fa248af9181fe1164f9eb2e88b45861e347dbb6ca60ff8a2fd40b3e7bb1a4b52

Sharing

Copy URL Twitter E-mail

General

Target
fa248af9181fe1164f9eb2e88b45861e347dbb6ca60ff8a2fd40b3e7bb1a4b52
Size 268KB
Sample240404-22fd6adf62
SHA256 fa248af9181fe1164f9eb2e88b45861e347dbb6ca60ff8a2fd40b3e7bb1a4b52
MD5 0246c2089c513dd176ac575774839ace
SHA1 28e5beccd02777662bcca7d833abef9b42bd80b9
SHA512 c973508dac2e5ecd2cd7ae1c7c54a83d9f0b5f5667b497206e03b96eea102a32bfd19f828265e842d47c595e7dfe2e5c1c285bb6a385c5fd551b2a7c8c88d338
SSDEEP 3072:r9UvDqVxAN56xdtdaYP4Mush+zEfiXhBtui6as0ttsRc8EhEnRr4nby6dH/Pxn2F:wa8Y5u4AE6LZvsRycUVfPx2nT
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fa248af9181fe1164f9eb2e88b45861e347dbb6ca60ff8a2fd40b3e7bb1a4b52

File Explorer

fa248af9181fe1164f9eb2e88b45861e347dbb6ca60ff8a2fd40b3e7bb1a4b52

.exe 268KB

fa248af9181fe1164f9eb2e88b45861e347dbb6ca60ff8a2fd40b3e7bb1a4b52

IMPHASH 5dd5d7719eaae9cf6383e765461f20f8
SHA256 fa248af9181fe1164f9eb2e88b45861e347dbb6ca60ff8a2fd40b3e7bb1a4b52
MD5 0246c2089c513dd176ac575774839ace
SHA1 28e5beccd02777662bcca7d833abef9b42bd80b9
SHA512 c973508dac2e5ecd2cd7ae1c7c54a83d9f0b5f5667b497206e03b96eea102a32bfd19f828265e842d47c595e7dfe2e5c1c285bb6a385c5fd551b2a7c8c88d338
SSDEEP 3072:r9UvDqVxAN56xdtdaYP4Mush+zEfiXhBtui6as0ttsRc8EhEnRr4nby6dH/Pxn2F:wa8Y5u4AE6LZvsRycUVfPx2nT
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16977

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\wafode rojusupekoco24 gocujo74.pdb

kernel32

GetNumaProcessorNode GetLocaleInfoA GlobalAddAtomA GetConsoleAliasA CompareFileTime MoveFileWithProgressA GetNumberFormatA ReadConsoleW GetVolumeInformationA GlobalFindAtomA LoadLibraryW TerminateThread ReadConsoleInputA GetConsoleAliasExesLengthW LeaveCriticalSection GetFileAttributesA WriteConsoleW GetModuleFileNameW GetConsoleOutputCP GetLastError SetThreadContext SetLastError GetProcAddress CopyFileA InterlockedExchangeAdd LocalAlloc FindFirstVolumeMountPointW QueryDosDeviceW VirtualLock GetModuleFileNameA VirtualProtect GetWindowsDirectoryW DeleteTimerQueueTimer GetTempPathA FindNextVolumeA SetEndOfFile CreateFileW GetStringTypeW RemoveVectoredExceptionHandler FindResourceA GetCurrentDirectoryW GetEnvironmentVariableW OutputDebugStringW FlushFileBuffers IsProcessorFeaturePresent EncodePointer DecodePointer ExitProcess GetModuleHandleExW AreFileApisANSI MultiByteToWideChar WideCharToMultiByte GetCommandLineW RaiseException RtlUnwind IsDebuggerPresent HeapAlloc HeapSize EnterCriticalSection HeapFree GetCurrentThreadId GetStdHandle GetFileType DeleteCriticalSection GetStartupInfoW CloseHandle UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW WriteFile LoadLibraryExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetProcessHeap QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW HeapReAlloc LCMapStringW GetConsoleCP GetConsoleMode SetFilePointerEx SetStdHandle ReadFile

user32

CharUpperBuffW CharUpperBuffA

gdi32

SetTextAlign

advapi32

RegisterEventSourceW

ole32

CoGetClassObject

Sharing

General

Malware Config

Signatures

File Explorer

fa248af9181fe1164f9eb2e88b45861e347dbb6ca60ff8a2fd40b3e7bb1a4b52

kernel32

user32

gdi32

advapi32

ole32

generic