fb1b90ebb1f8f04d3cd83ec54b0e80a569aaf69f
SSDEEP 49152:31yvllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll:3A
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e13dccc93268b6ecfa5ec147bc81de7e

File Explorer

e13dccc93268b6ecfa5ec147bc81de7e

.exe 10.1MB

e13dccc93268b6ecfa5ec147bc81de7e

IMPHASH b0294ca3f734a087c5e3ce87ee532045
SHA256 bab713fc344881c8e7a7b30a23b43fc8a2b0d21039b36c1691874d35a30dc24d
MD5 e13dccc93268b6ecfa5ec147bc81de7e
SHA1 af120c84e56bcc74a3b93be96f76cc40804ca701
SHA512 c26a7b4f05fe681d39be48c35d65a6956aa4b4a47e4ce03cb40da7de3726ab00bf66bcfc0b7996c86dfd1c99fb1b90ebb1f8f04d3cd83ec54b0e80a569aaf69f
SSDEEP 49152:31yvllllllllllllllllllllllllllllllllllllllllllllllllllllllllllll:3A
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

46136

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

WaitForSingleObject SetTapeParameters WriteFile FindActCtxSectionStringA FindResourceExA GlobalAlloc Sleep FreeConsole GetFileAttributesA lstrcpynW LocalReAlloc SetSystemPowerState ReadFile GetModuleFileNameW GetACP SetConsoleTitleA HeapUnlock BuildCommDCBW ResetEvent LocalAlloc HeapLock WaitForMultipleObjects GetOEMCP GetModuleHandleA CreateMutexA GetPrivateProfileSectionA GetConsoleTitleW VirtualProtect DeleteCriticalSection ReleaseMutex CommConfigDialogW DeleteFileA GetCurrentProcess FindActCtxSectionGuid SetEndOfFile GetTapeStatus CreateFileA InterlockedIncrement InterlockedDecrement InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetLastError HeapFree TerminateProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoW RtlUnwind RaiseException LCMapStringA WideCharToMultiByte MultiByteToWideChar LCMapStringW GetCPInfo HeapAlloc HeapCreate VirtualFree VirtualAlloc HeapReAlloc GetModuleHandleW GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId CloseHandle ExitProcess GetStdHandle GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime HeapSize IsValidCodePage GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeA GetStringTypeW InitializeCriticalSectionAndSpinCount SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers LoadLibraryA GetLocaleInfoW SetFilePointer GetProcessHeap WriteConsoleA GetConsoleOutputCP WriteConsoleW

gdi32

GetCharWidthFloatA

advapi32

BackupEventLogA AdjustTokenGroups AreAllAccessesGranted MapGenericMask AdjustTokenPrivileges

msimg32

TransparentBlt

Name

.text

Size

178KB

Virtual Size

177KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

34KB

Virtual Size

7.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.wobib

Size

1024B

Virtual Size

626B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.bobica

Size

512B

Virtual Size

23B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fewokaf

Size

512B

Virtual Size

6B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.xen

Size

1024B

Virtual Size

963B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

9.9MB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

e13dccc93268b6ecfa5ec147bc81de7e

kernel32

gdi32

advapi32

msimg32

generic