4936a99eedce8022426ea66afa89986622314566e6b877b9bf77de27bd4359a1

General

Target
4936a99eedce8022426ea66afa89986622314566e6b877b9bf77de27bd4359a1
Size 4.2MB
Sample240424-ymc4psgd85
SHA256 4936a99eedce8022426ea66afa89986622314566e6b877b9bf77de27bd4359a1
MD5 4308101586c2195b901bf3b6daaee013
SHA1 83cce72e94adaa47047e21949c14032eaeafe3cc
SHA512 2d14795eb0ad36b8fffc8e082707d86fcbc88bc6f226ac34e63a3fd3d4a88c9cf1af77a5854f4a876565e00b662b91c3683cdbc5e631967de3d524d46afd5907
SSDEEP 98304:YEXL5P92Zen5pxefjCuc273pX2Uwa1rTf0MlNHsj4kvnL:ntP92Zen/gjy21wcHZkT
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

4936a99eedce8022426ea66afa89986622314566e6b877b9bf77de27bd4359a1

.exe 4.2MB

4936a99eedce8022426ea66afa89986622314566e6b877b9bf77de27bd4359a1

IMPHASH d305f7c5c0038604047c1f0be24ef632
SHA256 4936a99eedce8022426ea66afa89986622314566e6b877b9bf77de27bd4359a1
MD5 4308101586c2195b901bf3b6daaee013
SHA1 83cce72e94adaa47047e21949c14032eaeafe3cc
SHA512 2d14795eb0ad36b8fffc8e082707d86fcbc88bc6f226ac34e63a3fd3d4a88c9cf1af77a5854f4a876565e00b662b91c3683cdbc5e631967de3d524d46afd5907
SSDEEP 98304:YEXL5P92Zen5pxefjCuc273pX2Uwa1rTf0MlNHsj4kvnL:ntP92Zen/gjy21wcHZkT
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

PE Signature issue

Digest

b2:28:2d:3c:33:6d:f8:09:e6:dd:c1:08:c2:24:a2:a7:91:40:a6:7f:60:f4:4c:78:8b:6d:2f:9d:79:be:ee:1c

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

CN=522303292b2005041027200a5d5d12051031230d161c143d24542553452740323d28,POSTALCODE=10810,ST=0b1c1115005f5c4e061704171b0617160407045b0c1704+ST=0b1c1115494a5c11101704105c1f07410b17550d0e1c0c5a070a090e025212541c510f17091909155406121d141b0850180d0a16140e53100100171b1d12055b0c0b0a070b

Chains

Apr 23, 2024

Minor OS version

1

Major OS version

5

Entry point

17087

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\jodibe\catuso.pdb

kernel32

GetSystemDefaultLangID GlobalMemoryStatus GetLocaleInfoA FindResourceExW LocalCompact InterlockedDecrement GetComputerNameW CreateHardLinkA BackupSeek GetTickCount GetConsoleAliasesA GetWindowsDirectoryA EnumTimeFormatsA GetUserDefaultLangID SetCommState GlobalAlloc LoadLibraryW ReadConsoleInputA WriteConsoleW GetModuleFileNameW MultiByteToWideChar GetTempPathW GetLastError ChangeTimerQueueTimer SetLastError GetThreadLocale GetProcAddress SetFileAttributesA BuildCommDCBW LoadLibraryA GetExitCodeThread AddAtomW RemoveDirectoryW GlobalFindAtomW GetOEMCP LoadLibraryExA VirtualProtect SetCalendarInfoA GetConsoleProcessList GetVolumeInformationW HeapAlloc EncodePointer DecodePointer IsProcessorFeaturePresent GetCommandLineA RaiseException RtlUnwind IsDebuggerPresent HeapFree ExitProcess GetModuleHandleExW WideCharToMultiByte GetStdHandle WriteFile GetProcessHeap EnterCriticalSection LeaveCriticalSection FlushFileBuffers GetConsoleCP GetConsoleMode DeleteCriticalSection HeapSize GetFileType GetStartupInfoW CloseHandle GetCurrentThreadId GetModuleFileNameA QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW LoadLibraryExW IsValidCodePage GetACP GetCPInfo OutputDebugStringW SetStdHandle SetFilePointerEx HeapReAlloc LCMapStringW GetStringTypeW CreateFileW

Sharing

General

Malware Config

Signatures

File Explorer

4936a99eedce8022426ea66afa89986622314566e6b877b9bf77de27bd4359a1

PE Signature issue

kernel32

generic