2fba01ea2ed627e1f2f62003b518aca6a085e0d3b4569c49217b8966f50379cd

Sharing

Copy URL Twitter E-mail

General

Target
2fba01ea2ed627e1f2f62003b518aca6a085e0d3b4569c49217b8966f50379cd
Size 356KB
Sample240605-xtbnsafh83
SHA256 2fba01ea2ed627e1f2f62003b518aca6a085e0d3b4569c49217b8966f50379cd
MD5 71513abc73c19586398effc326e5c372
SHA1 1c89e2a7b15a3f2f17ddec79fe1810299d65f1d7
SHA512 f626c98e75fe2604ff731b4ec162e7713f0bf06cb465d87be10eec532b0ef5db9840c7f35f70c00aa728606b0d0d44ef8e5458873e7ffe3685d6530b11714421
SSDEEP 3072:qC1F1/9BC0MbX+u8Iq59jjUpY3+eQF3OndacR9ALdPPI2ASnN/Fk8JdOIc5j0y3p:qK/9MyFjc03KoGN/tVAwy3CXVdduPvT
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2fba01ea2ed627e1f2f62003b518aca6a085e0d3b4569c49217b8966f50379cd

File Explorer

2fba01ea2ed627e1f2f62003b518aca6a085e0d3b4569c49217b8966f50379cd

.exe 356KB

2fba01ea2ed627e1f2f62003b518aca6a085e0d3b4569c49217b8966f50379cd

IMPHASH 8571dae9b0b532dd8a42c9a419f83a72
SHA256 2fba01ea2ed627e1f2f62003b518aca6a085e0d3b4569c49217b8966f50379cd
MD5 71513abc73c19586398effc326e5c372
SHA1 1c89e2a7b15a3f2f17ddec79fe1810299d65f1d7
SHA512 f626c98e75fe2604ff731b4ec162e7713f0bf06cb465d87be10eec532b0ef5db9840c7f35f70c00aa728606b0d0d44ef8e5458873e7ffe3685d6530b11714421
SSDEEP 3072:qC1F1/9BC0MbX+u8Iq59jjUpY3+eQF3OndacR9ALdPPI2ASnN/Fk8JdOIc5j0y3p:qK/9MyFjc03KoGN/tVAwy3CXVdduPvT
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

28807

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

TzSpecificLocalTimeToSystemTime GetTickCount lstrcatA OpenEventA LoadLibraryA LoadLibraryExW GetModuleFileNameW GetWindowsDirectoryW CreateDirectoryW SetFileAttributesA IsBadStringPtrA BuildCommDCBA GetDefaultCommConfigA WriteProcessMemory QueryInformationJobObject FindFirstVolumeMountPointW GetACP GetNumberFormatA GetSystemDefaultLangID GetUserDefaultLangID FoldStringA SetConsoleTextAttribute AddConsoleAliasA CloseHandle CreateFileW OutputDebugStringW WriteConsoleW SetStdHandle SetLastError VirtualProtect GetLastError LocalAlloc GetProcAddress SetComputerNameA InterlockedCompareExchange WideCharToMultiByte MultiByteToWideChar GetStringTypeW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer HeapFree HeapReAlloc ReadFile RaiseException RtlUnwind GetCommandLineW GetCPInfo HeapAlloc UnhandledExceptionFilter SetUnhandledExceptionFilter InitializeCriticalSectionAndSpinCount Sleep GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree GetStartupInfoW GetModuleHandleW IsProcessorFeaturePresent LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ExitProcess GetModuleHandleExW HeapSize GetProcessHeap FlushFileBuffers WriteFile GetConsoleCP GetConsoleMode IsDebuggerPresent GetStdHandle GetFileType SetFilePointerEx GetCurrentThreadId QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW IsValidCodePage GetOEMCP

user32

LoadMenuW CloseWindow DrawCaption GetUserObjectSecurity

gdi32

DeleteMetaFile GdiComment

advapi32

CloseEventLog BackupEventLogA ClearEventLogA RegOpenKeyW

winhttp

WinHttpWriteData

Sharing

General

Malware Config

Signatures

File Explorer

2fba01ea2ed627e1f2f62003b518aca6a085e0d3b4569c49217b8966f50379cd

kernel32

user32

gdi32

advapi32

winhttp

generic