ecbba494b5e49cc39127eee5c116d6822ea169defde8712ca5964a818e22e370

Resubmissions

12/06/2024, 21:52

240612-1rejfasanc6

12/06/2024, 21:39

240612-1hwfla1fpg6

Sharing

Copy URL Twitter E-mail

General

Target
ecbba494b5e49cc39127eee5c116d6822ea169defde8712ca5964a818e22e370
Size 219KB
Sample240612-1hwfla1fpg
SHA256 ecbba494b5e49cc39127eee5c116d6822ea169defde8712ca5964a818e22e370
MD5 e6608b5ed4027edea424ceaf23f054d9
SHA1 3262faecb597e3d31d57685a77ff06bf1430edc3
SHA512 585f14fa198ef65997854d80e60159f9fc4e72e86a817528b998dc793d8ca69ede5f89d4edbbb49f4ce46985231db55f7fa26778c31556232e43ca054ae7f649
SSDEEP 3072:L2RaiKg4xmUh1WXHqw/l+qmOELhakVsm3mxB32tLEv8zfdn5f2dZLCoKOhh9K0KG:L0KgGwHqwOOELha+sm2D2+UhngNHK4K0
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ecbba494b5e49cc39127eee5c116d6822ea169defde8712ca5964a818e22e370

File Explorer

ecbba494b5e49cc39127eee5c116d6822ea169defde8712ca5964a818e22e370

.exe 219KB

ecbba494b5e49cc39127eee5c116d6822ea169defde8712ca5964a818e22e370

IMPHASH 79b68a12e4eb6aa0c59dd1289006924f
SHA256 ecbba494b5e49cc39127eee5c116d6822ea169defde8712ca5964a818e22e370
MD5 e6608b5ed4027edea424ceaf23f054d9
SHA1 3262faecb597e3d31d57685a77ff06bf1430edc3
SHA512 585f14fa198ef65997854d80e60159f9fc4e72e86a817528b998dc793d8ca69ede5f89d4edbbb49f4ce46985231db55f7fa26778c31556232e43ca054ae7f649
SSDEEP 3072:L2RaiKg4xmUh1WXHqw/l+qmOELhakVsm3mxB32tLEv8zfdn5f2dZLCoKOhh9K0KG:L0KgGwHqwOOELha+sm2D2+UhngNHK4K0
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4128

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\BUILD\work\8b0ebd312dc47f30\projects\avast\microstub\x86\Release\microstub.pdb

kernel32

SetLastError Sleep GetFileSizeEx WriteFile SetEndOfFile SetFilePointerEx LocalFree CloseHandle MapViewOfFile UnmapViewOfFile CreateFileMappingW EnumResourceNamesW GetWindowsDirectoryW CreateDirectoryW CreateFileW CreateThread GetSystemTimeAsFileTime GetNativeSystemInfo lstrcatA lstrlenA GetVersionExA GetCurrentProcess GetExitCodeProcess ResumeThread ReleaseMutex WaitForSingleObject CreateMutexW CreateProcessW GetPrivateProfileIntW GetPrivateProfileStringW GetDiskFreeSpaceExW CopyFileW MoveFileExW CreateHardLinkW HeapAlloc GetProcessHeap HeapSetInformation ExitProcess IsProcessorFeaturePresent lstrcpyW GetModuleHandleW GetSystemDirectoryW SetDllDirectoryW InterlockedExchange LockResource WriteConsoleW FlushFileBuffers GetConsoleMode GetConsoleCP SetStdHandle LCMapStringW FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP IsValidCodePage FindNextFileW FindFirstFileExW GetLastError HeapFree InterlockedExchangeAdd GetVersionExW FindResourceW LoadLibraryW SizeofResource LoadResource GlobalFree GlobalUnlock GlobalLock FindClose GetFileType GetStringTypeW GlobalAlloc FreeLibrary RaiseException GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA LoadLibraryA DecodePointer GetVersion HeapDestroy HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount DeleteCriticalSection DeviceIoControl GetVolumeNameForVolumeMountPointW GetVolumePathNameW MultiByteToWideChar WideCharToMultiByte EnterCriticalSection LeaveCriticalSection SetEvent ResetEvent WaitForSingleObjectEx CreateEventW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId InitializeSListHead IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW TerminateProcess OutputDebugStringW RtlUnwind EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetCommandLineA GetCommandLineW GetStdHandle GetModuleFileNameW GetModuleHandleExW GetACP GetProcAddress

user32

GetMessageW TranslateMessage DispatchMessageW SendMessageW AllowSetForegroundWindow PostMessageW wsprintfA LoadStringW MessageBoxExW wsprintfW SystemParametersInfoW IsDialogMessageW LoadImageW DestroyIcon FindWindowW FillRect GetWindowRect InvalidateRect EndPaint BeginPaint ReleaseDC GetDC SetForegroundWindow GetSystemMetrics KillTimer SetTimer SetFocus SetWindowPos DestroyWindow CreateWindowExW RegisterClassExW PostQuitMessage DefWindowProcW

gdi32

GetTextExtentPoint32W GetObjectW CreateDIBSection SelectObject CreateFontIndirectW DeleteObject CreateSolidBrush CreatePatternBrush

advapi32

CryptDestroyHash CryptHashData CryptCreateHash CryptGenRandom CryptGetHashParam CryptReleaseContext CryptAcquireContextA GetSidSubAuthorityCount GetSidSubAuthority IsValidSid GetTokenInformation OpenProcessToken ConvertStringSecurityDescriptorToSecurityDescriptorA

ole32

CoCreateInstance CreateStreamOnHGlobal CoUninitialize CoInitializeEx

comctl32

ord17

Name

.text

Size

134KB

Virtual Size

133KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

40KB

Virtual Size

40KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

76B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

33KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

ecbba494b5e49cc39127eee5c116d6822ea169defde8712ca5964a818e22e370

kernel32

user32

gdi32

advapi32

ole32

comctl32

generic