2b7bdd0b8bde43d8e9d9a32352a408c5028e2a39c694be064a6ed18d0aa830e7

General

Target
2b7bdd0b8bde43d8e9d9a32352a408c5028e2a39c694be064a6ed18d0aa830e7
Size 869KB
Sample241031-zrdfpstemp
SHA256 2b7bdd0b8bde43d8e9d9a32352a408c5028e2a39c694be064a6ed18d0aa830e7
MD5 b61223f5063b9290cb7177e0915be648
SHA1 041b2958f50c016f1d2525848b2e0b3cefad1dc3
SHA512 d492e72bea3996df52eb0631c411e806a9130bc1bc2dea514247f0c834c3316473bbe751dfa6692355d035ee229cb8fe7e5df609af757963d9c4641c35eb589f
SSDEEP 24576:hQxvS/h/e8PZD/PrhkNcW2S4+f8nalYsefFzy:Ovch/pPZ7PrpFJagz
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2b7bdd0b8bde43d8e9d9a32352a408c5028e2a39c694be064a6ed18d0aa830e7

File Explorer

2b7bdd0b8bde43d8e9d9a32352a408c5028e2a39c694be064a6ed18d0aa830e7

.exe 869KB

2b7bdd0b8bde43d8e9d9a32352a408c5028e2a39c694be064a6ed18d0aa830e7

IMPHASH ef8bfa67cab8f52c3f5ca31f772f6178
SHA256 2b7bdd0b8bde43d8e9d9a32352a408c5028e2a39c694be064a6ed18d0aa830e7
MD5 b61223f5063b9290cb7177e0915be648
SHA1 041b2958f50c016f1d2525848b2e0b3cefad1dc3
SHA512 d492e72bea3996df52eb0631c411e806a9130bc1bc2dea514247f0c834c3316473bbe751dfa6692355d035ee229cb8fe7e5df609af757963d9c4641c35eb589f
SSDEEP 24576:hQxvS/h/e8PZD/PrhkNcW2S4+f8nalYsefFzy:Ovch/pPZ7PrpFJagz
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

8921

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

FindResourceA MapViewOfFile SystemTimeToTzSpecificLocalTime LoadLibraryExW GetModuleHandleExW GetTickCount WriteFile LoadLibraryW GetLocaleInfoW SetSystemTimeAdjustment GetFileAttributesA HeapCreate GetConsoleAliasW GetFileAttributesW TerminateProcess GetTimeZoneInformation lstrcatA RaiseException FreeLibraryAndExitThread GetLastError GetProcAddress OpenWaitableTimerA GetAtomNameA LoadLibraryA GetProcessId SetConsoleOutputCP GlobalFindAtomW SetConsoleCursorInfo GetFileTime FindAtomW FileTimeToLocalFileTime DeleteTimerQueueTimer SetEnvironmentVariableA CompareStringW GetCommandLineA GetStartupInfoA RtlUnwind GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent HeapAlloc HeapFree GetModuleHandleW Sleep ExitProcess GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement GetCurrentThread HeapDestroy VirtualFree QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection FatalAppExitA EnterCriticalSection VirtualAlloc HeapReAlloc HeapSize SetConsoleCtrlHandler FreeLibrary InterlockedExchange InitializeCriticalSectionAndSpinCount GetCPInfo GetACP GetOEMCP IsValidCodePage GetLocaleInfoA LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW GetTimeFormatA GetDateFormatA GetUserDefaultLCID EnumSystemLocalesA IsValidLocale CompareStringA GetModuleHandleA

user32

GetDesktopWindow

Name

.text

Size

709KB

Virtual Size

709KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

20KB

Virtual Size

89KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.new

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

110KB

Virtual Size

402KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2b7bdd0b8bde43d8e9d9a32352a408c5028e2a39c694be064a6ed18d0aa830e7

kernel32

user32

generic