d0cff1c79d8adb733a42a60061367d93d386df1d0ccf38125560495013d1fdd7

General

Target
d0cff1c79d8adb733a42a60061367d93d386df1d0ccf38125560495013d1fdd7
Size 1.2MB
Sample240529-c4117sfc2w
SHA256 d0cff1c79d8adb733a42a60061367d93d386df1d0ccf38125560495013d1fdd7
MD5 20c0c1ac1ccbc081436d27fbf3367018
SHA1 c906b9ea627faac3cb937d895f97ea48cc69117b
SHA512 fce02ca6541ce7db1fe18b59903913a5554955d208cab59d2b6332f31691c363e21843f9d776c6d8bca3e1b1ed7680a5df521d2efdd28e41316df99adb55a670
SSDEEP 24576:h31VCBXwQZcoYrPO9ywF98ScT0++/eThPDuLOh8:h31JQZFYrPO9vLcQ+x1Dyb
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d0cff1c79d8adb733a42a60061367d93d386df1d0ccf38125560495013d1fdd7

File Explorer

d0cff1c79d8adb733a42a60061367d93d386df1d0ccf38125560495013d1fdd7

.exe 1.2MB

d0cff1c79d8adb733a42a60061367d93d386df1d0ccf38125560495013d1fdd7

IMPHASH 34738ce7256c19c4934900ea37dfbbd6
SHA256 d0cff1c79d8adb733a42a60061367d93d386df1d0ccf38125560495013d1fdd7
MD5 20c0c1ac1ccbc081436d27fbf3367018
SHA1 c906b9ea627faac3cb937d895f97ea48cc69117b
SHA512 fce02ca6541ce7db1fe18b59903913a5554955d208cab59d2b6332f31691c363e21843f9d776c6d8bca3e1b1ed7680a5df521d2efdd28e41316df99adb55a670
SSDEEP 24576:h31VCBXwQZcoYrPO9ywF98ScT0++/eThPDuLOh8:h31JQZFYrPO9vLcQ+x1Dyb
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

12811

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\55tk4l6i5ty0rv\output.pdb

advapi32

GetNumberOfEventLogRecords

kernel32

WaitForSingleObjectEx CreateThread VirtualAlloc FreeConsole CloseHandle Sleep SwitchToThread GetCurrentThreadId GetExitCodeThread GetNativeSystemInfo FormatMessageA WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection QueryPerformanceCounter QueryPerformanceFrequency ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW LocalFree GetLocaleInfoEx EncodePointer DecodePointer MultiByteToWideChar LCMapStringEx SetFileInformationByHandle GetTempPathW InitOnceExecuteOnce CreateEventExW CreateSemaphoreExW FlushProcessWriteBuffers GetCurrentProcessorNumber GetSystemTimeAsFileTime GetTickCount64 FreeLibraryWhenCallbackReturns CreateThreadpoolTimer SetThreadpoolTimer WaitForThreadpoolTimerCallbacks CloseThreadpoolTimer CreateThreadpoolWait SetThreadpoolWait CloseThreadpoolWait GetModuleHandleW GetProcAddress GetFileInformationByHandleEx CreateSymbolicLinkW GetStringTypeW CompareStringEx GetCPInfo IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess GetCurrentProcessId InitializeSListHead IsDebuggerPresent GetStartupInfoW CreateFileW RaiseException RtlUnwind InterlockedPushEntrySList InterlockedFlushSList GetLastError SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitThread ResumeThread FreeLibraryAndExitThread GetModuleHandleExW GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetCurrentThread HeapAlloc HeapFree GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType SetConsoleCtrlHandler FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile GetFileSizeEx SetFilePointerEx ReadConsoleW HeapReAlloc GetTimeZoneInformation OutputDebugStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetProcessHeap HeapSize WriteConsoleW

Name

.text

Size

735KB

Virtual Size

735KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.bsS

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

84KB

Virtual Size

83KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

373KB

Virtual Size

380KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.00cfg

Size

512B

Virtual Size

270B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

d0cff1c79d8adb733a42a60061367d93d386df1d0ccf38125560495013d1fdd7

advapi32

kernel32

generic