a5fa265584de70494e0f157f3d36af977629dede0d10cae96ff333712f4d6348

General

Target
a5fa265584de70494e0f157f3d36af977629dede0d10cae96ff333712f4d6348
Size 4.1MB
Sample240421-tw9rtafa52
SHA256 a5fa265584de70494e0f157f3d36af977629dede0d10cae96ff333712f4d6348
MD5 b47fdaf06def2d9fdef7b418061f2a82
SHA1 7c42df27d750c81e5ac7a41fbe4e03cd8e059272
SHA512 220ec67ad898b703357b6fc64aec02e1e950e3c0ee1dc9817e8af17eaa642a6c51194802a084c91bfbc6abb9905e626779af88fd441991262f6915c7769e9da3
SSDEEP 98304:8wAze/FNZMWTI4IerOgms7GjcZA7/RTa+EmUQAtQ:+S/DzMv1si4yTElQp
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

a5fa265584de70494e0f157f3d36af977629dede0d10cae96ff333712f4d6348

.exe 4.1MB

a5fa265584de70494e0f157f3d36af977629dede0d10cae96ff333712f4d6348

IMPHASH 9f06483be0cb3e943a20251385e705a2
SHA256 a5fa265584de70494e0f157f3d36af977629dede0d10cae96ff333712f4d6348
MD5 b47fdaf06def2d9fdef7b418061f2a82
SHA1 7c42df27d750c81e5ac7a41fbe4e03cd8e059272
SHA512 220ec67ad898b703357b6fc64aec02e1e950e3c0ee1dc9817e8af17eaa642a6c51194802a084c91bfbc6abb9905e626779af88fd441991262f6915c7769e9da3
SSDEEP 98304:8wAze/FNZMWTI4IerOgms7GjcZA7/RTa+EmUQAtQ:+S/DzMv1si4yTElQp
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

62:45:1f:7c:09:a6:86:39:ed:55:80:6c:75:aa:b5:d3:5a:45:5f:6a:34:92:2c:f6:36:80:bd:78:0c:ed:44:b8

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=522910322628070b250c52200b542f1a57031b422732351e332f4620190820022d0b,POSTALCODE=10826,ST=0b1c1115005f5c4e010b00101c041100031a0d10104b111d+ST=0b1c1115494a5c18101602500b53081d121c021c1b120f07110e12511d161a5003091c030c1053460e4113160e181d130101060d401252070f0f08001312055b0c0b0a070b

Chains

Apr 19, 2024

Minor OS version

1

Major OS version

5

Entry point

16493

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\nowasugotoy\kok.pdb

kernel32

GetUserDefaultLCID AddConsoleAliasW CreateHardLinkA GetTickCount EnumTimeFormatsW GetUserDefaultLangID FindResourceExA GetVolumeInformationA GetCompressedFileSizeA GetTempPathW SetThreadLocale SetLastError GetProcAddress CreateTimerQueueTimer SetFileAttributesA LocalCompact LoadLibraryA WriteConsoleA InterlockedExchangeAdd LocalAlloc SetCalendarInfoW GetExitCodeThread RemoveDirectoryW AddAtomA SetNamedPipeHandleState GlobalFindAtomW GetModuleFileNameA GetOEMCP GlobalUnWire LoadLibraryExA ReadConsoleInputW GetWindowsDirectoryW AddConsoleAliasA FindFirstChangeNotificationW GetLocaleInfoA BuildCommDCBW GetComputerNameA WriteConsoleW OutputDebugStringW GetLastError HeapFree EncodePointer DecodePointer ReadFile ExitProcess GetModuleHandleExW MultiByteToWideChar WideCharToMultiByte GetCommandLineA RaiseException RtlUnwind IsProcessorFeaturePresent IsValidCodePage GetACP GetCPInfo GetCurrentThreadId IsDebuggerPresent HeapAlloc GetProcessHeap HeapSize EnterCriticalSection LeaveCriticalSection SetFilePointerEx GetConsoleMode GetStdHandle GetFileType DeleteCriticalSection GetStartupInfoW CloseHandle UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW WriteFile GetModuleFileNameW LoadLibraryExW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW GetStringTypeW HeapReAlloc LCMapStringW SetStdHandle GetConsoleCP FlushFileBuffers CreateFileW

gdi32

GetCharacterPlacementW

advapi32

DeregisterEventSource

winhttp

WinHttpConnect

Sharing

General

Malware Config

Signatures

File Explorer

a5fa265584de70494e0f157f3d36af977629dede0d10cae96ff333712f4d6348

PE Signature issue

kernel32

gdi32

advapi32

winhttp

generic