c41dec94b21e35bdc200594a57c0618ca8fe01e701a90d171f66f1b94b849967

Sharing

Copy URL Twitter E-mail

General

Target
c41dec94b21e35bdc200594a57c0618ca8fe01e701a90d171f66f1b94b849967
Size 583KB
Sample240612-ejblxszgra
SHA256 c41dec94b21e35bdc200594a57c0618ca8fe01e701a90d171f66f1b94b849967
MD5 16f809097928a3d7029f79bb9bc783cf
SHA1 23a43b0292c57e590a7b6e09d0029e146d7f226e
SHA512 143e825925cab3b058d00411ec6b365e932112af084aa1ebb1d2c653284928142aaeefbfa85bd85f0d232c3ed5eff742705cb322f6719776f83777939d67056c
SSDEEP 12288:RSr8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:RS4+L6VMRCPU6CENltmVVdpx7fLrQWd
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c41dec94b21e35bdc200594a57c0618ca8fe01e701a90d171f66f1b94b849967

File Explorer

c41dec94b21e35bdc200594a57c0618ca8fe01e701a90d171f66f1b94b849967

.exe 583KB

c41dec94b21e35bdc200594a57c0618ca8fe01e701a90d171f66f1b94b849967

IMPHASH 9688b942763cb955cd0f874f972e6459
SHA256 c41dec94b21e35bdc200594a57c0618ca8fe01e701a90d171f66f1b94b849967
MD5 16f809097928a3d7029f79bb9bc783cf
SHA1 23a43b0292c57e590a7b6e09d0029e146d7f226e
SHA512 143e825925cab3b058d00411ec6b365e932112af084aa1ebb1d2c653284928142aaeefbfa85bd85f0d232c3ed5eff742705cb322f6719776f83777939d67056c
SSDEEP 12288:RSr8+Tn6VMP5CPU6EkUw6XvV2NlLiwXmVmMdpx7TjLNFtA2byK9CTIb7:RS4+L6VMRCPU6CENltmVVdpx7fLrQWd
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7151

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Reader_SL.pdb

kernel32

CloseHandle GetLastError SetNamedPipeHandleState OpenMutexW Sleep GetTickCount WriteFile CreateProcessA GetModuleFileNameA GetSystemPowerStatus GetStartupInfoW IsDebuggerPresent InitializeSListHead ReadFile GetVolumeInformationW lstrlenW CreateFileW GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetModuleHandleW

user32

FindWindowA

advapi32

RegOpenKeyExW RegCloseKey RegQueryValueExW

vcruntime140

__std_exception_destroy _except_handler4_common __CxxFrameHandler3 memset __current_exception_context _CxxThrowException __std_exception_copy __current_exception

api-ms-win-crt-string-l1-1-0

wcscpy_s

api-ms-win-crt-filesystem-l1-1-0

_splitpath_s _makepath_s

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s __p__commode _set_fmode

api-ms-win-crt-runtime-l1-1-0

_get_narrow_winmain_command_line _exit _controlfp_s _register_onexit_function _initterm_e _register_thread_local_exe_atexit_callback _initialize_narrow_environment _c_exit _configure_narrow_argv terminate _initialize_onexit_table _initterm _cexit _set_app_type _seh_filter_exe exit _crt_atexit

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

malloc free _set_new_mode _callnewh

Sharing

General

Malware Config

Signatures

File Explorer

c41dec94b21e35bdc200594a57c0618ca8fe01e701a90d171f66f1b94b849967

kernel32

user32

advapi32

vcruntime140

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

generic