4adf61aa0b44273e8e9a770859225514ce7433fef615469f88180d417867abce

General

Target
4adf61aa0b44273e8e9a770859225514ce7433fef615469f88180d417867abce
Size 738KB
Sample240405-e1rdpscf32
SHA256 4adf61aa0b44273e8e9a770859225514ce7433fef615469f88180d417867abce
MD5 ac082d5f48200f4358291a225ee23e5b
SHA1 e808bd1bf51b927b7a3ce5bc829ee97c5eef331a
SHA512 4096df8372d7b964edf03de352053275216ebbb1f580222d7d912b8b6a629a5cda9518956c856fd5db9148cf04a9754ad0908a64835accf6475cb774eb77a00d
SSDEEP 12288:X8RTBaYnrGFixBFuNVvOimuPXsK7ydZKgf3KjRUEKgsZqTAMkl:XGBbnyABFuNVvOhIXskcZ3KjOZ5
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4adf61aa0b44273e8e9a770859225514ce7433fef615469f88180d417867abce

File Explorer

4adf61aa0b44273e8e9a770859225514ce7433fef615469f88180d417867abce

.exe 738KB

4adf61aa0b44273e8e9a770859225514ce7433fef615469f88180d417867abce

IMPHASH 139fb810012bd1f8fb1fed972825a3ee
SHA256 4adf61aa0b44273e8e9a770859225514ce7433fef615469f88180d417867abce
MD5 ac082d5f48200f4358291a225ee23e5b
SHA1 e808bd1bf51b927b7a3ce5bc829ee97c5eef331a
SHA512 4096df8372d7b964edf03de352053275216ebbb1f580222d7d912b8b6a629a5cda9518956c856fd5db9148cf04a9754ad0908a64835accf6475cb774eb77a00d
SSDEEP 12288:X8RTBaYnrGFixBFuNVvOimuPXsK7ydZKgf3KjRUEKgsZqTAMkl:XGBbnyABFuNVvOhIXskcZ3KjOZ5
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

4698

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

HeapAlloc InterlockedIncrement SystemTimeToFileTime ReadConsoleOutputAttribute HeapFree SetComputerNameW GetTimeFormatA SetEvent GetNumaAvailableMemoryNode GlobalAlloc LoadLibraryW GetFileAttributesA LocalReAlloc GetAtomNameW GetModuleFileNameW MultiByteToWideChar GetLocaleInfoA CreateJobObjectA SetThreadLocale GetLastError HeapSize BuildCommDCBW UnhandledExceptionFilter FindAtomA CreatePipe VirtualProtect GetCurrentDirectoryA SetCalendarInfoA GetProfileSectionW HeapReAlloc FindNextVolumeMountPointW CreateFileA GetCommandLineA HeapSetInformation GetStartupInfoW TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter IsDebuggerPresent GetProcAddress GetModuleHandleW ExitProcess DecodePointer WriteFile GetStdHandle HeapCreate EncodePointer GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree SetLastError GetCurrentThreadId InterlockedDecrement QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection GetCPInfo GetACP GetOEMCP IsValidCodePage Sleep RtlUnwind LCMapStringW GetStringTypeW IsProcessorFeaturePresent

user32

GetMonitorInfoW

advapi32

OpenThreadToken

winhttp

WinHttpOpen

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

4adf61aa0b44273e8e9a770859225514ce7433fef615469f88180d417867abce

kernel32

user32

advapi32

winhttp

generic