134a024e7f598986229e902a75f3c2b047dd4370c22e428c1768ca65715c84bc

General

Target
134a024e7f598986229e902a75f3c2b047dd4370c22e428c1768ca65715c84bc
Size 761KB
Sample240424-msvedsha45
SHA256 134a024e7f598986229e902a75f3c2b047dd4370c22e428c1768ca65715c84bc
MD5 ba17be6ba4bced17f3fb9d48642e063c
SHA1 71fc2aa67a6e1a11547a621c27f42934e25a4a39
SHA512 d40aeb6782388ab3577cd1d4335d0dab306c68e2c9522b0abeae61f1004ad7159c385b870ba0c6bf7ea7fed7a049bf709011792c786b929fa30ff29b0d890219
SSDEEP 12288:JUU0WLpKZ7MSsAtj3CEJSNlPaPlK+NnPnXTrVE6HNDqvUrQ8gxPLG/464O:JD0ZOEwNlUvdXdE6rQxPLtO
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
134a024e7f598986229e902a75f3c2b047dd4370c22e428c1768ca65715c84bc

File Explorer

134a024e7f598986229e902a75f3c2b047dd4370c22e428c1768ca65715c84bc

.exe 761KB

134a024e7f598986229e902a75f3c2b047dd4370c22e428c1768ca65715c84bc

IMPHASH 0c221599ea7b9c4f042cfb23a69ed3b1
SHA256 134a024e7f598986229e902a75f3c2b047dd4370c22e428c1768ca65715c84bc
MD5 ba17be6ba4bced17f3fb9d48642e063c
SHA1 71fc2aa67a6e1a11547a621c27f42934e25a4a39
SHA512 d40aeb6782388ab3577cd1d4335d0dab306c68e2c9522b0abeae61f1004ad7159c385b870ba0c6bf7ea7fed7a049bf709011792c786b929fa30ff29b0d890219
SSDEEP 12288:JUU0WLpKZ7MSsAtj3CEJSNlPaPlK+NnPnXTrVE6HNDqvUrQ8gxPLG/464O:JD0ZOEwNlUvdXdE6rQxPLtO
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

16207

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\zuwiforu.pdb

kernel32

LocalCompact GetComputerNameW CreateHardLinkA BackupSeek GetTickCount GetConsoleAliasesA EnumTimeFormatsA GetUserDefaultLangID SetCommState LoadLibraryW GetLocaleInfoW ReadConsoleInputA WriteConsoleW MultiByteToWideChar GetTempPathW InterlockedExchange GetLastError ChangeTimerQueueTimer SetLastError FindResourceExW GetProcAddress SetFileAttributesA BuildCommDCBW LoadLibraryA LocalAlloc GetExitCodeThread AddAtomW RemoveDirectoryW GlobalFindAtomW GetModuleFileNameA GetOEMCP GlobalUnWire LoadLibraryExA SetCalendarInfoA GetWindowsDirectoryW GetConsoleProcessList GetVolumeInformationW GetThreadLocale GetSystemDefaultLangID GetStringTypeW OutputDebugStringW EncodePointer DecodePointer IsProcessorFeaturePresent GetCommandLineA RaiseException RtlUnwind IsDebuggerPresent HeapFree HeapAlloc ExitProcess GetModuleHandleExW WideCharToMultiByte HeapSize EnterCriticalSection LeaveCriticalSection GetStdHandle GetFileType DeleteCriticalSection GetStartupInfoW CloseHandle GetCurrentThreadId GetProcessHeap WriteFile GetModuleFileNameW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW LoadLibraryExW IsValidCodePage GetACP GetCPInfo HeapReAlloc LCMapStringW GetConsoleCP GetConsoleMode SetFilePointerEx SetStdHandle FlushFileBuffers CreateFileW

advapi32

DeregisterEventSource

winhttp

WinHttpOpen

Sharing

General

Malware Config

Signatures

File Explorer

134a024e7f598986229e902a75f3c2b047dd4370c22e428c1768ca65715c84bc

kernel32

advapi32

winhttp

generic