21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b

Sharing

Copy URL Twitter E-mail

General

Target
21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b
Size 385KB
Sample240403-x2pklsab9t
SHA256 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b
MD5 1510c7e79d87db55f1a78fbc9349ad14
SHA1 b8e0ea6ea4da8c22a56acbe968d2b3d530be4859
SHA512 7131a2a990f0dc77f5aa8c67e135317e6cc1146834ade0c443d2cb727e380abbc38b251e55d79970fedb0e88cd3058b0dc04ffc87c96004d20f1a77af6ef88cc
SSDEEP 6144:dXC4vgmhbIxs3NBB/EM4D7sJ5XyeY9+BpTNoSJ3/6bY0wAqMQ+vM0vi0ipad4O6i:dXCNi9BGMJ7nVF/60kqMVrvirs59
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Signatures

Detects executables containing possible sandbox analysis VM usernames 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_SandboxUserNames

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b

File Explorer

21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b

.exe 385KB

21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b

IMPHASH 4e73db19151d1ed485c4843f251684e3
SHA256 21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b
MD5 1510c7e79d87db55f1a78fbc9349ad14
SHA1 b8e0ea6ea4da8c22a56acbe968d2b3d530be4859
SHA512 7131a2a990f0dc77f5aa8c67e135317e6cc1146834ade0c443d2cb727e380abbc38b251e55d79970fedb0e88cd3058b0dc04ffc87c96004d20f1a77af6ef88cc
SSDEEP 6144:dXC4vgmhbIxs3NBB/EM4D7sJ5XyeY9+BpTNoSJ3/6bY0wAqMQ+vM0vi0ipad4O6i:dXCNi9BGMJ7nVF/60kqMVrvirs59
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Detects executables containing possible sandbox analysis VM usernames
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

19488

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegOpenKeyExA RegQueryValueExA RegCloseKey RegSetValueExA RegConnectRegistryA OpenSCManagerA LockServiceDatabase OpenServiceA ChangeServiceConfigA StartServiceA CloseServiceHandle UnlockServiceDatabase EnumServicesStatusA ControlService DeleteService

shell32

FindExecutableA ShellExecuteA

mpr

WNetAddConnection2A WNetCancelConnection2A WNetOpenEnumA WNetEnumResourceA WNetCloseEnum WNetGetConnectionA

kernel32

GetDriveTypeA GetWindowsDirectoryA GetComputerNameA GetLastError Sleep GetModuleFileNameA GetLocalTime CreateThread OpenMutexA ReleaseMutex CreateMutexA CloseHandle GetVersionExA CreateFileA CreateFileMappingA MapViewOfFile WriteFile SetFilePointer FindFirstFileA FindNextFileA FindClose OpenProcess TerminateProcess CreateToolhelp32Snapshot Process32First Process32Next LoadLibraryA GetProcAddress FreeLibrary GetSystemTimeAsFileTime SetConsoleCtrlHandler GetStartupInfoA GetModuleHandleA VirtualAlloc VirtualQuery HeapCreate HeapDestroy HeapAlloc HeapReAlloc HeapFree HeapSize HeapValidate ExitProcess RtlUnwind GetFileType GetStdHandle GetCurrentProcess DuplicateHandle SetHandleCount GetCommandLineA GetEnvironmentStrings FreeEnvironmentStringsA UnhandledExceptionFilter GetTimeZoneInformation SetStdHandle DeleteFileA ReadFile SetEndOfFile

user32

GetWindowTextA GetWindowThreadProcessId EnumWindows

ws2_32

socket htonl htons bind recvfrom sendto WSAStartup WSACleanup inet_addr gethostbyname gethostbyaddr

Sharing

General

Malware Config

Signatures

File Explorer

21392b015c4bc94c97383344fab4c7d3ac805f9104236704ce713d73486c3b4b

advapi32

shell32

mpr

kernel32

user32

ws2_32

generic