ea3ca6d2059e9ca8f004cfdd99a5bc68cc7276c47c9848de3910627401e1794d

General

Target
ea3ca6d2059e9ca8f004cfdd99a5bc68cc7276c47c9848de3910627401e1794d
Size 570KB
Sample240404-21plfadf35
SHA256 ea3ca6d2059e9ca8f004cfdd99a5bc68cc7276c47c9848de3910627401e1794d
MD5 867e2c013de864fd566189d868d96da9
SHA1 0989e8d817350a84f0b743672977af09f44dd24b
SHA512 303082fb39a9c787c941f01cad46bdf594d922d28b65c3ffcf82f933966b19b584288b678111fd4c4e49b6a675be9d8c95ddbbc97710cf5a3b9b03ae5aa9774b
SSDEEP 12288:BYMsdPpa59a6FlQZaMekmvotz+kmufkpLaciVwu:BuR8NFlEaNN4SkmufkniVwu
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ea3ca6d2059e9ca8f004cfdd99a5bc68cc7276c47c9848de3910627401e1794d

File Explorer

ea3ca6d2059e9ca8f004cfdd99a5bc68cc7276c47c9848de3910627401e1794d

.exe 570KB

ea3ca6d2059e9ca8f004cfdd99a5bc68cc7276c47c9848de3910627401e1794d

IMPHASH 6c17cd221979c51b4b1f1bc0b7dc863e
SHA256 ea3ca6d2059e9ca8f004cfdd99a5bc68cc7276c47c9848de3910627401e1794d
MD5 867e2c013de864fd566189d868d96da9
SHA1 0989e8d817350a84f0b743672977af09f44dd24b
SHA512 303082fb39a9c787c941f01cad46bdf594d922d28b65c3ffcf82f933966b19b584288b678111fd4c4e49b6a675be9d8c95ddbbc97710cf5a3b9b03ae5aa9774b
SSDEEP 12288:BYMsdPpa59a6FlQZaMekmvotz+kmufkpLaciVwu:BuR8NFlEaNN4SkmufkniVwu
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

14675

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\hevinutozavun85\biguvuyenuw\jig85\mawipeveramu3\gedo85.pdb

kernel32

SetThreadContext GetConsoleAliasesLengthW GetLocaleInfoA GlobalAddAtomA GetConsoleAliasA QueryDosDeviceA _lcreat MoveFileWithProgressA GetNumberFormatA ReadConsoleW GetConsoleCP GetVolumeInformationA GlobalFindAtomA InitializeCriticalSectionAndSpinCount ReadConsoleInputA FindNextVolumeW WriteConsoleW FileTimeToSystemTime FindResourceA GetTempPathW GetLastError ChangeTimerQueueTimer SetLastError GetProcAddress LoadLibraryA InterlockedExchangeAdd LocalAlloc FindFirstVolumeMountPointW RemoveDirectoryW VirtualLock GetModuleFileNameA GetCurrentDirectoryA GetWindowsDirectoryW GetStringTypeW OutputDebugStringW FlushFileBuffers CreateFileA GetNumaNodeProcessorMask ExitThread GetEnvironmentVariableW IsProcessorFeaturePresent EncodePointer DecodePointer ExitProcess GetModuleHandleExW MultiByteToWideChar WideCharToMultiByte GetCommandLineW RaiseException RtlUnwind IsDebuggerPresent HeapSize HeapFree GetCurrentThreadId EnterCriticalSection LeaveCriticalSection GetStdHandle GetFileType DeleteCriticalSection GetStartupInfoW CloseHandle UnhandledExceptionFilter SetUnhandledExceptionFilter Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW WriteFile GetModuleFileNameW LoadLibraryExW IsValidCodePage GetACP GetOEMCP GetCPInfo HeapAlloc GetProcessHeap QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW HeapReAlloc LCMapStringW GetConsoleMode SetFilePointerEx SetStdHandle CreateFileW

user32

CharUpperBuffA DrawCaption

gdi32

SetTextColor

advapi32

ReadEventLogW

Sharing

General

Malware Config

Signatures

File Explorer

ea3ca6d2059e9ca8f004cfdd99a5bc68cc7276c47c9848de3910627401e1794d

kernel32

user32

gdi32

advapi32

generic