4ebebc45004e498bdf1381747354206c02475f9fabd18e397897d3324081cb69

General

Target
4ebebc45004e498bdf1381747354206c02475f9fabd18e397897d3324081cb69
Size 311KB
Sample240428-kybhcscc28
SHA256 4ebebc45004e498bdf1381747354206c02475f9fabd18e397897d3324081cb69
MD5 204d683564be599027ba32ed8897842d
SHA1 d96443e1c8e085d130a5dc6ec00a00516af1f57c
SHA512 1bf0cd9d003ec6bf538e3d5e189c0f8230942d50a44f37e89d3a81be2a66b65169ecb58d503e3a17cd25b3cda2af93e6b877c4accea04260a83140ed3f742869
SSDEEP 3072:n1Et3irRpiJFyw043mc8+i0+f4mmpbUPgkVhxEUxtK4SeI/QOQtUHERow6I7Ild:HwJFuhuYmmPn3ta2t8ER761d
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
4ebebc45004e498bdf1381747354206c02475f9fabd18e397897d3324081cb69

File Explorer

4ebebc45004e498bdf1381747354206c02475f9fabd18e397897d3324081cb69

.exe 311KB

4ebebc45004e498bdf1381747354206c02475f9fabd18e397897d3324081cb69

IMPHASH f654e5c1b5e321f3cf66a20ff016ccab
SHA256 4ebebc45004e498bdf1381747354206c02475f9fabd18e397897d3324081cb69
MD5 204d683564be599027ba32ed8897842d
SHA1 d96443e1c8e085d130a5dc6ec00a00516af1f57c
SHA512 1bf0cd9d003ec6bf538e3d5e189c0f8230942d50a44f37e89d3a81be2a66b65169ecb58d503e3a17cd25b3cda2af93e6b877c4accea04260a83140ed3f742869
SSDEEP 3072:n1Et3irRpiJFyw043mc8+i0+f4mmpbUPgkVhxEUxtK4SeI/QOQtUHERow6I7Ild:HwJFuhuYmmPn3ta2t8ER761d
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

17170

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\gelusasug_focowa\gikonan78\yorihalow.pdb

kernel32

GetSystemDefaultLangID GlobalMemoryStatus FindResourceA GetLocaleInfoA LoadLibraryExW InterlockedDecrement GetComputerNameW GetSystemDefaultLCID BackupSeek GetConsoleAliasesA GetWindowsDirectoryA EnumTimeFormatsW SetCommState GlobalAlloc GetVolumeInformationA LoadLibraryW LocalShrink TerminateThread ReadConsoleInputA WriteConsoleW GetModuleFileNameW GetACP MultiByteToWideChar GetLastError ChangeTimerQueueTimer SetLastError GetThreadLocale GetProcAddress RemoveDirectoryA InterlockedExchangeAdd SetCalendarInfoW CreateHardLinkW CreateEventW QueryDosDeviceW AddAtomA GlobalFindAtomW BuildCommDCBA VirtualProtect GetConsoleProcessList GetTempPathA SetFileAttributesW EncodePointer DecodePointer HeapReAlloc ExitProcess GetModuleHandleExW AreFileApisANSI WideCharToMultiByte GetCommandLineA RaiseException RtlUnwind IsProcessorFeaturePresent IsDebuggerPresent HeapFree HeapAlloc EnterCriticalSection LeaveCriticalSection FlushFileBuffers WriteFile GetConsoleCP GetConsoleMode DeleteCriticalSection HeapSize GetStdHandle GetFileType GetStartupInfoW GetProcessHeap CloseHandle UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW IsValidCodePage GetOEMCP GetCPInfo GetCurrentThreadId GetModuleFileNameA QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW SetStdHandle SetFilePointerEx LCMapStringW OutputDebugStringW GetStringTypeW CreateFileW SetEndOfFile ReadFile ReadConsoleW

Sharing

General

Malware Config

Signatures

File Explorer

4ebebc45004e498bdf1381747354206c02475f9fabd18e397897d3324081cb69

kernel32

generic