c74d87eb8e2de5493d8e950b8fcf51b2d89d88c7e5b77a9dc480e8dd77ac15a4

Sharing

Copy URL Twitter E-mail

General

Target
c74d87eb8e2de5493d8e950b8fcf51b2d89d88c7e5b77a9dc480e8dd77ac15a4
Size 219KB
Sample240706-wafmysxcpr
SHA256 c74d87eb8e2de5493d8e950b8fcf51b2d89d88c7e5b77a9dc480e8dd77ac15a4
MD5 9448faa05098532aa47f8c55ed979586
SHA1 0039a2a94cfd105b7b3ac3f174931bb0cf3153f8
SHA512 19b4790b9c6bbf09de4f80f368527c7eb6a0a65f1a1d0e6fb277a8f44048d05415f680fe60b144bdaddcbc09ed6fea6eea2f05edd69b654167e09e6bbba5b556
SSDEEP 3072:p8FfXDCLGhRZ9sZexhfXd+jYzoH8X0fLXSAHUbGlmsy4iIc:yFfTCiX0AUYAsS2AHlmW
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c74d87eb8e2de5493d8e950b8fcf51b2d89d88c7e5b77a9dc480e8dd77ac15a4

File Explorer

c74d87eb8e2de5493d8e950b8fcf51b2d89d88c7e5b77a9dc480e8dd77ac15a4

.exe 219KB

c74d87eb8e2de5493d8e950b8fcf51b2d89d88c7e5b77a9dc480e8dd77ac15a4

IMPHASH af5b51cd81208d846c1363af30da3791
SHA256 c74d87eb8e2de5493d8e950b8fcf51b2d89d88c7e5b77a9dc480e8dd77ac15a4
MD5 9448faa05098532aa47f8c55ed979586
SHA1 0039a2a94cfd105b7b3ac3f174931bb0cf3153f8
SHA512 19b4790b9c6bbf09de4f80f368527c7eb6a0a65f1a1d0e6fb277a8f44048d05415f680fe60b144bdaddcbc09ed6fea6eea2f05edd69b654167e09e6bbba5b556
SSDEEP 3072:p8FfXDCLGhRZ9sZexhfXd+jYzoH8X0fLXSAHUbGlmsy4iIc:yFfTCiX0AUYAsS2AHlmW
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

9217

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetConsoleAliasesLengthW SetEndOfFile FindResourceW CreateDirectoryW WriteConsoleInputA GetModuleHandleW VirtualFree LoadLibraryW ReplaceFileW GetModuleFileNameW GlobalUnlock GetLastError SetLastError GetProcAddress AttachConsole IsBadStringPtrW LocalAlloc GlobalGetAtomNameW EnumResourceTypesW GetOEMCP CancelIo OpenFileMappingW GetWindowsDirectoryW CreateFileW WriteConsoleW CloseHandle HeapSize FlushFileBuffers GetConsoleMode GetConsoleCP RemoveVectoredExceptionHandler FindResourceA CreateFileA OpenMutexA GetDateFormatW GetStringTypeW MultiByteToWideChar LCMapStringW HeapFree HeapReAlloc GetCommandLineA HeapSetInformation GetStartupInfoW IsProcessorFeaturePresent HeapCreate HeapAlloc SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection SetFilePointer UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer DecodePointer TerminateProcess GetCurrentProcess EnterCriticalSection LeaveCriticalSection ExitProcess WriteFile GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP IsValidCodePage Sleep SetStdHandle RtlUnwind RaiseException

user32

InsertMenuItemW GetKeyboardLayoutNameW GetCaretPos SetMessageExtraInfo CharUpperBuffW DdeKeepStringHandle GetClassInfoW

gdi32

GetCharWidthW

advapi32

BackupEventLogW GetLengthSid

shell32

FindExecutableA

ole32

CoRevokeClassObject CoMarshalHresult

winhttp

WinHttpWriteData

Sharing

General

Malware Config

Signatures

File Explorer

c74d87eb8e2de5493d8e950b8fcf51b2d89d88c7e5b77a9dc480e8dd77ac15a4

kernel32

user32

gdi32

advapi32

shell32

ole32

winhttp

generic