363c8a59e1aa5db76fbea9790e8a5d6aea34c91c31058f27b1d74cd61176d473

General

Target
363c8a59e1aa5db76fbea9790e8a5d6aea34c91c31058f27b1d74cd61176d473
Size 234KB
Sample240408-cx9prsec45
SHA256 363c8a59e1aa5db76fbea9790e8a5d6aea34c91c31058f27b1d74cd61176d473
MD5 ebe71b5ba13ea1a61f3473ef01036eb4
SHA1 29a8e68384ecf60935a61b32b311002a620a85eb
SHA512 f4c7d5b3ee3d4d1e27ef85b58b877f0d033f31881e96cddab7fe845d487a2b1d575f6bb61caada912b8e2b0b17249eafa0cefabeaa1440805a85e76227112746
SSDEEP 3072:+lzupUvMF2X7BHv1uhtw+LZiXhMFM4aNejxBykNwc45uhGg3eo0jCSETu:nWEF+7Bt/Akf44ePykuci+GDBjCSET
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
363c8a59e1aa5db76fbea9790e8a5d6aea34c91c31058f27b1d74cd61176d473

File Explorer

363c8a59e1aa5db76fbea9790e8a5d6aea34c91c31058f27b1d74cd61176d473

.exe 234KB

363c8a59e1aa5db76fbea9790e8a5d6aea34c91c31058f27b1d74cd61176d473

IMPHASH dcf99e8764eb8316e61954e86bb0a268
SHA256 363c8a59e1aa5db76fbea9790e8a5d6aea34c91c31058f27b1d74cd61176d473
MD5 ebe71b5ba13ea1a61f3473ef01036eb4
SHA1 29a8e68384ecf60935a61b32b311002a620a85eb
SHA512 f4c7d5b3ee3d4d1e27ef85b58b877f0d033f31881e96cddab7fe845d487a2b1d575f6bb61caada912b8e2b0b17249eafa0cefabeaa1440805a85e76227112746
SSDEEP 3072:+lzupUvMF2X7BHv1uhtw+LZiXhMFM4aNejxBykNwc45uhGg3eo0jCSETu:nWEF+7Bt/Akf44ePykuci+GDBjCSET
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

16977

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\lakigaf\tahenofeku.pdb

kernel32

GetLocaleInfoA GlobalAddAtomA GetCurrentProcess QueryDosDeviceA GetNumberFormatA ReadConsoleW GetVolumeInformationA GlobalFindAtomA LoadLibraryW ReadConsoleInputA GetConsoleAliasExesLengthW LeaveCriticalSection GetConsoleAliasW WriteConsoleW FileTimeToSystemTime GetModuleFileNameW ExitThread GetConsoleOutputCP GetNumaProcessorNode GetCurrentDirectoryW SetLastError GetThreadLocale GetProcAddress InterlockedExchangeAdd LocalAlloc FindFirstVolumeMountPointW VirtualLock GetModuleFileNameA VirtualProtect GetWindowsDirectoryW DeleteTimerQueueTimer MoveFileWithProgressW GetTempPathA FindNextVolumeA SetThreadContext RemoveVectoredExceptionHandler FindResourceA GetLastError GetEnvironmentVariableW SetEndOfFile SetFilePointerEx IsProcessorFeaturePresent EncodePointer DecodePointer ExitProcess GetModuleHandleExW AreFileApisANSI MultiByteToWideChar WideCharToMultiByte GetCommandLineW RaiseException RtlUnwind IsDebuggerPresent HeapFree HeapAlloc HeapSize EnterCriticalSection GetCurrentThreadId CloseHandle DeleteCriticalSection UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetModuleHandleW GetStdHandle WriteFile LoadLibraryExW IsValidCodePage GetACP GetOEMCP GetCPInfo GetProcessHeap GetFileType QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW HeapReAlloc LCMapStringW SetStdHandle FlushFileBuffers GetConsoleCP GetConsoleMode OutputDebugStringW GetStringTypeW CreateFileW ReadFile

gdi32

SetTextJustification SelectPalette

advapi32

RegisterEventSourceW

ole32

CoGetClassObject

Sharing

General

Malware Config

Signatures

File Explorer

363c8a59e1aa5db76fbea9790e8a5d6aea34c91c31058f27b1d74cd61176d473

kernel32

gdi32

advapi32

ole32

generic