ebbf30e06de3a25f76cf43c72c521d14a27053e4d9be566b41f50c41bea3a7a9

General

Target
ebbf30e06de3a25f76cf43c72c521d14a27053e4d9be566b41f50c41bea3a7a9
Size 223KB
Sample240410-r5f5rabf68
SHA256 ebbf30e06de3a25f76cf43c72c521d14a27053e4d9be566b41f50c41bea3a7a9
MD5 893b17ed65ecffa8376063349f22d2bc
SHA1 50c556277899d6b9da5ec125c0a58650a14a08a7
SHA512 e61a215547991592a204868a979ec513198a6ba192a692a97ccba352c427dc1721a433c0aaaa98107f2d91ae5d2b0aad57ea9ea86ca48a0d61b8a48ecef6b787
SSDEEP 3072:EwA6vAcT6agXrIISqRIYrCNrACDJi7kX9ne6uDxj5AiOhtSvLt2b:6cT6PXrI/qRIZrACGkX9niILtUt2b
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ebbf30e06de3a25f76cf43c72c521d14a27053e4d9be566b41f50c41bea3a7a9

File Explorer

ebbf30e06de3a25f76cf43c72c521d14a27053e4d9be566b41f50c41bea3a7a9

.exe 223KB

ebbf30e06de3a25f76cf43c72c521d14a27053e4d9be566b41f50c41bea3a7a9

IMPHASH 8f3b883f63bfc01a6dacbc74bf6f7699
SHA256 ebbf30e06de3a25f76cf43c72c521d14a27053e4d9be566b41f50c41bea3a7a9
MD5 893b17ed65ecffa8376063349f22d2bc
SHA1 50c556277899d6b9da5ec125c0a58650a14a08a7
SHA512 e61a215547991592a204868a979ec513198a6ba192a692a97ccba352c427dc1721a433c0aaaa98107f2d91ae5d2b0aad57ea9ea86ca48a0d61b8a48ecef6b787
SSDEEP 3072:EwA6vAcT6agXrIISqRIYrCNrACDJi7kX9ne6uDxj5AiOhtSvLt2b:6cT6PXrI/qRIZrACGkX9niILtUt2b
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

28355

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\lorec53_niyu-femebovoyipo_giguma-remex-gozu.pdb

kernel32

WriteConsoleW GetSystemPowerStatus DeleteVolumeMountPointW GetDefaultCommConfigW CreateMutexW GetStdHandle InterlockedDecrement SetSystemTimeAdjustment FileTimeToSystemTime GetNamedPipeHandleStateW CallNamedPipeW EnumResourceNamesW BuildCommDCBAndTimeoutsA EnterCriticalSection DebugSetProcessKillOnExit EnumTimeFormatsW TlsSetValue GetACP WriteFile GetCurrentActCtx ReleaseActCtx AddRefActCtx GetHandleInformation OpenFile VerifyVersionInfoA GetVersionExA FreeLibrary LoadLibraryExW GetComputerNameA CommConfigDialogA VirtualProtect GetProcessPriorityBoost LoadLibraryW GlobalAlloc SetEndOfFile CancelWaitableTimer GetCurrentDirectoryW VirtualFree GetCommMask HeapFree RaiseException GetBinaryTypeA LocalSize SetConsoleMode GetLargestConsoleWindowSize WriteConsoleInputW OpenMutexW SetThreadContext AddAtomW FindVolumeMountPointClose GetSystemTime GetCommandLineA SetLocalTime GetSystemTimeAsFileTime DisconnectNamedPipe SetConsoleCursorInfo TerminateThread GetFileAttributesW GetLastError lstrlenA CompareStringW CompareStringA lstrcpyA CreateJobObjectW RtlUnwind TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetStartupInfoA HeapAlloc LeaveCriticalSection GetProcAddress GetModuleHandleA GetModuleHandleW TlsGetValue TlsAlloc TlsFree InterlockedIncrement SetLastError GetCurrentThreadId GetCurrentThread Sleep ExitProcess GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection HeapCreate HeapDestroy QueryPerformanceCounter GetTickCount GetCurrentProcessId SetFilePointer GetConsoleCP GetConsoleMode GetCPInfo GetOEMCP IsValidCodePage FatalAppExitA VirtualAlloc HeapReAlloc HeapSize SetConsoleCtrlHandler InterlockedExchange LoadLibraryA InitializeCriticalSectionAndSpinCount SetStdHandle WriteConsoleA GetConsoleOutputCP MultiByteToWideChar LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW GetTimeFormatA GetDateFormatA GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale FlushFileBuffers GetLocaleInfoW CreateFileA CloseHandle GetTimeZoneInformation SetEnvironmentVariableA

user32

GetComboBoxInfo

advapi32

ClearEventLogW

Sharing

General

Malware Config

Signatures

File Explorer

ebbf30e06de3a25f76cf43c72c521d14a27053e4d9be566b41f50c41bea3a7a9

kernel32

user32

advapi32

generic