f331593af26e8cbe3ac66ed184d7b499c7520033232c8464c8ff16fdeb66fb8f

General

Target
f331593af26e8cbe3ac66ed184d7b499c7520033232c8464c8ff16fdeb66fb8f
Size 398KB
Sample240604-k5gmyscc52
SHA256 f331593af26e8cbe3ac66ed184d7b499c7520033232c8464c8ff16fdeb66fb8f
MD5 1cbf6a676d332e40dd0138da7e93fb57
SHA1 ac8d2e24d31bc6a2762ae9fd0e4b8d68241c4d45
SHA512 03908db96ed8afb919c74448ddc79e067358410b8f93c0d1c5d42e63b155a842914e483784424c89e25fedf29636a1183283f1d9de08ab3622179054cf03486d
SSDEEP 6144:O56LZeoKBh0QhFirHiO83sDUPMDHttUEm1zGsXL:y6Y/Bi7rHiB3enDfUt1SK
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f331593af26e8cbe3ac66ed184d7b499c7520033232c8464c8ff16fdeb66fb8f

File Explorer

f331593af26e8cbe3ac66ed184d7b499c7520033232c8464c8ff16fdeb66fb8f

.exe 398KB

f331593af26e8cbe3ac66ed184d7b499c7520033232c8464c8ff16fdeb66fb8f

IMPHASH 821cc90dba6931879b65e39ffbba987d
SHA256 f331593af26e8cbe3ac66ed184d7b499c7520033232c8464c8ff16fdeb66fb8f
MD5 1cbf6a676d332e40dd0138da7e93fb57
SHA1 ac8d2e24d31bc6a2762ae9fd0e4b8d68241c4d45
SHA512 03908db96ed8afb919c74448ddc79e067358410b8f93c0d1c5d42e63b155a842914e483784424c89e25fedf29636a1183283f1d9de08ab3622179054cf03486d
SSDEEP 6144:O56LZeoKBh0QhFirHiO83sDUPMDHttUEm1zGsXL:y6Y/Bi7rHiB3enDfUt1SK
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

5948

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetModuleHandleW FormatMessageW GetConsoleAliasW GetFileAttributesW GetModuleFileNameW CompareStringW SetConsoleTitleA WritePrivateProfileStringW GetStringTypeExA GetConsoleOutputCP GetConsoleAliasesW SetLastError GetTimeFormatA FindVolumeMountPointClose LoadLibraryA ConvertDefaultLocale EnumDateFormatsA QueryMemoryResourceNotification GetProcessAffinityMask FreeEnvironmentStringsW BuildCommDCBA DeleteCriticalSection GetShortPathNameW DeleteAtom LocalFileTimeToFileTime WriteConsoleOutputW InterlockedDecrement GetProcAddress GetComputerNameA HeapAlloc Sleep ExitProcess GetStartupInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent LeaveCriticalSection EnterCriticalSection HeapFree VirtualFree VirtualAlloc HeapReAlloc HeapCreate WriteFile GetStdHandle GetModuleFileNameA GetLastError TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InitializeCriticalSectionAndSpinCount GetEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime SetFilePointer WideCharToMultiByte GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage RtlUnwind MultiByteToWideChar HeapSize GetLocaleInfoA SetStdHandle WriteConsoleA WriteConsoleW LCMapStringA LCMapStringW GetStringTypeA GetStringTypeW FlushFileBuffers ReadFile CreateFileA CloseHandle GetModuleHandleA

gdi32

GetCharWidth32W

advapi32

DuplicateToken

winhttp

WinHttpReadData

Sharing

General

Malware Config

Signatures

File Explorer

f331593af26e8cbe3ac66ed184d7b499c7520033232c8464c8ff16fdeb66fb8f

kernel32

gdi32

advapi32

winhttp

generic