10d888d47e2d232bc2fb9ae7ae02017f841fc96ba83fc6e0f68d39a1777444ab

Sharing

Copy URL Twitter E-mail

General

Target
10d888d47e2d232bc2fb9ae7ae02017f841fc96ba83fc6e0f68d39a1777444ab
Size 472KB
Sample240612-eergkszfrq
SHA256 10d888d47e2d232bc2fb9ae7ae02017f841fc96ba83fc6e0f68d39a1777444ab
MD5 0a5d4c0397234046d120d5d8bf6deb98
SHA1 be06f1995e6b7ca3e11c161c7c85e94eefbc2f3d
SHA512 59322948c36ebaa5d4d5f78caa2d76c2226c0828ddd18078ae709f4f5475f14489dd9daa4a60ccb46be70569e43313d5751163b19edde7d64f1576613fa39bbf
SSDEEP 12288:31vKpgoIWgqAyymyzIunr1a8Fp/iKMsDAoauV:lvKCoBlymSDakyspaQ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
10d888d47e2d232bc2fb9ae7ae02017f841fc96ba83fc6e0f68d39a1777444ab

File Explorer

10d888d47e2d232bc2fb9ae7ae02017f841fc96ba83fc6e0f68d39a1777444ab

.exe 472KB

10d888d47e2d232bc2fb9ae7ae02017f841fc96ba83fc6e0f68d39a1777444ab

IMPHASH acac4f024915fbce13bcbe214016f740
SHA256 10d888d47e2d232bc2fb9ae7ae02017f841fc96ba83fc6e0f68d39a1777444ab
MD5 0a5d4c0397234046d120d5d8bf6deb98
SHA1 be06f1995e6b7ca3e11c161c7c85e94eefbc2f3d
SHA512 59322948c36ebaa5d4d5f78caa2d76c2226c0828ddd18078ae709f4f5475f14489dd9daa4a60ccb46be70569e43313d5751163b19edde7d64f1576613fa39bbf
SSDEEP 12288:31vKpgoIWgqAyymyzIunr1a8Fp/iKMsDAoauV:lvKCoBlymSDakyspaQ
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

94624

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

O:\webex-windows-plugin\output\i386\bin\Release\webex.pdb

kernel32

GetUserGeoID GetUserDefaultLCID SetThreadUILanguage GetThreadUILanguage DecodePointer RaiseException InitializeCriticalSectionEx lstrlenW MultiByteToWideChar WideCharToMultiByte MapViewOfFile UnmapViewOfFile CreateFileMappingA SetLastError LocalFree FormatMessageW WaitForSingleObject Sleep CreateThread TerminateThread GetFileSize ReadFile SetFilePointer GetVersionExW FreeLibrary GetProcAddress LoadLibraryW lstrcpynW GetSystemDefaultLangID CreateProcessA GetNativeSystemInfo SetEvent CreateEventW OpenEventW LCIDToLocaleName GetLocaleInfoEx GetCurrentProcess CreateProcessW IsProcessInJob FindResourceExW FreeResource LoadResource LockResource CreateFileW GetConsoleMode GetGeoInfoA SetFilePointerEx GetLocalTime SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose HeapReAlloc GetFileType HeapAlloc HeapFree GetStdHandle GetModuleFileNameW GetModuleHandleExW ExitProcess GetFileAttributesExW QueryPerformanceFrequency LoadLibraryExW RtlUnwind OutputDebugStringW WriteConsoleW InitializeSListHead QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent WaitForSingleObjectEx ResetEvent IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetStringTypeW LCMapStringW GetModuleHandleW GetModuleFileNameA GetSystemTimeAsFileTime CreateMutexW GetLastError GetTempFileNameA GetConsoleOutputCP GetCommandLineA TlsFree TlsSetValue TlsGetValue GetCurrentThreadId GetCurrentProcessId DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection CloseHandle GetTempPathA WriteFile FlushFileBuffers CreateFileA HeapSize SetDefaultDllDirectories GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA EncodePointer GetCPInfo InitializeCriticalSectionAndSpinCount TlsAlloc

user32

LoadImageW GetClientRect GetWindowTextW DrawTextW DialogBoxParamW ChangeWindowMessageFilterEx LoadIconW LoadCursorW GetWindowThreadProcessId SetWindowLongW GetWindowLongW SetCursor GetWindowRect SetWindowTextW SetWindowTextA SetPropW SetPropA SetForegroundWindow GetForegroundWindow SetActiveWindow UpdateWindow KillTimer SetTimer SetFocus DefDlgProcW GetDlgItem CreateDialogParamW BringWindowToTop IsWindowVisible SetWindowPos ShowWindow DestroyWindow CreateWindowExW RegisterClassW AttachThreadInput SendMessageW FindWindowExA GetDesktopWindow WaitForInputIdle GetMonitorInfoW MonitorFromPoint GetCursorPos ReleaseDC GetDC PostQuitMessage PostMessageW LoadStringW DispatchMessageW TranslateMessage GetMessageW MessageBoxExW

gdi32

SelectObject GetTextExtentPoint32W GetStockObject DeleteObject GetDeviceCaps CreateFontIndirectW SetTextColor

shell32

SHGetFolderPathA ShellExecuteW

advapi32

CryptDestroyHash CryptReleaseContext RegQueryValueExW RegOpenKeyExW RegCloseKey ConvertStringSecurityDescriptorToSecurityDescriptorW CryptAcquireContextW CryptHashData CryptCreateHash CryptGetHashParam

comctl32

InitCommonControlsEx

Name

.text

Size

184KB

Virtual Size

183KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

73KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

76B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

191KB

Virtual Size

191KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

10d888d47e2d232bc2fb9ae7ae02017f841fc96ba83fc6e0f68d39a1777444ab

kernel32

user32

gdi32

shell32

advapi32

comctl32

generic