1aefaf148a178b4ebfbe492e9b937d94c9203acc2baff62420d8f8f6f6ac5d94

General

Target
1aefaf148a178b4ebfbe492e9b937d94c9203acc2baff62420d8f8f6f6ac5d94
Size 237KB
Sample240719-nqscpasdke
SHA256 1aefaf148a178b4ebfbe492e9b937d94c9203acc2baff62420d8f8f6f6ac5d94
MD5 8b1f4b7f4ce87d05cec90b9d43eef3a4
SHA1 a20f80357f0a9ab05eaea5a709be58574a141ee4
SHA512 f5a7da635a56f714b4b0e4c4cfbfa068d9181e36947f39baa711cbd74e782d6021bf9d53594449d5b5a65d6ca89594558e5e04aa180811a3d5d7fb4c4efa27f6
SSDEEP 3072:LKW8Q0Lk51Y/JCegjoPiT+SEWUKSnVx1Szhxy58tK4DhyDJmmEyOtBic:LKWV8xCegjQiT+S2cTy58tKmhBmEBB
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1aefaf148a178b4ebfbe492e9b937d94c9203acc2baff62420d8f8f6f6ac5d94

File Explorer

1aefaf148a178b4ebfbe492e9b937d94c9203acc2baff62420d8f8f6f6ac5d94

.exe 237KB

1aefaf148a178b4ebfbe492e9b937d94c9203acc2baff62420d8f8f6f6ac5d94

IMPHASH 9fa45476e477c6919d1122378d8053e3
SHA256 1aefaf148a178b4ebfbe492e9b937d94c9203acc2baff62420d8f8f6f6ac5d94
MD5 8b1f4b7f4ce87d05cec90b9d43eef3a4
SHA1 a20f80357f0a9ab05eaea5a709be58574a141ee4
SHA512 f5a7da635a56f714b4b0e4c4cfbfa068d9181e36947f39baa711cbd74e782d6021bf9d53594449d5b5a65d6ca89594558e5e04aa180811a3d5d7fb4c4efa27f6
SSDEEP 3072:LKW8Q0Lk51Y/JCegjoPiT+SEWUKSnVx1Szhxy58tK4DhyDJmmEyOtBic:LKWV8xCegjQiT+S2cTy58tKmhBmEBB
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

18808

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SetEndOfFile LocalCompact CreateHardLinkA GetModuleHandleW GetProcessHeap EnumResourceTypesA GlobalAlloc GetSystemDirectoryW LoadLibraryW IsProcessInJob AssignProcessToJobObject IsBadWritePtr GetLastError SetLastError GetProcAddress IsBadHugeWritePtr VerLanguageNameA FindClose LoadLibraryA SetConsoleCtrlHandler AddAtomW CreateEventW GlobalHandle GetModuleFileNameA GetOEMCP GlobalUnWire HeapSetInformation EnumResourceNamesA GetCurrentThreadId Module32NextW GetDiskFreeSpaceExA ReadConsoleInputW WriteConsoleW CloseHandle FlushFileBuffers GetConsoleMode GetConsoleCP SetStdHandle SetFilePointer HeapReAlloc WideCharToMultiByte InterlockedIncrement InterlockedDecrement InterlockedCompareExchange InterlockedExchange MultiByteToWideChar GetStringTypeW EncodePointer DecodePointer Sleep InitializeCriticalSection DeleteCriticalSection EnterCriticalSection LeaveCriticalSection HeapFree GetCommandLineW GetStartupInfoW GetCPInfo RaiseException RtlUnwind HeapAlloc LCMapStringW IsProcessorFeaturePresent HeapCreate ReadFile UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess ExitProcess WriteFile GetStdHandle GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType TlsAlloc TlsGetValue TlsSetValue TlsFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetLocaleInfoW HeapSize GetACP IsValidCodePage GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale CreateFileW

user32

ChangeMenuW GetMessageExtraInfo CharUpperBuffA SetCursorPos SetUserObjectSecurity SetCaretPos GetCaretBlinkTime SetClipboardViewer

Name

.text

Size

143KB

Virtual Size

142KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

47KB

Virtual Size

28.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.sotaru

Size

1024B

Virtual Size

1024B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.nib

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bumaco

Size

1024B

Virtual Size

723B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

18KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

1aefaf148a178b4ebfbe492e9b937d94c9203acc2baff62420d8f8f6f6ac5d94

kernel32

user32

generic