3e1c44e85fb5fe2fbbd707e66526afdc836d1c777b0f388db6f837a4db1f4dc5

General

Target
3e1c44e85fb5fe2fbbd707e66526afdc836d1c777b0f388db6f837a4db1f4dc5
Size 700KB
Sample240718-2gvncazejp
SHA256 3e1c44e85fb5fe2fbbd707e66526afdc836d1c777b0f388db6f837a4db1f4dc5
MD5 4a585e95952179e7dd63e217ff8d5775
SHA1 0f665e71484876acf2db54714ab910f889741d8a
SHA512 17addcbce4515ee0e1f0ca78d4a39110d15f9efb68128d65dab1ce2c2a6b80525abf40aec7a59aee5e2556917ea0b66df1ad9801eec4085b9f422f9eceaad33d
SSDEEP 12288:j6+LE9X2oPiqScp5DtFHlrUeo3k5Tka+WgYscsXTMJLBEReTCFWa:dE9X2xQFHlrUeo05yDJKCeTNa
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3e1c44e85fb5fe2fbbd707e66526afdc836d1c777b0f388db6f837a4db1f4dc5

File Explorer

3e1c44e85fb5fe2fbbd707e66526afdc836d1c777b0f388db6f837a4db1f4dc5

.exe 700KB

3e1c44e85fb5fe2fbbd707e66526afdc836d1c777b0f388db6f837a4db1f4dc5

IMPHASH b96fa6d857ff4223ed4ce64b37e1eb1f
SHA256 3e1c44e85fb5fe2fbbd707e66526afdc836d1c777b0f388db6f837a4db1f4dc5
MD5 4a585e95952179e7dd63e217ff8d5775
SHA1 0f665e71484876acf2db54714ab910f889741d8a
SHA512 17addcbce4515ee0e1f0ca78d4a39110d15f9efb68128d65dab1ce2c2a6b80525abf40aec7a59aee5e2556917ea0b66df1ad9801eec4085b9f422f9eceaad33d
SSDEEP 12288:j6+LE9X2oPiqScp5DtFHlrUeo3k5Tka+WgYscsXTMJLBEReTCFWa:dE9X2xQFHlrUeo05yDJKCeTNa
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

8873

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEndOfFile FindResourceW LocalCompact CreateDirectoryW GetModuleHandleW EnumResourceTypesA LoadLibraryW IsBadCodePtr CreateEventA GetModuleFileNameW GetACP ReplaceFileA GlobalUnlock GetLastError SetLastError GetProcAddress AttachConsole CreateJobSet IsBadStringPtrW FindClose LoadLibraryA LocalAlloc FindAtomA ReleaseMutex ReadConsoleInputW TerminateJobObject GetWindowsDirectoryW CheckRemoteDebuggerPresent GetStringTypeW MultiByteToWideChar LCMapStringW HeapReAlloc HeapSize FindResourceA GetDiskFreeSpaceW CreateFileA HeapAlloc GetCommandLineA HeapSetInformation GetStartupInfoW IsProcessorFeaturePresent ExitProcess DecodePointer UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer TerminateProcess GetCurrentProcess HeapFree WriteFile GetStdHandle HeapCreate GetModuleFileNameA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection Sleep RtlUnwind GetCPInfo GetOEMCP IsValidCodePage RaiseException

user32

GetKeyboardLayoutNameW CharUpperBuffA SetCursorPos LoadMenuW GetCaretPos GetSysColorBrush GetSystemMetrics GetMessageTime

advapi32

AddAce ClearEventLogW

Sharing

General

Malware Config

Signatures

File Explorer

3e1c44e85fb5fe2fbbd707e66526afdc836d1c777b0f388db6f837a4db1f4dc5

kernel32

user32

advapi32

generic