a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87

General

Target
a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87
Size 8.4MB
Sample240613-eaebfswhlq
SHA256 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87
MD5 85c5f876f3fdd140122d4f27caba86bb
SHA1 b6ca092dc01825dd21469637055bf48a1d614bc0
SHA512 2d5365a630f2b4e069bf9898eb4e8c49808adbf712ccdfb22a9b074f40a8966d6994669a5d6b84d2a2b3431fa68a490e15e7bdee61a8e7aa934ff21fcac0ab16
SSDEEP 196608:4Dq6UE7o5QzxheXBT9mVZmziyWT5QhwIFDjvuwvEv:4DaErheZ6lQhwIlvEv
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87

.exe 8.4MB

a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87

IMPHASH 836688c7d21e39394af41ce9a8c2d728
SHA256 a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87
MD5 85c5f876f3fdd140122d4f27caba86bb
SHA1 b6ca092dc01825dd21469637055bf48a1d614bc0
SHA512 2d5365a630f2b4e069bf9898eb4e8c49808adbf712ccdfb22a9b074f40a8966d6994669a5d6b84d2a2b3431fa68a490e15e7bdee61a8e7aa934ff21fcac0ab16
SSDEEP 196608:4Dq6UE7o5QzxheXBT9mVZmziyWT5QhwIFDjvuwvEv:4DaErheZ6lQhwIlvEv
MD5 SHA1 SHA512 SSDEEP

PE Signature issue

Digest

47:80:06:2e:42:80:33:77:6c:24:2f:80:22:a8:cc:c7:04:bf:c3:dd:3f:9e:61:a0:da:0c:51:24:d8:ff:36:0f

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Not trusted

Signing Certificate

CN=C2RService,O=C2RService,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2024

PE Signature issue

Digest

47:80:06:2e:42:80:33:77:6c:24:2f:80:22:a8:cc:c7:04:bf:c3:dd:3f:9e:61:a0:da:0c:51:24:d8:ff:36:0f

Digest Algorithm

sha256

PE Digests Matches

Not matched

Trusted

Signing Certificate

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Chains

Jun 12, 2024

CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Minor OS version

0

Major OS version

6

Entry point

1654644

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\JobRelease\win\Release\stubs\x86\ExternalUi.pdb

kernel32

CreateFileW CloseHandle WriteFile DeleteFileW HeapDestroy HeapSize HeapReAlloc HeapFree HeapAlloc GetProcessHeap SizeofResource LockResource LoadResource FindResourceW FindResourceExW RemoveDirectoryW GetTempPathW GetTempFileNameW CreateDirectoryW MoveFileW GetLastError EnterCriticalSection LeaveCriticalSection GetModuleFileNameW DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetCurrentThreadId RaiseException SetLastError GlobalUnlock GlobalLock GlobalAlloc MulDiv lstrcmpW CreateEventW FindClose FindFirstFileW GetFullPathNameW SetEvent InitializeCriticalSection lstrcpynW CreateThread WaitForSingleObject GetProcAddress LoadLibraryExW Sleep GetDiskFreeSpaceExW DecodePointer GetExitCodeThread GetCurrentProcessId FreeLibrary GetSystemDirectoryW lstrlenW VerifyVersionInfoW VerSetConditionMask lstrcmpiW GetModuleHandleW LoadLibraryW GetDriveTypeW CompareStringW FindNextFileW GetLogicalDriveStringsW GetFileSize GetFileAttributesW GetShortPathNameW SetFileAttributesW GetFileTime CopyFileW ReadFile SetFilePointer SystemTimeToFileTime MultiByteToWideChar WideCharToMultiByte GetCurrentProcess GetSystemInfo WaitForMultipleObjects VirtualProtect VirtualQuery LoadLibraryExA GetStringTypeW SetUnhandledExceptionFilter FormatMessageW FileTimeToSystemTime GetEnvironmentVariableW GetEnvironmentStringsW LocalFree InitializeCriticalSectionEx LoadLibraryA GetModuleFileNameA GetCurrentThread GetConsoleOutputCP FlushFileBuffers SetConsoleTextAttribute GetStdHandle GetConsoleScreenBufferInfo OutputDebugStringW CreateProcessW GetExitCodeProcess GetTickCount GetCommandLineW SetCurrentDirectoryW SetEndOfFile EnumResourceLanguagesW GetLocaleInfoW GetSystemDefaultLangID GetUserDefaultLangID GetWindowsDirectoryW GetSystemTime GetDateFormatW GetTimeFormatW CreateToolhelp32Snapshot Process32FirstW Process32NextW ResetEvent GlobalFree GetPrivateProfileStringW GetPrivateProfileSectionNamesW WritePrivateProfileStringW GetLocalTime CreateNamedPipeW ConnectNamedPipe Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection IsWow64Process TerminateThread LocalAlloc CompareFileTime CopyFileExW OpenEventW PeekNamedPipe QueryPerformanceCounter QueryPerformanceFrequency EncodePointer LCMapStringEx GetSystemTimeAsFileTime CompareStringEx GetCPInfo IsDebuggerPresent InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree WaitForSingleObjectEx UnhandledExceptionFilter TerminateProcess GetStartupInfoW RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW GetFileType GetTimeZoneInformation LCMapStringW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleMode IsValidCodePage GetACP GetOEMCP GetFileSizeEx SetFilePointerEx FindFirstFileExW GetCommandLineA FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle ReadConsoleW WriteConsoleW

Sharing

General

Malware Config

Signatures

File Explorer

a4723aeae00a2dbcec69badfe754c71a8d1a4b1a447bed6a05e1ed809ddaca87

PE Signature issue

PE Signature issue

kernel32

generic