32cb9a1376e95ae1208d77394b6056af821b9bee230d1dad80b13a6f5b0c08d7

General

Target
32cb9a1376e95ae1208d77394b6056af821b9bee230d1dad80b13a6f5b0c08d7
Size 811KB
Sample240415-px85fsef45
SHA256 32cb9a1376e95ae1208d77394b6056af821b9bee230d1dad80b13a6f5b0c08d7
MD5 d26b5f117004ecb74c81c25dbda723a4
SHA1 00041f51fd5ccc7aa91eac8bfc9f5de6a5f1b129
SHA512 742abb55b16270e2f51ba4bad4fbbd926a09e6eb1a6e8ca1539132274f70dea525a66f72217d5256dbec6a13a846969fd480f6ed2ae74a3e3745fa93cd056be0
SSDEEP 12288:ni7/kZSkeL8jFpqHYV3DjdSXrSyb24fgRQjsMgd5pgI0iEVD+:nioSk97V/d8UkoQjsH5pgI0F
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
32cb9a1376e95ae1208d77394b6056af821b9bee230d1dad80b13a6f5b0c08d7

File Explorer

32cb9a1376e95ae1208d77394b6056af821b9bee230d1dad80b13a6f5b0c08d7

.exe 811KB

32cb9a1376e95ae1208d77394b6056af821b9bee230d1dad80b13a6f5b0c08d7

IMPHASH bbf1973b17d49afd80fcc4d52ee6bc10
SHA256 32cb9a1376e95ae1208d77394b6056af821b9bee230d1dad80b13a6f5b0c08d7
MD5 d26b5f117004ecb74c81c25dbda723a4
SHA1 00041f51fd5ccc7aa91eac8bfc9f5de6a5f1b129
SHA512 742abb55b16270e2f51ba4bad4fbbd926a09e6eb1a6e8ca1539132274f70dea525a66f72217d5256dbec6a13a846969fd480f6ed2ae74a3e3745fa93cd056be0
SSDEEP 12288:ni7/kZSkeL8jFpqHYV3DjdSXrSyb24fgRQjsMgd5pgI0iEVD+:nioSk97V/d8UkoQjsH5pgI0F
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

26866

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\tuhi\fuguy\tinokita\zug.pdb

kernel32

DebugActiveProcess SetThreadContext FindVolumeClose GetConsoleAliasA GetCurrentProcess WriteConsoleInputA CreateHardLinkA GetNumberFormatA GetUserDefaultLangID GlobalFindAtomA LoadLibraryW TerminateThread GetLocaleInfoW ReadConsoleInputA ReadProcessMemory GetConsoleAliasExesLengthW WriteConsoleW GetCompressedFileSizeA GetACP GetLastError GetThreadLocale RemoveDirectoryA CopyFileA VirtualAllocEx GetNumaHighestNodeNumber LoadLibraryA WriteConsoleA InterlockedExchangeAdd LocalAlloc SetCalendarInfoW AddAtomW VirtualLock GetCommMask GetModuleFileNameA VirtualProtect GetWindowsDirectoryW DeleteTimerQueueTimer FindNextVolumeA SetFileAttributesW GetVolumeInformationW SetEndOfFile CreateFileW OutputDebugStringW FlushFileBuffers WideCharToMultiByte MultiByteToWideChar GetStringTypeW EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection HeapFree GetCommandLineA GetCPInfo RaiseException RtlUnwind HeapAlloc IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError InitializeCriticalSectionAndSpinCount Sleep TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetModuleHandleW GetProcAddress LCMapStringW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW IsValidCodePage GetOEMCP GetCurrentThreadId IsDebuggerPresent GetStdHandle GetFileType GetProcessHeap ReadFile ExitProcess GetModuleHandleExW AreFileApisANSI HeapSize CloseHandle WriteFile GetModuleFileNameW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW HeapReAlloc GetConsoleCP GetConsoleMode SetFilePointerEx ReadConsoleW LoadLibraryExW SetStdHandle

user32

GetMenuInfo

winhttp

WinHttpReadData

Sharing

General

Malware Config

Signatures

File Explorer

32cb9a1376e95ae1208d77394b6056af821b9bee230d1dad80b13a6f5b0c08d7

kernel32

user32

winhttp

generic