89bd52f639a316cd73d56f444c0663e7b3829b9fc70b083eb3aa7d761a00e2b6N

Sharing

Copy URL Twitter E-mail

General

Target
89bd52f639a316cd73d56f444c0663e7b3829b9fc70b083eb3aa7d761a00e2b6N
Size 106KB
Sample240919-eav9zazbql
SHA256 89bd52f639a316cd73d56f444c0663e7b3829b9fc70b083eb3aa7d761a00e2b6
MD5 bbf8ddf6f17557dd4759d7a0d0a85320
SHA1 ce8f438fc986a7a3e1bbc6150a027a1b9005109a
SHA512 e67dfcf76ff65e8556b1b291a34fd31ec9ddf86de82a46032034426750d8ef7071f0f9c870347abe3cf87b142d546a91b21cee766d65e5db6a9cfe7489143a51
SSDEEP 768:y+6p+OMlgGXCWhfDzU7f0JDgi9I57+sByZ+XsfXpwtG9ipelU9JA:y+mFM2QXtZgi9Iksu+XM57ipeq9JA
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
89bd52f639a316cd73d56f444c0663e7b3829b9fc70b083eb3aa7d761a00e2b6N

File Explorer

89bd52f639a316cd73d56f444c0663e7b3829b9fc70b083eb3aa7d761a00e2b6N

.exe 106KB

89bd52f639a316cd73d56f444c0663e7b3829b9fc70b083eb3aa7d761a00e2b6N

IMPHASH 4dab014261fac4bf536f9fdb7ef5177f
SHA256 89bd52f639a316cd73d56f444c0663e7b3829b9fc70b083eb3aa7d761a00e2b6
MD5 bbf8ddf6f17557dd4759d7a0d0a85320
SHA1 ce8f438fc986a7a3e1bbc6150a027a1b9005109a
SHA512 e67dfcf76ff65e8556b1b291a34fd31ec9ddf86de82a46032034426750d8ef7071f0f9c870347abe3cf87b142d546a91b21cee766d65e5db6a9cfe7489143a51
SSDEEP 768:y+6p+OMlgGXCWhfDzU7f0JDgi9I57+sByZ+XsfXpwtG9ipelU9JA:y+mFM2QXtZgi9Iksu+XM57ipeq9JA
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

22992

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

CreateMailslotW GetTickCount FreeConsole TlsAlloc CancelDeviceWakeupRequest GetConsoleTitleW SetCurrentDirectoryW GetEnvironmentStrings CreateNamedPipeA OpenWaitableTimerW FindNextVolumeA GetLocaleInfoW GetFullPathNameW FoldStringA SetProcessAffinityMask GetNumberFormatA GlobalFindAtomW AreFileApisANSI HeapAlloc LeaveCriticalSection GetSystemInfo GetProfileSectionA RegisterWaitForSingleObjectEx GetCommTimeouts FindFirstVolumeA CreateDirectoryExW WritePrivateProfileSectionA WriteConsoleOutputAttribute DisconnectNamedPipe SetConsoleOutputCP SetCalendarInfoA ReadConsoleOutputW CopyFileA SetConsoleScreenBufferSize OpenEventA WaitCommEvent SetThreadPriority AssignProcessToJobObject GetComputerNameW GetNamedPipeInfo

mscms

CreateMultiProfileTransform ConvertIndexToColorName GetCMMInfo DisassociateColorProfileFromDeviceW SelectCMM DisassociateColorProfileFromDeviceA OpenColorProfileW CreateProfileFromLogColorSpaceW GetColorDirectoryW CreateProfileFromLogColorSpaceA RegisterCMMA AssociateColorProfileWithDeviceA OpenColorProfileA GetColorProfileElement InstallColorProfileW GetPS2ColorRenderingDictionary GetStandardColorSpaceProfileW SetColorProfileElementReference GetColorProfileFromHandle GetStandardColorSpaceProfileA UninstallColorProfileW GetCountColorProfileElements SetColorProfileHeader CloseColorProfile GetColorProfileHeader TranslateBitmapBits SetColorProfileElementSize

msvcrt

fputc _wtoi atol isdigit _wexecle memcpy _lrotr bsearch wcsncmp _wgetenv fputws _wspawnlp ungetwc _wexecv _tempnam fwrite isprint free _wspawnve wcscoll _wspawnlpe wcsspn _wexeclpe fflush strtok _fgetwchar _wgetdcwd wcscmp _vsnwprintf _wremove _flsbuf

ole32

CreateStreamOnHGlobal CoRegisterPSClsid HMENU_UserSize CoCopyProxy OleTranslateAccelerator OleRun CreateILockBytesOnHGlobal StgIsStorageILockBytes

winmm

midiOutMessage midiInGetDevCapsW midiInStart midiStreamPause mciGetErrorStringW mmioSetBuffer waveOutClose PlaySoundA mixerGetDevCapsW midiOutGetErrorTextW waveOutGetErrorTextA mmioDescend mciGetDeviceIDFromElementIDA waveInAddBuffer mciGetYieldProc joyGetThreshold waveInUnprepareHeader mixerGetLineInfoA auxGetNumDevs joySetCapture midiStreamProperty waveOutGetErrorTextW mixerGetNumDevs waveInStart midiStreamClose midiInClose joyGetPosEx waveOutGetID waveOutPrepareHeader waveInGetPosition midiStreamStop auxOutMessage mciGetDeviceIDA mixerGetDevCapsA midiInGetErrorTextA

Name

.text

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.WavfW

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

gu_idata

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

gu_rsrcs

Size

13KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.htext

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

89bd52f639a316cd73d56f444c0663e7b3829b9fc70b083eb3aa7d761a00e2b6N

kernel32

mscms

msvcrt

ole32

winmm

generic