b64611d1dc24557468045da4200d7b23ac65a9a7b82cc00a0e00b548acb1147dN

General

Target
b64611d1dc24557468045da4200d7b23ac65a9a7b82cc00a0e00b548acb1147dN
Size 564KB
Sample241021-pxhmhatgla
SHA256 b64611d1dc24557468045da4200d7b23ac65a9a7b82cc00a0e00b548acb1147d
MD5 3ef7a13352026b6ffa18064423d108e0
SHA1 e082238649301430ae38183cbd64e78d3e129ad4
SHA512 f998440d336db7e2ca723573008d7150d729702dde16728ae13162ab7e4e92db94eefc02676c3d64ed2aa2c634a4ce4185f9cae2d0f1e9ca1947b8f8fe245e66
SSDEEP 12288:tehnaNPpSVZmNxRCwnwm3W3OHIIf5m9RhWFVS:teh0PpS6NxNnwYeOHXAhWTS
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b64611d1dc24557468045da4200d7b23ac65a9a7b82cc00a0e00b548acb1147dN

File Explorer

b64611d1dc24557468045da4200d7b23ac65a9a7b82cc00a0e00b548acb1147dN

.dll 564KB

b64611d1dc24557468045da4200d7b23ac65a9a7b82cc00a0e00b548acb1147dN

IMPHASH a24bdda400a413aa6d759d0b8e02ddd9
SHA256 b64611d1dc24557468045da4200d7b23ac65a9a7b82cc00a0e00b548acb1147d
MD5 3ef7a13352026b6ffa18064423d108e0
SHA1 e082238649301430ae38183cbd64e78d3e129ad4
SHA512 f998440d336db7e2ca723573008d7150d729702dde16728ae13162ab7e4e92db94eefc02676c3d64ed2aa2c634a4ce4185f9cae2d0f1e9ca1947b8f8fe245e66
SSDEEP 12288:tehnaNPpSVZmNxRCwnwm3W3OHIIf5m9RhWFVS:teh0PpS6NxNnwYeOHXAhWTS
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

397312

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

InitializeCriticalSection LeaveCriticalSection EnterCriticalSection DeleteCriticalSection GlobalMemoryStatus QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime GetSystemInfo GetCurrentProcessId TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent GetLastError HeapFree HeapAlloc InterlockedIncrement InterlockedDecrement HeapReAlloc GetCurrentThreadId GetCommandLineA GetVersionExA GetProcessHeap RaiseException RtlUnwind GetProcAddress GetModuleHandleA TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError HeapDestroy HeapCreate VirtualFree VirtualAlloc ExitProcess WriteFile GetStdHandle GetModuleFileNameA GetCPInfo GetACP GetOEMCP WideCharToMultiByte GetTimeZoneInformation Sleep GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale IsValidCodePage GetStringTypeA MultiByteToWideChar GetStringTypeW SetHandleCount GetFileType GetStartupInfoA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW SetFilePointer GetConsoleCP GetConsoleMode LoadLibraryA LCMapStringA LCMapStringW GetLocaleInfoW SetStdHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW HeapSize CreateFileA CloseHandle FlushFileBuffers CompareStringA CompareStringW SetEnvironmentVariableA

