36ca1ca95c36322c60e75f6dd9a0955f83340f4e25140b3757c4389905c25216

General

Target
36ca1ca95c36322c60e75f6dd9a0955f83340f4e25140b3757c4389905c25216
Size 728KB
Sample240520-e4vwascd2z
SHA256 36ca1ca95c36322c60e75f6dd9a0955f83340f4e25140b3757c4389905c25216
MD5 3126b4d37ccbef6d938d706317a6679e
SHA1 8df385167e45ecf93346af81d8a5987ddd9e6f41
SHA512 cefe66787cf4d4f6424adca16fd08dbbfdcb26e3bab642a6c7ad1b0ef1f5aba75a18b64ee9478957d6abef230f8b484938f3664af1abb13d85feb1445514c087
SSDEEP 12288:M0o7B9QE4e17PxB7BY5P/1QH8cV4DXmYGu09KNycFvzF0V1tWJRFq0:wJ4e1FBq5PtFY4DXFt09doqkFq0
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
36ca1ca95c36322c60e75f6dd9a0955f83340f4e25140b3757c4389905c25216

File Explorer

36ca1ca95c36322c60e75f6dd9a0955f83340f4e25140b3757c4389905c25216

.exe 728KB

36ca1ca95c36322c60e75f6dd9a0955f83340f4e25140b3757c4389905c25216

IMPHASH 37b83adc183001c9e38660b73f251c40
SHA256 36ca1ca95c36322c60e75f6dd9a0955f83340f4e25140b3757c4389905c25216
MD5 3126b4d37ccbef6d938d706317a6679e
SHA1 8df385167e45ecf93346af81d8a5987ddd9e6f41
SHA512 cefe66787cf4d4f6424adca16fd08dbbfdcb26e3bab642a6c7ad1b0ef1f5aba75a18b64ee9478957d6abef230f8b484938f3664af1abb13d85feb1445514c087
SSDEEP 12288:M0o7B9QE4e17PxB7BY5P/1QH8cV4DXmYGu09KNycFvzF0V1tWJRFq0:wJ4e1FBq5PtFY4DXFt09doqkFq0
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

15750

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetTickCount TzSpecificLocalTimeToSystemTime WriteConsoleW GetSystemDirectoryA SetComputerNameExW IsBadStringPtrA GetLastError SetLastError GetProcAddress LoadLibraryA GetConsoleAliasA GetNumberFormatW CreateEventW RemoveDirectoryW GetModuleFileNameA BuildCommDCBA VirtualProtect PurgeComm SetFileAttributesW GetVolumeInformationW CloseHandle CreateFileW GetStringTypeW LocalAlloc LoadLibraryExW OutputDebugStringW GetConsoleCP IsProcessorFeaturePresent EncodePointer DecodePointer ExitProcess GetModuleHandleExW AreFileApisANSI MultiByteToWideChar WideCharToMultiByte GetCommandLineW RaiseException RtlUnwind IsDebuggerPresent HeapAlloc HeapSize EnterCriticalSection LeaveCriticalSection HeapFree ReadFile SetFilePointerEx DeleteCriticalSection UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetModuleHandleW GetStdHandle WriteFile GetModuleFileNameW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCurrentThreadId GetProcessHeap GetFileType QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW HeapReAlloc LCMapStringW GetConsoleMode ReadConsoleW SetStdHandle FlushFileBuffers SetEndOfFile

user32

GetMenuItemID ChangeDisplaySettingsW

gdi32

GetCharWidthI

ole32

CoMarshalHresult

Sharing

General

Malware Config

Signatures

File Explorer

36ca1ca95c36322c60e75f6dd9a0955f83340f4e25140b3757c4389905c25216

kernel32

user32

gdi32

ole32

generic