aaded7b9e4953dfe1d195b88f7be2b9768b020d816149caf345fd8bc65bace84

Sharing

Copy URL Twitter E-mail

General

Target
aaded7b9e4953dfe1d195b88f7be2b9768b020d816149caf345fd8bc65bace84
Size 1.4MB
Sample240601-b689xsec48
SHA256 aaded7b9e4953dfe1d195b88f7be2b9768b020d816149caf345fd8bc65bace84
MD5 6dfc7a8611521af0c36582feda5183f0
SHA1 8c5a5103017789f82e3a98e6a6f157b97985011d
SHA512 2150decbcb1a867f5ed326e0f0f8a640f0030b45fd6b04855d13a222f25e8ab038dcdfad9fdaed9b19cd451bce58b17b991e8c71622b674770aa754657b7b9a3
SSDEEP 24576:rluO36FU23Cawqol2qDl9BL7FKyr7sBWbqreghLdSxFY:ReU2yjl24ToynwN/Fo
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
aaded7b9e4953dfe1d195b88f7be2b9768b020d816149caf345fd8bc65bace84

File Explorer

aaded7b9e4953dfe1d195b88f7be2b9768b020d816149caf345fd8bc65bace84

.exe 1.4MB

aaded7b9e4953dfe1d195b88f7be2b9768b020d816149caf345fd8bc65bace84

IMPHASH c5671d92446c3b62b33d10c7250b35fe
SHA256 aaded7b9e4953dfe1d195b88f7be2b9768b020d816149caf345fd8bc65bace84
MD5 6dfc7a8611521af0c36582feda5183f0
SHA1 8c5a5103017789f82e3a98e6a6f157b97985011d
SHA512 2150decbcb1a867f5ed326e0f0f8a640f0030b45fd6b04855d13a222f25e8ab038dcdfad9fdaed9b19cd451bce58b17b991e8c71622b674770aa754657b7b9a3
SSDEEP 24576:rluO36FU23Cawqol2qDl9BL7FKyr7sBWbqreghLdSxFY:ReU2yjl24ToynwN/Fo
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

101097

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\dbs\sh\ddvsm\1130_140035\cmd\a\out\binaries\x86ret\bin\i386\VSLauncher.pdb

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW RegQueryInfoKeyW RegDeleteKeyA RegEnumKeyExA RegOpenKeyExA RegSetValueExA RegCreateKeyExA RegDeleteValueA EventRegister EventWrite EventProviderEnabled EventUnregister

kernel32

HeapFree HeapAlloc RaiseException HeapDestroy HeapSize WideCharToMultiByte GetEnvironmentVariableW FreeLibrary GetProcAddress GetModuleHandleA lstrcmpiA IsDBCSLeadByte SizeofResource LoadResource FindResourceA LoadLibraryExA GetModuleFileNameA DeleteCriticalSection InitializeCriticalSectionEx GetCommandLineW DecodePointer FindFirstFileW FindNextFileW FindClose ExpandEnvironmentStringsW GetFullPathNameW GetLongPathNameW GetStartupInfoW GetStdHandle SetEnvironmentVariableW CreateProcessW WaitForSingleObject CompareFileTime LockResource FindResourceExW FindResourceW CloseHandle GetUserDefaultUILanguage GetFileAttributesW lstrlenA WriteConsoleW ReadFile FlushFileBuffers SetFilePointerEx GetConsoleMode GetConsoleCP SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetCPInfo GetOEMCP FindNextFileA FindFirstFileExA OutputDebugStringW LCMapStringW GetFileType UnmapViewOfFile GetLastError MultiByteToWideChar MapViewOfFile CreateFileMappingA GetFileSize CreateFileW SetErrorMode IsValidCodePage GetProcessHeap HeapReAlloc UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetModuleHandleW RtlUnwind SetLastError EnterCriticalSection LeaveCriticalSection EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetSystemInfo VirtualAlloc VirtualProtect VirtualQuery WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetACP GetStringTypeW

user32

LoadStringW CharPrevW GetWindowRect SystemParametersInfoA SetWindowPos MessageBoxW CharNextA DialogBoxParamW GetDlgItem SetDlgItemTextW SendDlgItemMessageW SendMessageA EndDialog

ole32

CoTaskMemAlloc CoTaskMemFree CoTaskMemRealloc CoCreateInstance CoInitialize CoUninitialize

oleaut32

SysAllocStringLen SysStringLen SysAllocString SysStringByteLen SysFreeString VarUI4FromStr SysAllocStringByteLen

shell32

ShellExecuteExW CommandLineToArgvW

version

GetFileVersionInfoW GetFileVersionInfoSizeW VerQueryValueW

Sharing

General

Malware Config

Signatures

File Explorer

aaded7b9e4953dfe1d195b88f7be2b9768b020d816149caf345fd8bc65bace84

advapi32

kernel32

user32

ole32

oleaut32

shell32

version

generic