e8fbaf1e0a9724d541898c17c3cc7c2b703d00ef2e8bd3e0fb70a7c0df8ca9e7

General

Target
e8fbaf1e0a9724d541898c17c3cc7c2b703d00ef2e8bd3e0fb70a7c0df8ca9e7
Size 248KB
Sample240531-mefn3sfb89
SHA256 e8fbaf1e0a9724d541898c17c3cc7c2b703d00ef2e8bd3e0fb70a7c0df8ca9e7
MD5 a7ea08450be8bf5dff2f0a207611ca85
SHA1 dce76689e7ea830e518e7670d34e230b5c7b9970
SHA512 2d2b5ef9fad485bda1f3c9f5ec4292d6bc992b12cbfd9d4db57532a1bb2a4c0fbd9d73387f5ee568989b4d0b914d73771146ab54c83aac64eddd2bdd0f1acb31
SSDEEP 3072:IhSR6pi8MnUso6xoko8NzSvCSkC3jV/j45zAbVX8bVXmh:Ihovo6KkHzuCSb3jJjnBX8BXmh
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e8fbaf1e0a9724d541898c17c3cc7c2b703d00ef2e8bd3e0fb70a7c0df8ca9e7

File Explorer

e8fbaf1e0a9724d541898c17c3cc7c2b703d00ef2e8bd3e0fb70a7c0df8ca9e7

.exe 248KB

e8fbaf1e0a9724d541898c17c3cc7c2b703d00ef2e8bd3e0fb70a7c0df8ca9e7

IMPHASH 2f3c2a0d201b39df299a19311cb60912
SHA256 e8fbaf1e0a9724d541898c17c3cc7c2b703d00ef2e8bd3e0fb70a7c0df8ca9e7
MD5 a7ea08450be8bf5dff2f0a207611ca85
SHA1 dce76689e7ea830e518e7670d34e230b5c7b9970
SHA512 2d2b5ef9fad485bda1f3c9f5ec4292d6bc992b12cbfd9d4db57532a1bb2a4c0fbd9d73387f5ee568989b4d0b914d73771146ab54c83aac64eddd2bdd0f1acb31
SSDEEP 3072:IhSR6pi8MnUso6xoko8NzSvCSkC3jV/j45zAbVX8bVXmh:Ihovo6KkHzuCSb3jJjnBX8BXmh
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

4631

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

InterlockedDecrement ZombifyActCtx GetComputerNameW GetTimeFormatA GetModuleHandleW EnumTimeFormatsW ReadFileScatter WriteConsoleOutputA InterlockedPopEntrySList SetConsoleMode GetConsoleAliasW GetFileAttributesW GetModuleFileNameW GetShortPathNameA TryEnterCriticalSection SetLastError GetProcAddress GetLongPathNameA LocalLock LoadLibraryA UnhandledExceptionFilter HeapLock SetConsoleTitleW FreeEnvironmentStringsW BuildCommDCBA CompareStringA FileTimeToLocalFileTime GetFileInformationByHandle GetConsoleAliasesW GlobalDeleteAtom GetCommandLineA GetStartupInfoA TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc GetLastError HeapFree Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId HeapCreate VirtualFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc GetCPInfo GetACP GetOEMCP IsValidCodePage InitializeCriticalSectionAndSpinCount RtlUnwind LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA HeapSize

advapi32

OpenThreadToken

winhttp

WinHttpReadData

Sharing

General

Malware Config

Signatures

File Explorer

e8fbaf1e0a9724d541898c17c3cc7c2b703d00ef2e8bd3e0fb70a7c0df8ca9e7

kernel32

advapi32

winhttp

generic