a2be1d5be7fc1358a081527ff2654d0ab5c2425ed960020fbbcccb8025cec1ffN

General

Target
a2be1d5be7fc1358a081527ff2654d0ab5c2425ed960020fbbcccb8025cec1ffN
Size 685KB
Sample241003-vbkgvsyhpg
SHA256 a2be1d5be7fc1358a081527ff2654d0ab5c2425ed960020fbbcccb8025cec1ff
MD5 86a7a160e257e190399d6059cacca0a0
SHA1 665fff8e0f5455e37d21da18ae12421da5ef3572
SHA512 0f9dc3decf33fbd78513e2313ddbb8af70e378be520a398b18e96510dbfb1549074d2a67be218c9482feda5eaa45723fb615083a92ef4ddfc1fe3477e39d12b2
SSDEEP 12288:FiDTDIO3IfnPZjcEBfsKYEZuROtto4aIJayoPJviaKYNVuI:YKnPZjcEBfsKYFuayoSsuI
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a2be1d5be7fc1358a081527ff2654d0ab5c2425ed960020fbbcccb8025cec1ffN

File Explorer

a2be1d5be7fc1358a081527ff2654d0ab5c2425ed960020fbbcccb8025cec1ffN

.dll 685KB

a2be1d5be7fc1358a081527ff2654d0ab5c2425ed960020fbbcccb8025cec1ffN

IMPHASH e859761bcd7ac19039e80a133546ba8d
SHA256 a2be1d5be7fc1358a081527ff2654d0ab5c2425ed960020fbbcccb8025cec1ff
MD5 86a7a160e257e190399d6059cacca0a0
SHA1 665fff8e0f5455e37d21da18ae12421da5ef3572
SHA512 0f9dc3decf33fbd78513e2313ddbb8af70e378be520a398b18e96510dbfb1549074d2a67be218c9482feda5eaa45723fb615083a92ef4ddfc1fe3477e39d12b2
SSDEEP 12288:FiDTDIO3IfnPZjcEBfsKYEZuROtto4aIJayoPJviaKYNVuI:YKnPZjcEBfsKYFuayoSsuI
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

352256

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

E:\Simba\WorkShop\Channel\Common\Bin\DiagChan9.pdb

kernel32

CloseHandle WaitForSingleObject Sleep SetEvent LeaveCriticalSection EnterCriticalSection InterlockedDecrement GetPrivateProfileIntW ResetEvent InterlockedIncrement GetTickCount CreateEventW InitializeCriticalSectionAndSpinCount InitializeCriticalSection DeleteCriticalSection GetProcAddress LoadLibraryW FreeLibrary GetModuleFileNameW VirtualAlloc VirtualQuery VirtualFree SleepEx GetCurrentThreadId GetSystemInfo GetLocalTime FreeConsole FlushFileBuffers IsBadWritePtr WriteConsoleW GetConsoleWindow SetConsoleTitleW SetConsoleWindowInfo SetConsoleScreenBufferSize GetStdHandle AllocConsole GetLastError CreateDirectoryW GetFileAttributesW lstrlenW SetFilePointer CreateFileW WideCharToMultiByte GetTempPathW WriteFile GetFileSize lstrlenA lstrcatA SetEndOfFile ReadFile GetConsoleMode GetConsoleCP SetStdHandle IsValidLocale EnumSystemLocalesA GetLocaleInfoA GetUserDefaultLCID HeapSize GetProcessHeap InterlockedCompareExchange InterlockedExchange MultiByteToWideChar EncodePointer DecodePointer RaiseException ExitThread CreateThread RtlUnwind HeapFree GetCommandLineA LCMapStringW GetCPInfo HeapAlloc GetLocaleInfoW TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent IsProcessorFeaturePresent TlsAlloc TlsGetValue TlsSetValue TlsFree GetModuleHandleW SetLastError GetCurrentThread ExitProcess SetHandleCount GetFileType GetStartupInfoW SetConsoleCtrlHandler FatalAppExitA HeapCreate HeapDestroy GetACP GetOEMCP IsValidCodePage GetModuleFileNameA FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetStringTypeW HeapReAlloc

user32

EnableMenuItem ShowWindow GetMessageW PostThreadMessageW GetSystemMenu

shlwapi

PathFindFileNameW PathIsRelativeW PathRemoveFileSpecW PathFindExtensionW

Name

.text

Size

258KB

Virtual Size

258KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

47KB

Virtual Size

47KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.text

Size

357KB

Virtual Size

360KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

a2be1d5be7fc1358a081527ff2654d0ab5c2425ed960020fbbcccb8025cec1ffN

kernel32

user32

shlwapi

generic