89da9a4a5c26b7818e5660b33941b45c8838fa7cfa15685adfe83ff84463799a

General

Target
89da9a4a5c26b7818e5660b33941b45c8838fa7cfa15685adfe83ff84463799a
Size 727KB
Sample240410-pm75eafe93
SHA256 89da9a4a5c26b7818e5660b33941b45c8838fa7cfa15685adfe83ff84463799a
MD5 d377c71f7df1c515705eb6b0cc745f7d
SHA1 a2ac278ec99ec0bcab10b55427753327da1cc3a4
SHA512 f77c6f23836d204a6c03a35277bfed01eded7552a2e06b2e7f2c3fc40e1442e6c9cf007c61e937938cc9b8abffc929ab82aa430a8544dad474a132fc73b805cd
SSDEEP 12288:MxcCHuSL6Ay2gm0XnrU3pwLtvaCXnciv8haBNLZV4wGkbMLwhGkMhjqIvoO:MFXL6ALMkyLNa0DhnH4jj6GLpoO
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
89da9a4a5c26b7818e5660b33941b45c8838fa7cfa15685adfe83ff84463799a

File Explorer

89da9a4a5c26b7818e5660b33941b45c8838fa7cfa15685adfe83ff84463799a

.exe 727KB

89da9a4a5c26b7818e5660b33941b45c8838fa7cfa15685adfe83ff84463799a

IMPHASH 48f8ae55ef81ee1777a03c81c7953458
SHA256 89da9a4a5c26b7818e5660b33941b45c8838fa7cfa15685adfe83ff84463799a
MD5 d377c71f7df1c515705eb6b0cc745f7d
SHA1 a2ac278ec99ec0bcab10b55427753327da1cc3a4
SHA512 f77c6f23836d204a6c03a35277bfed01eded7552a2e06b2e7f2c3fc40e1442e6c9cf007c61e937938cc9b8abffc929ab82aa430a8544dad474a132fc73b805cd
SSDEEP 12288:MxcCHuSL6Ay2gm0XnrU3pwLtvaCXnciv8haBNLZV4wGkbMLwhGkMhjqIvoO:MFXL6ALMkyLNa0DhnH4jj6GLpoO
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

11579

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

RemoveVectoredExceptionHandler FindResourceA WriteConsoleOutputCharacterA SystemTimeToTzSpecificLocalTime SetWaitableTimer GetCurrentProcess HeapFree GetModuleHandleExW CancelWaitableTimer LockFile GetConsoleAliasesA GetCompressedFileSizeW FindResourceExA GlobalFindAtomA GetLocaleInfoW SizeofResource SetSystemTimeAdjustment GetFileAttributesA GetExitCodeProcess TerminateProcess GetAtomNameW GetTimeZoneInformation GetEnvironmentVariableA GlobalUnlock DisconnectNamedPipe VirtualUnlock SetLastError OpenWaitableTimerW LocalAlloc SetConsoleCtrlHandler SetConsoleOutputCP AddAtomA GetTapeParameters GlobalWire lstrcatW VirtualProtect GetFileTime LocalFree SetFileAttributesW LocalFileTimeToFileTime SetEnvironmentVariableA CompareStringW HeapAlloc GetStartupInfoW RaiseException RtlUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetLastError DeleteCriticalSection LeaveCriticalSection FatalAppExitA EnterCriticalSection VirtualFree VirtualAlloc HeapReAlloc HeapCreate HeapDestroy GetModuleHandleW Sleep GetProcAddress ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement GetCurrentThread QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime SetFilePointer WideCharToMultiByte GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage InitializeCriticalSectionAndSpinCount FreeLibrary InterlockedExchange LoadLibraryA MultiByteToWideChar CloseHandle CreateFileA HeapSize SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetTimeFormatA GetDateFormatA GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale FlushFileBuffers ReadFile SetEndOfFile GetProcessHeap CompareStringA GetModuleHandleA

user32

GetMonitorInfoA

Name

.text

Size

655KB

Virtual Size

655KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

57.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.kapu

Size

512B

Virtual Size

1B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.yihikih

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.new

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

37KB

Virtual Size

36KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

89da9a4a5c26b7818e5660b33941b45c8838fa7cfa15685adfe83ff84463799a

kernel32

user32

generic