e062eef39560092cdd4fb500542d09f945f7446f3d7bdaf08150ae5d5a14d391

Sharing

Copy URL Twitter E-mail

General

Target
e062eef39560092cdd4fb500542d09f945f7446f3d7bdaf08150ae5d5a14d391
Size 1.5MB
Sample240915-t2tmsatcml
SHA256 e062eef39560092cdd4fb500542d09f945f7446f3d7bdaf08150ae5d5a14d391
MD5 21641adc924ac0dab813848c457ba37c
SHA1 d490da9069955c01395e97c7e75cf67274978cdf
SHA512 707be2644841efe6e7c5f1f66f8385d6f4b59ec0ef704e1cbd5db979b3cd300696e70a45907e6246dce17eb70cef5ec05edaaf729041369789f9fa2751bb4b50
SSDEEP 24576:HkVUWcG3lqC2MERKvARjLbDoZJoAOM08/85RkptVIJqFx3r:qCC2DReUOOMjUfkptVxFJ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e062eef39560092cdd4fb500542d09f945f7446f3d7bdaf08150ae5d5a14d391

File Explorer

e062eef39560092cdd4fb500542d09f945f7446f3d7bdaf08150ae5d5a14d391

.exe 1.5MB

e062eef39560092cdd4fb500542d09f945f7446f3d7bdaf08150ae5d5a14d391

IMPHASH 8b4f04d2d9e704a8f296770909ee197e
SHA256 e062eef39560092cdd4fb500542d09f945f7446f3d7bdaf08150ae5d5a14d391
MD5 21641adc924ac0dab813848c457ba37c
SHA1 d490da9069955c01395e97c7e75cf67274978cdf
SHA512 707be2644841efe6e7c5f1f66f8385d6f4b59ec0ef704e1cbd5db979b3cd300696e70a45907e6246dce17eb70cef5ec05edaaf729041369789f9fa2751bb4b50
SSDEEP 24576:HkVUWcG3lqC2MERKvARjLbDoZJoAOM08/85RkptVIJqFx3r:qCC2DReUOOMjUfkptVxFJ
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

263932

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ole32

StringFromGUID2 IIDFromString

shell32

SHGetFolderPathW CommandLineToArgvW

user32

MessageBoxW

kernel32

FindClose GetFileAttributesA CloseHandle SetLastError GetCommandLineW GetTempPathA GetCurrentProcess GetSystemDirectoryA GetNativeSystemInfo GetModuleFileNameA GetModuleHandleExW LocalFree Sleep GetCurrentProcessId GetCurrentThreadId GetLocalTime FormatMessageW ReadFile PeekNamedPipe WaitForSingleObject TerminateProcess GetExitCodeProcess CreateProcessA GetProcessId WideCharToMultiByte GetModuleHandleExA FreeLibrary GetProcAddress LoadLibraryW LoadLibraryExW OpenMutexA OpenProcess LoadResource LockResource SizeofResource FindResourceA QueryPerformanceCounter QueryPerformanceFrequency CreateFileW SetFilePointerEx InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetStringTypeW InitializeCriticalSectionEx EncodePointer LCMapStringEx GetCPInfo IsDebuggerPresent OutputDebugStringW RaiseException TlsAlloc DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetLastError DecodePointer GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetFileSizeEx ReadConsoleW GetCurrentDirectoryW HeapReAlloc GetTimeZoneInformation HeapSize FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap TlsGetValue TlsSetValue TlsFree RtlUnwind MultiByteToWideChar RtlUnwindEx RtlPcToFileHeader InitializeSListHead IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW FlsFree FlsSetValue FlsGetValue FlsAlloc HeapAlloc HeapFree ExitProcess SetStdHandle CreateDirectoryW GetFullPathNameW WriteConsoleW GetModuleFileNameW GetStdHandle GetConsoleMode GetConsoleOutputCP WriteFile SetEndOfFile FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetFileType GetFileInformationByHandle RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW GetModuleHandleW GetSystemTimeAsFileTime GetDriveTypeW

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW RegQueryValueExA RegOpenKeyExA RegCreateKeyExA RegCloseKey CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextA

version

GetFileVersionInfoSizeA VerQueryValueW GetFileVersionInfoA

msi

ord137 ord8 ord67 ord91 ord189 ord204 ord115 ord117 ord31 ord159 ord160 ord168 ord44 ord141

Name

.text

Size

446KB

Virtual Size

446KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

154KB

Virtual Size

153KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

800KB

Virtual Size

799KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

e062eef39560092cdd4fb500542d09f945f7446f3d7bdaf08150ae5d5a14d391

ole32

shell32

user32

kernel32

advapi32

version

msi

generic