000a5351b371aded2fb7194910ee210cb029199eb65a4f755f23a4f904117607

General

Target
000a5351b371aded2fb7194910ee210cb029199eb65a4f755f23a4f904117607
Size 454KB
Sample240907-zpc26avapl
SHA256 000a5351b371aded2fb7194910ee210cb029199eb65a4f755f23a4f904117607
MD5 a29b233216094ad01ecd5c5405bda21c
SHA1 874b0eab36e5951df9a129ae272c627d661a69a4
SHA512 11365254b7b91b1ea81ce84a4c05ff18b9c60f4e97c32d8c770adc9168798553768ef271ccfca812b8d10e2330fb3c95d8fbcb9a01d61454619483682cdae63e
SSDEEP 12288:XrLO6RAATflzgrXUJNGnZJORHWXdGIyFH8x:3tRJ9MrkJNGLOR2NGIOH8x
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
000a5351b371aded2fb7194910ee210cb029199eb65a4f755f23a4f904117607

File Explorer

000a5351b371aded2fb7194910ee210cb029199eb65a4f755f23a4f904117607

.exe 454KB

000a5351b371aded2fb7194910ee210cb029199eb65a4f755f23a4f904117607

IMPHASH facc417011cd2847066f1f1ec6f97b50
SHA256 000a5351b371aded2fb7194910ee210cb029199eb65a4f755f23a4f904117607
MD5 a29b233216094ad01ecd5c5405bda21c
SHA1 874b0eab36e5951df9a129ae272c627d661a69a4
SHA512 11365254b7b91b1ea81ce84a4c05ff18b9c60f4e97c32d8c770adc9168798553768ef271ccfca812b8d10e2330fb3c95d8fbcb9a01d61454619483682cdae63e
SSDEEP 12288:XrLO6RAATflzgrXUJNGnZJORHWXdGIyFH8x:3tRJ9MrkJNGLOR2NGIOH8x
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

6633

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\dayog\farohoge-94\paxa\monunudayemo\wuh.pdb

kernel32

UnmapViewOfFile EndUpdateResourceW ReadConsoleA GetCurrentProcess BackupSeek FindActCtxSectionStringA GetEnvironmentStrings GlobalAlloc Sleep InitAtomTable HeapDestroy FindNextVolumeW GetModuleFileNameW CreateActCtxA GetACP ReleaseSemaphore SetTapePosition SetLastError GetProcAddress BeginUpdateResourceW ResetEvent DebugSetProcessKillOnExit CreateIoCompletionPort GetModuleHandleA GetProcessShutdownParameters VirtualProtect SetProcessShutdownParameters GetCurrentProcessId FindNextVolumeA LCMapStringW lstrcpyA WriteConsoleW HeapReAlloc GetCommandLineW HeapSetInformation GetStartupInfoW HeapAlloc EnterCriticalSection LeaveCriticalSection DecodePointer UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent EncodePointer TerminateProcess GetLastError HeapFree SetFilePointer CloseHandle GetModuleHandleW ExitProcess WriteFile GetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement HeapCreate QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime GetCPInfo GetOEMCP IsValidCodePage WideCharToMultiByte RtlUnwind SetStdHandle GetConsoleCP GetConsoleMode FlushFileBuffers LoadLibraryW RaiseException MultiByteToWideChar GetStringTypeW IsProcessorFeaturePresent HeapSize CreateFileW

advapi32

RegQueryValueExA

Name

.text

Size

363KB

Virtual Size

362KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

17KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.hahija

Size

1024B

Virtual Size

624B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.yaz

Size

512B

Virtual Size

23B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

63KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

000a5351b371aded2fb7194910ee210cb029199eb65a4f755f23a4f904117607

kernel32

advapi32

generic