WXMPIterator_DecrementRefCount_1 WXMPIterator_IncrementRefCount_1 WXMPIterator_Next_1 WXMPIterator_PropCTor_1 WXMPIterator_Skip_1 WXMPIterator_TableCTor_1 WXMPIterator_Unlock_1 WXMPMeta_AppendArrayItem_1 WXMPMeta_CTor_1 WXMPMeta_Clone_1 WXMPMeta_CountArrayItems_1 WXMPMeta_DecrementRefCount_1 WXMPMeta_DeleteAlias_1 WXMPMeta_DeleteArrayItem_1 WXMPMeta_DeleteNamespace_1 WXMPMeta_DeleteProperty_1 WXMPMeta_DeleteQualifier_1 WXMPMeta_DeleteStructField_1 WXMPMeta_DoesArrayItemExist_1 WXMPMeta_DoesPropertyExist_1 WXMPMeta_DoesQualifierExist_1 WXMPMeta_DoesStructFieldExist_1 WXMPMeta_DumpAliases_1 WXMPMeta_DumpNamespaces_1 WXMPMeta_DumpObject_1 WXMPMeta_DumpPropertyTraits_1 WXMPMeta_GetArrayItem_1 WXMPMeta_GetGlobalOptions_1 WXMPMeta_GetLocalizedText_1 WXMPMeta_GetMemProcs_1 WXMPMeta_GetNamespacePrefix_1 WXMPMeta_GetNamespaceURI_1 WXMPMeta_GetObjectName_1 WXMPMeta_GetObjectOptions_1 WXMPMeta_GetProperty_1 WXMPMeta_GetProperty_Bool_1 WXMPMeta_GetProperty_Date_1 WXMPMeta_GetProperty_Float_1 WXMPMeta_GetProperty_Int64_1 WXMPMeta_GetProperty_Int_1 WXMPMeta_GetQualifier_1 WXMPMeta_GetStructField_1 WXMPMeta_GetVersionInfo_1 WXMPMeta_IncrementRefCount_1 WXMPMeta_Initialize_1 WXMPMeta_MarkStaleProperties_1 WXMPMeta_ParseFromBuffer_1 WXMPMeta_RegisterAlias_1 WXMPMeta_RegisterAssertNotify_1 WXMPMeta_RegisterNamespace_1 WXMPMeta_RegisterPropertyTraits_1 WXMPMeta_RegisterStandardAliases_1 WXMPMeta_ResolveAlias_1 WXMPMeta_SendAssertNotify_1 WXMPMeta_SerializeToBuffer_1 WXMPMeta_SetArrayItem_1 WXMPMeta_SetGlobalOptions_1 WXMPMeta_SetLocalizedText_1 WXMPMeta_SetObjectName_1 WXMPMeta_SetObjectOptions_1 WXMPMeta_SetProperty_1 WXMPMeta_SetProperty_Bool_1 WXMPMeta_SetProperty_Date_1 WXMPMeta_SetProperty_Float_1 WXMPMeta_SetProperty_Int64_1 WXMPMeta_SetProperty_Int_1 WXMPMeta_SetQualifier_1 WXMPMeta_SetStructField_1 WXMPMeta_Terminate_1 WXMPMeta_UnlockObject_1 WXMPMeta_Unlock_1 WXMPMeta_UnregisterAssertNotify_1 WXMPUtils_AddEmbeddedDocument_1 WXMPUtils_AppendProperties_1 WXMPUtils_CatenateArrayItems_1 WXMPUtils_ClearManifest_1 WXMPUtils_CollectMultiFileXMP_1 WXMPUtils_CompareDateTime_1 WXMPUtils_ComposeArrayItemPath_1 WXMPUtils_ComposeFieldSelector_1 WXMPUtils_ComposeLangSelector_1 WXMPUtils_ComposeQualifierPath_1 WXMPUtils_ComposeStructFieldPath_1 WXMPUtils_ConvertFromBool_1 WXMPUtils_ConvertFromDate_1 WXMPUtils_ConvertFromFloat_1 WXMPUtils_ConvertFromInt64_1 WXMPUtils_ConvertFromInt_1 WXMPUtils_ConvertToBool_1 WXMPUtils_ConvertToDate_1 WXMPUtils_ConvertToFloat_1 WXMPUtils_ConvertToInt64_1 WXMPUtils_ConvertToInt_1 WXMPUtils_ConvertToLocalTime_1 WXMPUtils_ConvertToUTCTime_1 WXMPUtils_CurrentDateTime_1 WXMPUtils_DecodeFromBase64_1 WXMPUtils_DistributeMultiFileXMP_1 WXMPUtils_DuplicateSubtree_1 WXMPUtils_EncodeToBase64_1 WXMPUtils_GetDateRange_1 WXMPUtils_GetMergedListPath_1 WXMPUtils_HasContainedDoc_1 WXMPUtils_InitializeDerivedDocument_1 WXMPUtils_InitializeNewDocument_1 WXMPUtils_IsPropertyMultiValued_1 WXMPUtils_MergeFromJPEG_1 WXMPUtils_OpenWorkingDocument_1 WXMPUtils_PackageForJPEG_1 WXMPUtils_RemoveEmbeddedDocument_1 WXMPUtils_RemoveMultiValueInfo_1 WXMPUtils_RemoveProperties_1 WXMPUtils_SaveWorkingDocument_1 WXMPUtils_SeparateArrayItems_1 WXMPUtils_SetAppName_1 WXMPUtils_SetMIMEMapping_1 WXMPUtils_SetTimeZone_1 WXMPUtils_UnlockIter_1 WXMPUtils_Unlock_1 WXMPUtils_UpdateEmbeddedDocument_1

Name

.text

Size

276KB

Virtual Size

273KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

68KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

13KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

20KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.text

Size

168KB

Virtual Size

168KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

b64611d1dc24557468045da4200d7b23ac65a9a7b82cc00a0e00b548acb1147dN

kernel32

generic