2d2020ba2c8ec470a5c3424f16012a3b26b4286469fe042177574cc7e22952db

Sharing

Copy URL Twitter E-mail

General

Target
2d2020ba2c8ec470a5c3424f16012a3b26b4286469fe042177574cc7e22952db
Size 176KB
Sample240417-rjrdlabd25
SHA256 2d2020ba2c8ec470a5c3424f16012a3b26b4286469fe042177574cc7e22952db
MD5 cb1bfb236d47bea851ce5eda7968cebb
SHA1 16705706158047ab52a65ceca022185c63754918
SHA512 ee502f696f9716c23d3cd7f590ebe28a056d892b5d0ddb519dc6c1b59dc3ce6a8214fb319ffe7816a1304121215c8099de4898f3aad543faa528731c6eb85c0b
SSDEEP 3072:q0Hh/BZ1+oQrJ2ghp2i0+6bfbdXin+avcewt06JSzLFEfwCIqh:q0/ZK2gnN0i+Hewt9OLFEfwCIS
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/aec37f0045fb7091d04f8eedd38d171debaec8225d344a8050cea1c31b435e74.exe

File Explorer

2d2020ba2c8ec470a5c3424f16012a3b26b4286469fe042177574cc7e22952db

.zip 176KB
aec37f0045fb7091d04f8eedd38d171debaec8225d344a8050cea1c31b435e74.exe

.exe 240KB

2d2020ba2c8ec470a5c3424f16012a3b26b4286469fe042177574cc7e22952db

SHA256 2d2020ba2c8ec470a5c3424f16012a3b26b4286469fe042177574cc7e22952db
MD5 cb1bfb236d47bea851ce5eda7968cebb
SHA1 16705706158047ab52a65ceca022185c63754918
SHA512 ee502f696f9716c23d3cd7f590ebe28a056d892b5d0ddb519dc6c1b59dc3ce6a8214fb319ffe7816a1304121215c8099de4898f3aad543faa528731c6eb85c0b
SSDEEP 3072:q0Hh/BZ1+oQrJ2ghp2i0+6bfbdXin+avcewt06JSzLFEfwCIqh:q0/ZK2gnN0i+Hewt9OLFEfwCIS
MD5 SHA1 SHA512 SSDEEP

Password

infected

aec37f0045fb7091d04f8eedd38d171debaec8225d344a8050cea1c31b435e74.exe

IMPHASH 82e2f6a4dece6269daba8be879ab2b7a
SHA256 aec37f0045fb7091d04f8eedd38d171debaec8225d344a8050cea1c31b435e74
MD5 4fe446a6392bb4473a45ff037592d52c
SHA1 ca815e429534931c4c189c2c91a81fb1d6df1cc5
SHA512 4780e1948f13e258ff9610b08c1f84caaf659fdb3bba7925d9447c20fbf3f1fde9fc24d6fd616003d8be349a2bfe3a845074ec1206efe764aef925c0c2547db4
SSDEEP 3072:z0/Jk9z3DmaXLVODmGP+Xrn6dThsLNkeBaxRuiluCxh3t35waZVTGh:wxmz3KaXC2Xr6dWLPoRNH3TlG
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5701

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

HeapAlloc SystemTimeToFileTime GetUserDefaultLCID WideCharToMultiByte GetConsoleAliasExesLengthW GetTimeZoneInformation ReleaseSemaphore ReplaceFileA GetConsoleOutputCP GetStdHandle GetCurrentDirectoryW SetLastError CreateNamedPipeA CreateTimerQueueTimer LoadLibraryA InterlockedExchangeAdd SystemTimeToTzSpecificLocalTime GetFileType AddAtomW GetModuleFileNameA lstrcatW FreeEnvironmentStringsW BuildCommDCBA VirtualProtect FatalAppExitA EndUpdateResourceA GetVolumeInformationW CreateFileW WriteConsoleW SetFilePointer GetStringTypeW GetLocaleInfoA MoveFileExA LocalAlloc WriteConsoleOutputCharacterW MultiByteToWideChar LCMapStringW GetLastError HeapFree EncodePointer DecodePointer GetCommandLineW HeapSetInformation GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent HeapCreate Sleep HeapSize GetProcAddress GetModuleHandleW ExitProcess EnterCriticalSection LeaveCriticalSection CloseHandle WriteFile GetModuleFileNameW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime RaiseException HeapReAlloc LoadLibraryW RtlUnwind GetCPInfo GetACP GetOEMCP IsValidCodePage SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers

user32

SetActiveWindow SetKeyboardState CreateIcon GetClassLongA

gdi32

GetCharWidthW

advapi32

GetAce

ole32

CoTaskMemFree

Sharing

General

Malware Config

Signatures

File Explorer

2d2020ba2c8ec470a5c3424f16012a3b26b4286469fe042177574cc7e22952db

aec37f0045fb7091d04f8eedd38d171debaec8225d344a8050cea1c31b435e74.exe

kernel32

user32

gdi32

advapi32

ole32

generic