17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb

Sharing

Copy URL Twitter E-mail

General

Target
17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb
Size 2.8MB
Sample240608-x82thsfb71
SHA256 17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb
MD5 9646d7904a123f27f834d0fbaf8bce01
SHA1 851dc03cccf41b5ccf6a2dce26e4c6134b88766d
SHA512 13d345d9536c9925f78f702a952225a7c62b74cf1b7a01b410d3fa05b93f874b9616070bbd9b9ac538e6549d24f60c7d466fcb922e783aa504c3500012fa46ae
SSDEEP 49152:4YN2skpzPXDFBjWRJTCAIHuDeeaJ98mjRC9YC2Ns+/X0h54GEewKFblI7a8K2mFp:4i2bz/5YvpI2eey98CRC4L0ZRbplI7KX
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb

File Explorer

17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb

.exe 2.8MB

17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb

IMPHASH 092eb6daba2f17cbda102fd1a32acd00
SHA256 17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb
MD5 9646d7904a123f27f834d0fbaf8bce01
SHA1 851dc03cccf41b5ccf6a2dce26e4c6134b88766d
SHA512 13d345d9536c9925f78f702a952225a7c62b74cf1b7a01b410d3fa05b93f874b9616070bbd9b9ac538e6549d24f60c7d466fcb922e783aa504c3500012fa46ae
SSDEEP 49152:4YN2skpzPXDFBjWRJTCAIHuDeeaJ98mjRC9YC2Ns+/X0h54GEewKFblI7a8K2mFp:4i2bz/5YvpI2eey98CRC4L0ZRbplI7KX
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

22898

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_REMOVABLE_RUN_FROM_SWAP IMAGE_FILE_NET_RUN_FROM_SWAP

PDB paths

kernel32

GetDriveTypeA HeapFree FormatMessageA LeaveCriticalSection DeleteFileA EnterCriticalSection TerminateProcess WaitForMultipleObjects CreateEventW SetEvent Sleep SetEnvironmentVariableA GetEnvironmentVariableA WideCharToMultiByte HeapAlloc SetLastError WriteFile MoveFileA ExitProcess DeleteCriticalSection FlushFileBuffers GetVersionExA WaitForSingleObject OpenEventA GetCurrentProcess GetFileAttributesA GetCommandLineA GetModuleFileNameA CreateFileA FindNextFileA FindFirstFileA CopyFileA SetFileAttributesA SystemTimeToFileTime GetSystemTime GetDiskFreeSpaceA QueryDosDeviceA GetCurrentDirectoryA SetEndOfFile SetFileTime LocalFileTimeToFileTime DosDateTimeToFileTime GetExitCodeProcess CreateProcessA ExpandEnvironmentStringsA GetFileSize CreateThread CreateEventA GetProcessHeap InitializeCriticalSectionAndSpinCount GetModuleHandleA QueryPerformanceCounter GetCurrentThreadId GetCurrentProcessId GetSystemTimeAsFileTime SetUnhandledExceptionFilter CloseHandle DeviceIoControl GetSystemDirectoryA LoadLibraryA GetProcAddress FreeLibrary SetErrorMode GetTickCount CreateDirectoryA GetLastError RemoveDirectoryA MoveFileExA SetFilePointer FindClose ReadFile

msvcrt

strchr _strnicmp _stricmp strrchr _strlwr strncpy strstr _snprintf sprintf

advapi32

AllocateAndInitializeSid GetTokenInformation GetLengthSid InitiateSystemShutdownA CryptReleaseContext CryptGenRandom CryptAcquireContextA SetSecurityDescriptorDacl AddAccessAllowedAce InitializeAcl InitializeSecurityDescriptor OpenProcessToken

user32

ShowWindow SendDlgItemMessageA SendMessageA DialogBoxParamA LoadStringA EndDialog SetParent MessageBoxA

ntdll

NtShutdownSystem NtAdjustPrivilegesToken NtClose NtOpenProcessToken

comctl32

ord17

shell32

SHBrowseForFolderA SHGetPathFromIDListA

Sharing

General

Malware Config

Signatures

File Explorer

17c9a7888303daf87f5cd119dbb5cd2d3511169658941e65b8b3a298d7d147cb

kernel32

msvcrt

advapi32

user32

ntdll

comctl32

shell32

generic