ff03b0e46c9b1672bc761f8f761d0f74e678a9b60eb2bae762213a33aa1e58fbN

Sharing

Copy URL Twitter E-mail

General

Target
ff03b0e46c9b1672bc761f8f761d0f74e678a9b60eb2bae762213a33aa1e58fbN
Size 208KB
Sample241106-e15w4atnfs
SHA256 ff03b0e46c9b1672bc761f8f761d0f74e678a9b60eb2bae762213a33aa1e58fb
MD5 a82b20470d488e0b868a1f61e27a57f0
SHA1 0e8626114074d99af8a59275e15c3a19c60e7087
SHA512 7225160a549a731355b67deabbf1bd50ea74c7c194855b0b6a8bb301b94763f6422947ae947efc0af3fffbd55594f27cfbddec15c9c30d21226b39a3f5b46ac8
SSDEEP 6144:Ea1oB/yvpK0JCmRcRRR8N0e2kXfCqNidkfk:EbapK0JCmRcU9vVokf
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ff03b0e46c9b1672bc761f8f761d0f74e678a9b60eb2bae762213a33aa1e58fbN

File Explorer

ff03b0e46c9b1672bc761f8f761d0f74e678a9b60eb2bae762213a33aa1e58fbN

.exe 208KB

ff03b0e46c9b1672bc761f8f761d0f74e678a9b60eb2bae762213a33aa1e58fbN

IMPHASH e391eee2fda3671a828f8ce7165ca399
SHA256 ff03b0e46c9b1672bc761f8f761d0f74e678a9b60eb2bae762213a33aa1e58fb
MD5 a82b20470d488e0b868a1f61e27a57f0
SHA1 0e8626114074d99af8a59275e15c3a19c60e7087
SHA512 7225160a549a731355b67deabbf1bd50ea74c7c194855b0b6a8bb301b94763f6422947ae947efc0af3fffbd55594f27cfbddec15c9c30d21226b39a3f5b46ac8
SSDEEP 6144:Ea1oB/yvpK0JCmRcRRR8N0e2kXfCqNidkfk:EbapK0JCmRcU9vVokf
MD5 SHA1 SHA512 SSDEEP

windows:2 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

32178

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

SearchPathA GetModuleHandleW ConnectNamedPipe GetModuleFileNameA EnumTimeFormatsW SuspendThread GetWindowsDirectoryW GetPriorityClass lstrlen CreateThread GetSystemDefaultLangID FlushFileBuffers ReadDirectoryChangesW GetDateFormatA BeginUpdateResourceW FreeResource GetSystemDirectoryA CreateMutexW GetModuleFileNameW GetModuleHandleA LoadLibraryW FatalAppExitA SetLocaleInfoW GetProcessHeap GetDiskFreeSpaceA GetProcAddress FindResourceA GetOEMCP lstrcpyW GetThreadPriority GlobalGetAtomNameW MoveFileW CompareStringA LocalFree MultiByteToWideChar GetVersionExW GetACP

user32

LoadMenuIndirectA UnregisterClassW GetClassInfoExW RegisterClassA GetClassNameA LoadMenuW DefDlgProcW SetWindowRgn GetParent DialogBoxIndirectParamA LoadMenuA GetClassInfoW DrawTextW CreateDialogIndirectParamW wvsprintfA LoadCursorW EnumWindows DialogBoxIndirectParamW CharNextW FindWindowW GetDCEx GetSysColor GetMenuStringW GetTopWindow LoadBitmapA TrackPopupMenuEx AppendMenuW InsertMenuItemA GetWindowRect MessageBoxW SetActiveWindow EnumDesktopsA CreatePopupMenu FindWindowA MessageBoxIndirectW CreateAcceleratorTableW CharLowerA DeleteMenu GetForegroundWindow EnumDesktopWindows EnumDesktopsW CopyRect OpenClipboard GetDlgItemTextW GetWindowLongW GetMenuItemCount CheckDlgButton CreateAcceleratorTableA WaitForInputIdle DialogBoxParamW PostQuitMessage GetActiveWindow CreateCaret RegisterWindowMessageW GetClassNameW GetMenuItemInfoA EndMenu WinHelpA SetCapture SetTimer CreateMenu CreateDialogParamA SendDlgItemMessageA LoadCursorA DefWindowProcW EnumDesktopsA SetMenu

gdi32

GetBrushOrgEx StrokeAndFillPath CreateFontW GetEnhMetaFilePixelFormat GetPixel GetViewportOrgEx CreateDCA CopyMetaFileW AbortPath RemoveFontResourceA GetKerningPairsA EnumFontFamiliesExW AddFontResourceW Rectangle GetDeviceGammaRamp PolyPolygon RectInRegion GetGlyphIndicesA CreatePolygonRgn SetColorSpace SetMetaFileBitsEx CreateBitmap OffsetRgn EndDoc CreateDIBPatternBrush PlayEnhMetaFile RestoreDC GetCharWidth32W PaintRgn StartFormPage

advapi32

RegDeleteKeyW RegOpenKeyA RegQueryMultipleValuesW RegEnumValueW RegSetValueA RegEnumKeyExA RegCreateKeyExA RegRestoreKeyW RegCloseKey RegEnumKeyA RegEnumKeyW RegDeleteValueA RegQueryValueW RegReplaceKeyW RegFlushKey CryptSetProviderA RegOpenKeyW RegEnumValueA

shell32

ExtractIconExA

comctl32

ImageList_SetImageCount ImageList_Duplicate FlatSB_EnableScrollBar DllGetVersion ImageList_SetBkColor InitCommonControls ImageList_GetBkColor

comdlg32

FindTextA LoadAlterBitmap ReplaceTextW GetFileTitleW GetSaveFileNameW ReplaceTextA

oleaut32

VarR8FromDisp VarUI1FromStr VarDateFromUI8 OleLoadPictureFile VarUI1FromDisp VarUI8FromCy

wininet

GopherGetLocatorTypeA ShowCertificate HttpQueryInfoA SetUrlCacheHeaderData FindFirstUrlCacheContainerA GetUrlCacheEntryInfoA FindNextUrlCacheContainerA DeleteUrlCacheEntry InternetGetConnectedState GetUrlCacheConfigInfoW InternetConfirmZoneCrossing InternetGetConnectedStateEx InternetCreateUrlA CreateUrlCacheEntryA InternetSetPerSiteCookieDecisionW InternetSetOptionW RetrieveUrlCacheEntryFileW FindCloseUrlCache UrlZonesDetach

urlmon

IsValidURL CoInternetCreateSecurityManager URLDownloadToCacheFileW Extract MkParseDisplayNameEx GetMarkOfTheWeb CopyStgMedium HlinkNavigateMoniker

wsock32

GetAddressByNameA GetAddressByNameW s_perror WSAAsyncGetProtoByNumber socket WSAAsyncGetHostByName send AcceptEx shutdown

crypt32

CertFreeCRLContext CertGetIntendedKeyUsage CertGetNameStringW PFXExportCertStoreEx CryptVerifyMessageHash CertGetIssuerCertificateFromStore I_CryptEnableLruOfEntries I_CryptGetAsn1Decoder CertEnumSystemStoreLocation I_CryptSetTls

Name

.ehkoKk

Size

2KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.WbOYt

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.jVQpnF

Size

1KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.MAgzG

Size

109KB

Virtual Size

217KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

6KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

64KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ff03b0e46c9b1672bc761f8f761d0f74e678a9b60eb2bae762213a33aa1e58fbN

kernel32

user32

gdi32

advapi32

shell32

comctl32

comdlg32

oleaut32

wininet

urlmon

wsock32

crypt32

generic