66b31963441dfc8fbd770c1cfaa2e328c176db05d9bd2f3013dee3a0d272b09a

Sharing

Copy URL Twitter E-mail

General

Target
66b31963441dfc8fbd770c1cfaa2e328c176db05d9bd2f3013dee3a0d272b09a
Size 2.0MB
Sample241021-tphprayekb
SHA256 66b31963441dfc8fbd770c1cfaa2e328c176db05d9bd2f3013dee3a0d272b09a
MD5 b0740b9e07131f253a14350e896c9946
SHA1 d25b4a0c1eee9bf4811a8540df2312378d808326
SHA512 066ba41fb572e2b1eb173130908b1ac8f0d68efaa6ee21ad40731592c287e23a856ff426b81fc2c5008e56fd4e12ef5d6d230bd863dc6b46d7b0137238cf0dc8
SSDEEP 49152:wgi7tbYOMjUfkptVxhxlMPdlR8v4UC0Eg6ET7M/I:wd7tMjUu5zl2/V0cETQ/I
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
66b31963441dfc8fbd770c1cfaa2e328c176db05d9bd2f3013dee3a0d272b09a

File Explorer

66b31963441dfc8fbd770c1cfaa2e328c176db05d9bd2f3013dee3a0d272b09a

.exe 2.0MB

66b31963441dfc8fbd770c1cfaa2e328c176db05d9bd2f3013dee3a0d272b09a

IMPHASH 8b4f04d2d9e704a8f296770909ee197e
SHA256 66b31963441dfc8fbd770c1cfaa2e328c176db05d9bd2f3013dee3a0d272b09a
MD5 b0740b9e07131f253a14350e896c9946
SHA1 d25b4a0c1eee9bf4811a8540df2312378d808326
SHA512 066ba41fb572e2b1eb173130908b1ac8f0d68efaa6ee21ad40731592c287e23a856ff426b81fc2c5008e56fd4e12ef5d6d230bd863dc6b46d7b0137238cf0dc8
SSDEEP 49152:wgi7tbYOMjUfkptVxhxlMPdlR8v4UC0Eg6ET7M/I:wd7tMjUu5zl2/V0cETQ/I
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

263932

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ole32

StringFromGUID2 IIDFromString

shell32

SHGetFolderPathW CommandLineToArgvW

user32

MessageBoxW

kernel32

FindClose GetFileAttributesA CloseHandle SetLastError GetCommandLineW GetTempPathA GetCurrentProcess GetSystemDirectoryA GetNativeSystemInfo GetModuleFileNameA GetModuleHandleExW LocalFree Sleep GetCurrentProcessId GetCurrentThreadId GetLocalTime FormatMessageW ReadFile PeekNamedPipe WaitForSingleObject TerminateProcess GetExitCodeProcess CreateProcessA GetProcessId WideCharToMultiByte GetModuleHandleExA FreeLibrary GetProcAddress LoadLibraryW LoadLibraryExW OpenMutexA OpenProcess LoadResource LockResource SizeofResource FindResourceA QueryPerformanceCounter QueryPerformanceFrequency CreateFileW SetFilePointerEx InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetStringTypeW InitializeCriticalSectionEx EncodePointer LCMapStringEx GetCPInfo IsDebuggerPresent OutputDebugStringW RaiseException TlsAlloc DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetLastError DecodePointer GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetFileSizeEx ReadConsoleW GetCurrentDirectoryW HeapReAlloc GetTimeZoneInformation HeapSize FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap TlsGetValue TlsSetValue TlsFree RtlUnwind MultiByteToWideChar RtlUnwindEx RtlPcToFileHeader InitializeSListHead IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW FlsFree FlsSetValue FlsGetValue FlsAlloc HeapAlloc HeapFree ExitProcess SetStdHandle CreateDirectoryW GetFullPathNameW WriteConsoleW GetModuleFileNameW GetStdHandle GetConsoleMode GetConsoleOutputCP WriteFile SetEndOfFile FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetFileType GetFileInformationByHandle RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW GetModuleHandleW GetSystemTimeAsFileTime GetDriveTypeW

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW RegQueryValueExA RegOpenKeyExA RegCreateKeyExA RegCloseKey CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextA

version

GetFileVersionInfoSizeA VerQueryValueW GetFileVersionInfoA

msi

ord137 ord8 ord67 ord91 ord189 ord204 ord115 ord117 ord31 ord159 ord160 ord168 ord44 ord141

Name

.text

Size

446KB

Virtual Size

446KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

154KB

Virtual Size

153KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

800KB

Virtual Size

799KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

66b31963441dfc8fbd770c1cfaa2e328c176db05d9bd2f3013dee3a0d272b09a

ole32

shell32

user32

kernel32

advapi32

version

msi

generic