03490019dd56b1f0876016b4b08d03a123fa8458ac4af42cebbca6b3481cb349

General

Target
03490019dd56b1f0876016b4b08d03a123fa8458ac4af42cebbca6b3481cb349
Size 84KB
Sample240613-xa3cdssalm
SHA256 03490019dd56b1f0876016b4b08d03a123fa8458ac4af42cebbca6b3481cb349
MD5 803b42c5aab2384402d0d2e3a43edde9
SHA1 bb896fb40f3725735edc23b5a73c1410d37c9fda
SHA512 077f38bff98d98549d60fe46680d29d97f7d5e716e58048f9b29519cc142675528dcbb3b308ac0caefcbe5c9fe316cec28921ae5a5c0b330d6a14f183dc80b66
SSDEEP 1536:TXn1JYSnExFkcgKKjxfmqshiKW5Xs/iYQqQJtsWFcdfRMvb+xWvz:jE3x5KBDYiKWm/iSw0fRMvygb
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
03490019dd56b1f0876016b4b08d03a123fa8458ac4af42cebbca6b3481cb349

File Explorer

03490019dd56b1f0876016b4b08d03a123fa8458ac4af42cebbca6b3481cb349

.exe 84KB

03490019dd56b1f0876016b4b08d03a123fa8458ac4af42cebbca6b3481cb349

IMPHASH 1273eaec87da7c0a308253f29e7857eb
SHA256 03490019dd56b1f0876016b4b08d03a123fa8458ac4af42cebbca6b3481cb349
MD5 803b42c5aab2384402d0d2e3a43edde9
SHA1 bb896fb40f3725735edc23b5a73c1410d37c9fda
SHA512 077f38bff98d98549d60fe46680d29d97f7d5e716e58048f9b29519cc142675528dcbb3b308ac0caefcbe5c9fe316cec28921ae5a5c0b330d6a14f183dc80b66
SSDEEP 1536:TXn1JYSnExFkcgKKjxfmqshiKW5Xs/iYQqQJtsWFcdfRMvb+xWvz:jE3x5KBDYiKWm/iSw0fRMvygb
MD5 SHA1 SHA512 SSDEEP

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

5863

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\Users\jmorgan\Source\ScreenConnectWork\Misc\Bootstrapper\Release\ClickOnceRunner.pdb

crypt32

CertOpenSystemStoreA CryptMsgClose CertFreeCertificateContext CertDeleteCertificateFromStore CryptQueryObject CertCloseStore CryptMsgGetParam CertAddCertificateContextToStore CertCreateCertificateContext

kernel32

SetFilePointer LocalAlloc CreateFileW Sleep LoadLibraryA CloseHandle GetProcAddress LocalFree UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW GetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW RtlUnwind SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetStdHandle WriteFile GetModuleFileNameW MultiByteToWideChar WideCharToMultiByte ExitProcess GetModuleHandleExW GetACP HeapFree HeapAlloc FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW LCMapStringW SetStdHandle GetFileType GetStringTypeW GetProcessHeap HeapSize HeapReAlloc FlushFileBuffers GetConsoleCP GetConsoleMode SetFilePointerEx WriteConsoleW DecodePointer RaiseException ReadFile GetModuleFileNameA

advapi32

SystemFunction036

Sharing

General

Malware Config

Signatures

File Explorer

03490019dd56b1f0876016b4b08d03a123fa8458ac4af42cebbca6b3481cb349

crypt32

kernel32

advapi32

generic