04c1ecaed917232ef3c8dfb885e8dda84d781d18[.]rl

General

Target
04c1ecaed917232ef3c8dfb885e8dda84d781d18.rl
Size 168KB
Sample241026-t45ststrds
SHA256 5dce0479f4adabaadf0faad5bf1478bb225787f3e1a7fc8d03495e0aed13b843
MD5 6643c64f29617b4e7cae474dc454431d
SHA1 04c1ecaed917232ef3c8dfb885e8dda84d781d18
SHA512 5c73d4a9567525679dcb64eb18134c61cc0f35572af711ba11e2abcbd4ff1bf987d3234057dbfb41796addcd07e87b425af21a6c6c52c692b4786936f85c39c8
SSDEEP 3072:0Rb8x8w8spF105inBx3mTvld6Cge4Nkz7RSx/iQ46oE6Tv:0Z8Ow8GFC5W3mTvWChzlS41R
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
04c1ecaed917232ef3c8dfb885e8dda84d781d18.rl

File Explorer

04c1ecaed917232ef3c8dfb885e8dda84d781d18.rl

.exe 168KB

04c1ecaed917232ef3c8dfb885e8dda84d781d18.rl

IMPHASH e79dd5d8d87cfe6cc9e05d3d783d694e
SHA256 5dce0479f4adabaadf0faad5bf1478bb225787f3e1a7fc8d03495e0aed13b843
MD5 6643c64f29617b4e7cae474dc454431d
SHA1 04c1ecaed917232ef3c8dfb885e8dda84d781d18
SHA512 5c73d4a9567525679dcb64eb18134c61cc0f35572af711ba11e2abcbd4ff1bf987d3234057dbfb41796addcd07e87b425af21a6c6c52c692b4786936f85c39c8
SSDEEP 3072:0Rb8x8w8spF105inBx3mTvld6Cge4Nkz7RSx/iQ46oE6Tv:0Z8Ow8GFC5W3mTvWChzlS41R
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

32240

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetCurrentProcess GetCurrentProcessId ExitProcess VirtualAlloc VirtualProtect ReadProcessMemory GetModuleFileNameA GetModuleHandleA GetProcAddress LoadResource SizeofResource FindResourceA Toolhelp32ReadProcessMemory GetModuleFileNameW FreeLibrary VirtualQuery GetProcessHeap HeapFree HeapAlloc GetLastError WideCharToMultiByte MultiByteToWideChar RaiseException GetStartupInfoW IsDebuggerPresent InitializeSListHead GetCurrentThreadId IsProcessorFeaturePresent TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter GetModuleHandleW GetSystemTimeAsFileTime DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection Sleep LoadLibraryExW QueryPerformanceFrequency QueryPerformanceCounter

ucrtbase

_get_thread_local_invalid_parameter_handler _get_invalid_parameter_handler terminate _controlfp_s _crt_atexit _register_onexit_function _initialize_onexit_table __p__commode _set_new_mode _configthreadlocale _register_thread_local_exe_atexit_callback _c_exit _cexit _set_fmode _exit exit _initterm_e _initterm _get_narrow_winmain_command_line _initialize_narrow_environment _configure_narrow_argv __setusermatherr _set_app_type _seh_filter_exe malloc _callnewh rand_s _unlock_locales _lock_locales _libm_sse2_sqrt_precise _libm_sse2_sin_precise _libm_sse2_cos_precise __stdio_common_vfprintf __acrt_iob_func free _except_handler4_common __current_exception_context _wmakepath_s _wsplitpath_s wcscpy_s __current_exception memset memmove __CxxFrameHandler3 _CxxThrowException __std_exception_destroy __std_exception_copy memcpy _invoke_watson

Sharing