214174b3cb076fc05b683fb80189ace40fc0edb59a36d109fd3c0f69a380a48a

General

Target
214174b3cb076fc05b683fb80189ace40fc0edb59a36d109fd3c0f69a380a48a
Size 636KB
Sample240706-ez8xcsvhkk
SHA256 214174b3cb076fc05b683fb80189ace40fc0edb59a36d109fd3c0f69a380a48a
MD5 e9b61a9dfc0f04c1fadbc68227494a9c
SHA1 df4b05b9b1613eb17e7cfecd843fe3159649c313
SHA512 426f3319f09adb14e9b4f5f391b3402e42de4fc75353e4646556b50a74e0111455f78a348b56ef4ad49e8146e4d6eca2db3ca055654f0343a456e4cb02cbd8ac
SSDEEP 12288:Xl853WP8x/Xsfdt7TSpvK16EDX30WA+McixjbI1fKx87bqmlB5O3b+lr8F8qNqHl:XWxWP8Vev7TlvZA+MZ9bIc6hoP+M6
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/8cf61c66b1cde95afdc402040152b3ca0022fceb866b84be297572708b08cb5b.exe

File Explorer

214174b3cb076fc05b683fb80189ace40fc0edb59a36d109fd3c0f69a380a48a

.zip 636KB
8cf61c66b1cde95afdc402040152b3ca0022fceb866b84be297572708b08cb5b.exe

.exe 691KB

214174b3cb076fc05b683fb80189ace40fc0edb59a36d109fd3c0f69a380a48a

SHA256 214174b3cb076fc05b683fb80189ace40fc0edb59a36d109fd3c0f69a380a48a
MD5 e9b61a9dfc0f04c1fadbc68227494a9c
SHA1 df4b05b9b1613eb17e7cfecd843fe3159649c313
SHA512 426f3319f09adb14e9b4f5f391b3402e42de4fc75353e4646556b50a74e0111455f78a348b56ef4ad49e8146e4d6eca2db3ca055654f0343a456e4cb02cbd8ac
SSDEEP 12288:Xl853WP8x/Xsfdt7TSpvK16EDX30WA+McixjbI1fKx87bqmlB5O3b+lr8F8qNqHl:XWxWP8Vev7TlvZA+MZ9bIc6hoP+M6
MD5 SHA1 SHA512 SSDEEP

Password

infected

8cf61c66b1cde95afdc402040152b3ca0022fceb866b84be297572708b08cb5b.exe

IMPHASH 26b20b2808041724a94fb2624d73bdc4
SHA256 8cf61c66b1cde95afdc402040152b3ca0022fceb866b84be297572708b08cb5b
MD5 88112987854f5a3bd04516f6a3334880
SHA1 a8c7e14800cf6d7a5140c22e6d34bb76275e38ae
SHA512 a37baad956e5bf8f57f02ea69083271aa866df10acccdedf374c66b0d072a368f1e0e9cb5c1ec0e87f8263fdc7369f033d3be814d221274ecf2986d7dfb14bdd
SSDEEP 12288:Ryxs0QrMKlM/zKo0Bjfym1Eewp7W57D56GSLM9LFZ0BMR1Dt44Sf/C7+GmZec8L7:0EyzKo0Bjpey5X5CMWMxthS/C7fcW7
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

6011

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CreateJobObjectW GetModuleHandleExW SleepEx GetModuleHandleW GetTickCount GetConsoleAliasesA ReadConsoleOutputA GlobalAlloc SetVolumeMountPointA GetConsoleAliasExesLengthW lstrcpynW WriteConsoleW GetModuleFileNameW ZombifyActCtx GetProcAddress BuildCommDCBW GetAtomNameA LoadLibraryA UnhandledExceptionFilter InterlockedExchangeAdd SetFileApisToANSI AddAtomA OpenJobObjectW FoldStringA lstrcatW EnumDateFormatsW FindFirstVolumeA SetLastError GetComputerNameA CreateFileA GetConsoleOutputCP GetLastError HeapFree MultiByteToWideChar GetStartupInfoW TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter IsDebuggerPresent HeapCreate VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapAlloc VirtualAlloc HeapReAlloc GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage TlsGetValue TlsAlloc TlsSetValue TlsFree GetCurrentThreadId SetHandleCount GetStdHandle GetFileType GetStartupInfoA Sleep HeapSize ExitProcess WriteFile GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount RtlUnwind LCMapStringA WideCharToMultiByte LCMapStringW GetStringTypeA GetStringTypeW GetLocaleInfoA ReadFile GetConsoleCP GetConsoleMode FlushFileBuffers SetFilePointer SetStdHandle CloseHandle WriteConsoleA

gdi32

GetBoundsRect

ole32

CoTaskMemAlloc

Sharing

General

Malware Config

Signatures

File Explorer

214174b3cb076fc05b683fb80189ace40fc0edb59a36d109fd3c0f69a380a48a

8cf61c66b1cde95afdc402040152b3ca0022fceb866b84be297572708b08cb5b.exe

kernel32

gdi32

ole32

generic