1fbdf84b964f331de21165cd33b3025404f4bffab9f082c60ab55fea4cff1f72

Sharing

Copy URL Twitter E-mail

General

Target
1fbdf84b964f331de21165cd33b3025404f4bffab9f082c60ab55fea4cff1f72
Size 430KB
Sample240612-eradts1alm
SHA256 1fbdf84b964f331de21165cd33b3025404f4bffab9f082c60ab55fea4cff1f72
MD5 a08689024a1dc87b7bc3866b5fd1d6ba
SHA1 d6e20ed146f36ad3dbfe916e244242ac272f3672
SHA512 cc6037d743c7e4c699f49946169501e1b1683013cc8fc1eebedc29e535f7b938258a826546c0693b3dc4f08dfecacf3608f4747f5c66ae16e8e400b9d5fc361b
SSDEEP 12288:jXFuNhmGqOYZGhydgJu2ZOWqMsD6Le1AR:4NhPaGhwg/Ds1G
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1fbdf84b964f331de21165cd33b3025404f4bffab9f082c60ab55fea4cff1f72

File Explorer

1fbdf84b964f331de21165cd33b3025404f4bffab9f082c60ab55fea4cff1f72

.exe 430KB

1fbdf84b964f331de21165cd33b3025404f4bffab9f082c60ab55fea4cff1f72

IMPHASH 967c5ceea6e3b3ef82171d460a533997
SHA256 1fbdf84b964f331de21165cd33b3025404f4bffab9f082c60ab55fea4cff1f72
MD5 a08689024a1dc87b7bc3866b5fd1d6ba
SHA1 d6e20ed146f36ad3dbfe916e244242ac272f3672
SHA512 cc6037d743c7e4c699f49946169501e1b1683013cc8fc1eebedc29e535f7b938258a826546c0693b3dc4f08dfecacf3608f4747f5c66ae16e8e400b9d5fc361b
SSDEEP 12288:jXFuNhmGqOYZGhydgJu2ZOWqMsD6Le1AR:4NhPaGhwg/Ds1G
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

82832

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

O:\webex-windows-plugin\output\i386\bin\Release\webex.pdb

kernel32

GetUserGeoID GetUserDefaultLCID SetThreadUILanguage GetThreadUILanguage DecodePointer RaiseException InitializeCriticalSectionEx lstrlenW MultiByteToWideChar WideCharToMultiByte MapViewOfFile UnmapViewOfFile CreateFileMappingA SetLastError LocalFree FormatMessageW WaitForSingleObject Sleep CreateThread TerminateThread GetFileSize ReadFile SetFilePointer GetVersionExW FreeLibrary GetProcAddress LoadLibraryW lstrcpynW GetSystemDefaultLangID CreateProcessA GetNativeSystemInfo SetEvent CreateEventW OpenEventW LCIDToLocaleName GetLocaleInfoEx CreateFileW GetConsoleMode GetConsoleOutputCP SetFilePointerEx GetGeoInfoA HeapSize GetLocalTime SetStdHandle GetProcessHeap LCMapStringW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetFileType HeapAlloc HeapFree GetStdHandle GetModuleFileNameW GetModuleHandleExW ExitProcess QueryPerformanceFrequency LoadLibraryExW TlsFree TlsSetValue WriteConsoleW TlsGetValue TlsAlloc EncodePointer RtlUnwind OutputDebugStringW InitializeSListHead GetModuleHandleW GetModuleFileNameA GetSystemTimeAsFileTime CreateMutexW GetLastError GetTempFileNameA HeapReAlloc GetCommandLineA QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent WaitForSingleObjectEx GetCurrentThreadId GetCurrentProcessId DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection CloseHandle GetTempPathA WriteFile FlushFileBuffers CreateFileA GetStringTypeW SetDefaultDllDirectories GetSystemInfo VirtualProtect VirtualQuery LoadLibraryExA UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount ResetEvent

user32

ChangeWindowMessageFilterEx LoadIconW LoadCursorW GetWindowThreadProcessId SetWindowLongW GetWindowLongW SetCursor SetWindowTextW SetWindowTextA SetPropW SetPropA SetForegroundWindow GetForegroundWindow SetActiveWindow UpdateWindow KillTimer SetTimer SetFocus DefDlgProcW GetDlgItem CreateDialogParamW BringWindowToTop IsWindowVisible SetWindowPos ShowWindow DestroyWindow CreateWindowExW RegisterClassW AttachThreadInput SendMessageW LoadStringW FindWindowExA GetDesktopWindow WaitForInputIdle GetMonitorInfoW MonitorFromPoint GetCursorPos ReleaseDC GetDC MessageBoxExA PostQuitMessage PostMessageW LoadStringA DispatchMessageW TranslateMessage GetMessageW MessageBoxExW

gdi32

SelectObject GetTextExtentPoint32W GetStockObject DeleteObject GetDeviceCaps CreateFontIndirectW SetTextColor

shell32

SHGetFolderPathA

advapi32

CryptDestroyHash CryptReleaseContext RegQueryValueExW RegOpenKeyExW RegCloseKey ConvertStringSecurityDescriptorToSecurityDescriptorW CryptAcquireContextW CryptHashData CryptCreateHash CryptGetHashParam

comctl32

InitCommonControlsEx

Name

.text

Size

168KB

Virtual Size

167KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

51KB

Virtual Size

51KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.didat

Size

512B

Virtual Size

76B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

191KB

Virtual Size

190KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

10KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

1fbdf84b964f331de21165cd33b3025404f4bffab9f082c60ab55fea4cff1f72

kernel32

user32

gdi32

shell32

advapi32

comctl32

generic