471339a0525809eab74b55fed407ac64697dbcfdaf52b21b56cc4a47125e76a8

General

Target
471339a0525809eab74b55fed407ac64697dbcfdaf52b21b56cc4a47125e76a8
Size 260KB
Sample240328-zhmb9agg93
SHA256 471339a0525809eab74b55fed407ac64697dbcfdaf52b21b56cc4a47125e76a8
MD5 8fdbb8914b3d1d601c0557478886a731
SHA1 8fe3855f2448d0a11cb8191ac7b6c496be3aadec
SHA512 ee890542b4d67d35b71fcacb0c8fbd578fc7fcad3e852cf55281d72efed573c13e76c603e05a14a44f2a2e3b3ec1d87fc14cf0e507279cab472e14252acd4da7
SSDEEP 3072:sFIby+X2CcC3GnpFoTOz6++aekasG+hXexfgoCOPHAxWwAac5kEzF2cuUyX1A6Z:sm+q2CD30WTOPwktGvgYwAaH8F2N
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
471339a0525809eab74b55fed407ac64697dbcfdaf52b21b56cc4a47125e76a8

File Explorer

471339a0525809eab74b55fed407ac64697dbcfdaf52b21b56cc4a47125e76a8

.exe 260KB

471339a0525809eab74b55fed407ac64697dbcfdaf52b21b56cc4a47125e76a8

IMPHASH e87c9c66e32f791de60bd46f1df17fc3
SHA256 471339a0525809eab74b55fed407ac64697dbcfdaf52b21b56cc4a47125e76a8
MD5 8fdbb8914b3d1d601c0557478886a731
SHA1 8fe3855f2448d0a11cb8191ac7b6c496be3aadec
SHA512 ee890542b4d67d35b71fcacb0c8fbd578fc7fcad3e852cf55281d72efed573c13e76c603e05a14a44f2a2e3b3ec1d87fc14cf0e507279cab472e14252acd4da7
SSDEEP 3072:sFIby+X2CcC3GnpFoTOz6++aekasG+hXexfgoCOPHAxWwAac5kEzF2cuUyX1A6Z:sm+q2CD30WTOPwktGvgYwAaH8F2N
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

16167

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\sayiyiwipegiy\kawuve 39_xuvonekisa.pdb

kernel32

InterlockedIncrement ReadConsoleA GetTickCount GetConsoleAliasesLengthA GetWindowsDirectoryA GlobalAlloc SetCommConfig GetLocaleInfoW GetSystemPowerStatus GetVersionExW FindNextVolumeW GetConsoleAliasW GetWriteWatch WriteConsoleW CreateFileW GetEnvironmentVariableA ExitThread GetHandleInformation GetLastError GetProcAddress FindResourceW RemoveDirectoryA LoadLibraryA FindFirstVolumeMountPointW SetConsoleCtrlHandler GetNumberFormatW SetFileApisToANSI QueryDosDeviceW GlobalFindAtomW GetModuleFileNameA VirtualProtect GetCurrentDirectoryA PeekConsoleInputA _lopen GetCurrentProcessId GetVolumeInformationW OutputDebugStringW HeapReAlloc SetStdHandle LCMapStringW GetConsoleAliasExesLengthA MultiByteToWideChar EncodePointer DecodePointer ReadFile ExitProcess GetModuleHandleExW WideCharToMultiByte GetCommandLineA RaiseException RtlUnwind IsProcessorFeaturePresent IsDebuggerPresent IsValidCodePage GetACP GetOEMCP GetCPInfo SetLastError GetCurrentThreadId EnterCriticalSection LeaveCriticalSection FlushFileBuffers WriteFile GetConsoleCP GetConsoleMode DeleteCriticalSection HeapSize HeapFree SetFilePointerEx GetStdHandle GetFileType GetStartupInfoW UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW GetModuleFileNameW LoadLibraryExW HeapAlloc GetProcessHeap QueryPerformanceCounter GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW GetStringTypeW CloseHandle

user32

ChangeMenuA DrawFrameControl CharUpperBuffW

advapi32

ReadEventLogW

Sharing

General

Malware Config

Signatures

File Explorer

471339a0525809eab74b55fed407ac64697dbcfdaf52b21b56cc4a47125e76a8

kernel32

user32

advapi32

generic