012e382049b88808e2d0b26e016dc189f608deea9b6cc993ce24a57c99dd93d1

General

Target
012e382049b88808e2d0b26e016dc189f608deea9b6cc993ce24a57c99dd93d1
Size 604KB
Sample240902-m52z1aydrm
SHA256 012e382049b88808e2d0b26e016dc189f608deea9b6cc993ce24a57c99dd93d1
MD5 03c5e639039fc1d30c92df7527e6e464
SHA1 42af028d0e3255c97626b06ae262a34b46419772
SHA512 43e215724d8a91c09c8a4c3c23584f4d4f39d0278e28bc918ee82fdc96ec36eb5cfb8c03491b80045d9448c6c1a775aa236a852d62117810a87aef6d32b0b84e
SSDEEP 12288:kwFVzgdn12PiuBWq5y6zLJ7M29SGMzmr:kAVgn+igWwVgXGMzy
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
012e382049b88808e2d0b26e016dc189f608deea9b6cc993ce24a57c99dd93d1

File Explorer

012e382049b88808e2d0b26e016dc189f608deea9b6cc993ce24a57c99dd93d1

.exe 604KB

012e382049b88808e2d0b26e016dc189f608deea9b6cc993ce24a57c99dd93d1

IMPHASH f7ec5170de034aa3644c4457a2b957d4
SHA256 012e382049b88808e2d0b26e016dc189f608deea9b6cc993ce24a57c99dd93d1
MD5 03c5e639039fc1d30c92df7527e6e464
SHA1 42af028d0e3255c97626b06ae262a34b46419772
SHA512 43e215724d8a91c09c8a4c3c23584f4d4f39d0278e28bc918ee82fdc96ec36eb5cfb8c03491b80045d9448c6c1a775aa236a852d62117810a87aef6d32b0b84e
SSDEEP 12288:kwFVzgdn12PiuBWq5y6zLJ7M29SGMzmr:kAVgn+igWwVgXGMzy
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

8921

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FindResourceA GetLocaleInfoA MapViewOfFile LoadLibraryExW GetModuleHandleExW GetTickCount WriteFile TzSpecificLocalTimeToSystemTime LoadLibraryW SetSystemTimeAdjustment GetFileAttributesA HeapCreate GetConsoleAliasW TerminateProcess GetTimeZoneInformation lstrcatA RaiseException FreeLibraryAndExitThread GetLastError GetProcAddress OpenWaitableTimerA GetAtomNameA GetProcessId SetConsoleOutputCP GlobalFindAtomW SetConsoleCursorInfo GetModuleHandleA GetFileTime FindAtomW FileTimeToLocalFileTime DeleteTimerQueueTimer CompareStringW CompareStringA GetCommandLineA GetStartupInfoA RtlUnwind GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc HeapFree GetModuleHandleW Sleep ExitProcess GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetCurrentThread HeapDestroy VirtualFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection FatalAppExitA EnterCriticalSection VirtualAlloc HeapReAlloc HeapSize SetConsoleCtrlHandler FreeLibrary InterlockedExchange LoadLibraryA InitializeCriticalSectionAndSpinCount GetCPInfo GetACP GetOEMCP IsValidCodePage GetLocaleInfoW LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW GetTimeFormatA GetDateFormatA GetUserDefaultLCID EnumSystemLocalesA IsValidLocale SetEnvironmentVariableA

user32

GetDesktopWindow

Name

.text

Size

445KB

Virtual Size

444KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

89KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.new

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

110KB

Virtual Size

110KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

012e382049b88808e2d0b26e016dc189f608deea9b6cc993ce24a57c99dd93d1

kernel32

user32

generic