668bd6b6ff84d29517aa6d5873c4ebe0bf185276e576c38ae47b03b15866ec66

Sharing

Copy URL Twitter E-mail

General

Target
668bd6b6ff84d29517aa6d5873c4ebe0bf185276e576c38ae47b03b15866ec66
Size 186KB
Sample240704-28zrdavepp
SHA256 668bd6b6ff84d29517aa6d5873c4ebe0bf185276e576c38ae47b03b15866ec66
MD5 5ed6780db8f7245c49c9233c57ab5733
SHA1 162551884aff7a5dbaec3f642e9713457440ffc0
SHA512 c10b71d3ff7fb2fd144fd54bed8789c73aa51686f5778e4ae5d29439e1d33867aa9837af259473d18a72796b0017eaff78eebe236faa9aa54f01cb9a182873d7
SSDEEP 3072:vSfkvkzcsxWHUgVB29FGD4M/vtxCEY73wmKbRMCwrkrwJcD:vSikg/UWB2nM/vezARMCw/J
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
668bd6b6ff84d29517aa6d5873c4ebe0bf185276e576c38ae47b03b15866ec66

File Explorer

668bd6b6ff84d29517aa6d5873c4ebe0bf185276e576c38ae47b03b15866ec66

.exe 186KB

668bd6b6ff84d29517aa6d5873c4ebe0bf185276e576c38ae47b03b15866ec66

IMPHASH 81986d1e463d7f91d2bafd2ba07c4ce7
SHA256 668bd6b6ff84d29517aa6d5873c4ebe0bf185276e576c38ae47b03b15866ec66
MD5 5ed6780db8f7245c49c9233c57ab5733
SHA1 162551884aff7a5dbaec3f642e9713457440ffc0
SHA512 c10b71d3ff7fb2fd144fd54bed8789c73aa51686f5778e4ae5d29439e1d33867aa9837af259473d18a72796b0017eaff78eebe236faa9aa54f01cb9a182873d7
SSDEEP 3072:vSfkvkzcsxWHUgVB29FGD4M/vtxCEY73wmKbRMCwrkrwJcD:vSikg/UWB2nM/vezARMCw/J
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8923

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetConsoleAliasesLengthW TlsGetValue SetEndOfFile FindResourceW InterlockedDecrement CreateDirectoryW WriteConsoleInputA GetWindowsDirectoryA LoadLibraryW ReplaceFileW GlobalUnlock SetLastError GetProcAddress LoadLibraryA LocalAlloc IsBadStringPtrW GlobalFindAtomW EnumResourceTypesW GetModuleFileNameA GetOEMCP OpenFileMappingW TerminateJobObject HeapSize HeapReAlloc RtlUnwind RemoveVectoredExceptionHandler FindResourceA CreateFileA GlobalGetAtomNameW GetDateFormatW Sleep EnterCriticalSection LeaveCriticalSection MultiByteToWideChar GetCommandLineA HeapSetInformation GetStartupInfoW IsProcessorFeaturePresent GetCPInfo InterlockedIncrement GetACP IsValidCodePage EncodePointer TlsAlloc TlsSetValue DecodePointer TlsFree GetModuleHandleW GetCurrentThreadId GetLastError UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess HeapAlloc HeapFree ExitProcess WriteFile GetStdHandle GetModuleFileNameW FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection HeapCreate QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LCMapStringW GetStringTypeW RaiseException

user32

InsertMenuItemW GetKeyboardLayoutNameW GetCaretPos SetMessageExtraInfo CharUpperBuffW DdeKeepStringHandle GetClassInfoW

gdi32

GetCharWidthW

advapi32

BackupEventLogW ClearEventLogW

shell32

FindExecutableA

ole32

CoSuspendClassObjects CoMarshalHresult

winhttp

WinHttpWriteData

Sharing

General

Malware Config

Signatures

File Explorer

668bd6b6ff84d29517aa6d5873c4ebe0bf185276e576c38ae47b03b15866ec66

kernel32

user32

gdi32

advapi32

shell32

ole32

winhttp

generic