bac6a7afb5447556528a8d449bcc5d382a4f4ccd25b31dee86ac40f4c462624d

Sharing

Copy URL Twitter E-mail

General

Target
bac6a7afb5447556528a8d449bcc5d382a4f4ccd25b31dee86ac40f4c462624d
Size 805KB
Sample240417-p53yeagb22
SHA256 bac6a7afb5447556528a8d449bcc5d382a4f4ccd25b31dee86ac40f4c462624d
MD5 fdaf82c56bb3d8ba6d0efa7becc52c80
SHA1 ab0dca0a0ddc9d4d6a3f4a8bd07fb80e06e68e22
SHA512 d96019e09fc365b12de5d19b2d142bddaf88753204f20455985f5bb5d82a84b62a3b226493d33b469532f307a6506847d921f1c6f3de759b273acfd88a32b598
SSDEEP 12288:mcK30av3XRmN3vqhJv6S6bweFonltmV10SoQtbxVR0MZ9VuQ3IIn6xMl:mxnRmcr6Jxgw10SfxjR0Mxu6Z6
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bac6a7afb5447556528a8d449bcc5d382a4f4ccd25b31dee86ac40f4c462624d

File Explorer

bac6a7afb5447556528a8d449bcc5d382a4f4ccd25b31dee86ac40f4c462624d

.exe 805KB

bac6a7afb5447556528a8d449bcc5d382a4f4ccd25b31dee86ac40f4c462624d

IMPHASH 82db959f3b3344b845e4c7b707536cda
SHA256 bac6a7afb5447556528a8d449bcc5d382a4f4ccd25b31dee86ac40f4c462624d
MD5 fdaf82c56bb3d8ba6d0efa7becc52c80
SHA1 ab0dca0a0ddc9d4d6a3f4a8bd07fb80e06e68e22
SHA512 d96019e09fc365b12de5d19b2d142bddaf88753204f20455985f5bb5d82a84b62a3b226493d33b469532f307a6506847d921f1c6f3de759b273acfd88a32b598
SSDEEP 12288:mcK30av3XRmN3vqhJv6S6bweFonltmV10SoQtbxVR0MZ9VuQ3IIn6xMl:mxnRmcr6Jxgw10SfxjR0Mxu6Z6
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

26677

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\dobikiritova_kawomes.pdb

kernel32

FindVolumeClose GetNumaProcessorNode GetLocaleInfoA GetUserDefaultLCID GetNumberFormatA GlobalFindAtomA LoadLibraryW ReadConsoleInputA ReadProcessMemory WriteConsoleW GetModuleFileNameW GetCompressedFileSizeA SetThreadLocale GetStdHandle GetLastError ChangeTimerQueueTimer VirtualAlloc GetThreadContext LocalAlloc CreateHardLinkW GetExitCodeThread AddAtomW RemoveDirectoryW SetCommMask GetOEMCP FindFirstChangeNotificationA VirtualProtect SetCalendarInfoA GetWindowsDirectoryW GetCurrentProcessId AddConsoleAliasA SetFileAttributesW GetVolumeInformationW CreateThread CreateFileW CopyFileA DebugActiveProcess OutputDebugStringW FlushFileBuffers SetStdHandle ReadFile WideCharToMultiByte MultiByteToWideChar GetStringTypeW EncodePointer DecodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection HeapFree GetCommandLineA GetCPInfo RaiseException RtlUnwind HeapAlloc IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetModuleHandleW GetProcAddress LCMapStringW GetLocaleInfoW IsValidLocale EnumSystemLocalesW IsValidCodePage GetACP GetCurrentThreadId IsDebuggerPresent GetFileType GetProcessHeap ExitProcess GetModuleHandleExW HeapSize CloseHandle GetModuleFileNameA WriteFile QueryPerformanceCounter GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW HeapReAlloc GetConsoleCP GetConsoleMode SetFilePointerEx LoadLibraryExW

user32

GetMenuItemID

gdi32

GetCharacterPlacementW

ole32

CoMarshalHresult

winhttp

WinHttpReadData

Sharing

General

Malware Config

Signatures

File Explorer

bac6a7afb5447556528a8d449bcc5d382a4f4ccd25b31dee86ac40f4c462624d

kernel32

user32

gdi32

ole32

winhttp

generic