63b6e2b5867062e476e3a02be403edfafd28f6733414e05b91ff0cfbab18c1b2

General

Target
63b6e2b5867062e476e3a02be403edfafd28f6733414e05b91ff0cfbab18c1b2
Size 529KB
Sample240801-2ltlvazell
SHA256 63b6e2b5867062e476e3a02be403edfafd28f6733414e05b91ff0cfbab18c1b2
MD5 22831ca3ab9f637849c51e4903beacd0
SHA1 0b57431c8ca8782565577d6b7b8b21d931e26e02
SHA512 690dbb5b9d0743bb5c222614bb5077cd89f4e5dac2d0083be74e2552b7e4a0f18226b4b3d5737550f200449034061b7f638751a766a0efb74379d6b12b228959
SSDEEP 12288:erwlqq+UHXkDwRrHv8jwe2MJJghxzZ6q9wy6oQfN:erw0qtXrPEB2MJJg/zZ6YnSN
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
63b6e2b5867062e476e3a02be403edfafd28f6733414e05b91ff0cfbab18c1b2

File Explorer

63b6e2b5867062e476e3a02be403edfafd28f6733414e05b91ff0cfbab18c1b2

.exe 529KB

63b6e2b5867062e476e3a02be403edfafd28f6733414e05b91ff0cfbab18c1b2

IMPHASH 95d4113c25a148a48f2688574ed71076
SHA256 63b6e2b5867062e476e3a02be403edfafd28f6733414e05b91ff0cfbab18c1b2
MD5 22831ca3ab9f637849c51e4903beacd0
SHA1 0b57431c8ca8782565577d6b7b8b21d931e26e02
SHA512 690dbb5b9d0743bb5c222614bb5077cd89f4e5dac2d0083be74e2552b7e4a0f18226b4b3d5737550f200449034061b7f638751a766a0efb74379d6b12b228959
SSDEEP 12288:erwlqq+UHXkDwRrHv8jwe2MJJghxzZ6q9wy6oQfN:erw0qtXrPEB2MJJg/zZ6YnSN
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

48254

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

WaitForSingleObject Sleep CreateThread VirtualAllocEx FreeConsole RaiseException InitOnceBeginInitialize InitOnceComplete QueryPerformanceCounter QueryPerformanceFrequency CloseHandle GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW WideCharToMultiByte MultiByteToWideChar GetStringTypeW GetLastError FreeLibraryWhenCallbackReturns CreateThreadpoolWork SubmitThreadpoolWork CloseThreadpoolWork GetModuleHandleExW IsProcessorFeaturePresent EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress EncodePointer DecodePointer LCMapStringEx GetCPInfo IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW GetCurrentProcess TerminateProcess GetCurrentProcessId InitializeSListHead CreateFileW RtlUnwind SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW ExitProcess GetModuleFileNameW GetStdHandle WriteFile GetCommandLineA GetCommandLineW HeapAlloc HeapFree GetFileType CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile ReadConsoleW HeapReAlloc FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap SetStdHandle HeapSize WriteConsoleW

Sharing

General

Malware Config

Signatures

File Explorer

63b6e2b5867062e476e3a02be403edfafd28f6733414e05b91ff0cfbab18c1b2

kernel32

generic