a36348cc45b8973a15d160062c72c4abcda1b297bbf44c0668f1bfbf13a7e353

General

Target
a36348cc45b8973a15d160062c72c4abcda1b297bbf44c0668f1bfbf13a7e353
Size 179KB
Sample241107-dn7pgsvbrm
SHA256 a36348cc45b8973a15d160062c72c4abcda1b297bbf44c0668f1bfbf13a7e353
MD5 caff2252260116aba6ef3bc10fc5c04c
SHA1 388d47ca631f454828dfecad46e0a060c0106eff
SHA512 51f91ca0d2569a32fb703603214291a934a3c4eaeba8279f8ee49ba1f9ae73081601980fa7013e59a873d10d9deeecaef585add9714227e5185fd7fa9f1a833e
SSDEEP 3072:SaCPIvPKxMhLHjmSkujNX+tBHNrM+BNwfgZTjjUnxNo2ErvWrxpzbgqru:WPIaxM5jquj0tBHNrMS9RGr1uuzbgwu
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a36348cc45b8973a15d160062c72c4abcda1b297bbf44c0668f1bfbf13a7e353

File Explorer

a36348cc45b8973a15d160062c72c4abcda1b297bbf44c0668f1bfbf13a7e353

.exe 179KB

a36348cc45b8973a15d160062c72c4abcda1b297bbf44c0668f1bfbf13a7e353

IMPHASH c0df013463ae9c6441312a1218343a59
SHA256 a36348cc45b8973a15d160062c72c4abcda1b297bbf44c0668f1bfbf13a7e353
MD5 caff2252260116aba6ef3bc10fc5c04c
SHA1 388d47ca631f454828dfecad46e0a060c0106eff
SHA512 51f91ca0d2569a32fb703603214291a934a3c4eaeba8279f8ee49ba1f9ae73081601980fa7013e59a873d10d9deeecaef585add9714227e5185fd7fa9f1a833e
SSDEEP 3072:SaCPIvPKxMhLHjmSkujNX+tBHNrM+BNwfgZTjjUnxNo2ErvWrxpzbgqru:WPIaxM5jquj0tBHNrMS9RGr1uuzbgwu
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

10396

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\xodopu\surewucone5-liyahobe_28.pdb

kernel32

FindVolumeClose HeapAlloc LoadLibraryExW EndUpdateResourceW HeapFree GetEnvironmentStringsW SetConsoleScreenBufferSize SetEvent OpenSemaphoreA GetTickCount GetProcessHeap FindActCtxSectionStringA SetCommTimeouts CreateActCtxW Sleep GetAtomNameW GetMailslotInfo GetModuleFileNameW GetConsoleOutputCP GetCPInfoExW GetProcAddress VirtualAlloc LoadLibraryA WriteConsoleA LocalAlloc BeginUpdateResourceA SetEnvironmentVariableA EraseTape GetProcessAffinityMask Module32Next DeleteAtom FindNextVolumeA LCMapStringW lstrcpyA EncodePointer DecodePointer GetCommandLineA HeapSetInformation GetStartupInfoW RaiseException UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent TerminateProcess GetCurrentProcess GetLastError IsProcessorFeaturePresent TlsAlloc TlsGetValue TlsSetValue TlsFree InterlockedIncrement GetModuleHandleW SetLastError GetCurrentThreadId InterlockedDecrement WideCharToMultiByte SetHandleCount GetStdHandle InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection EnterCriticalSection LeaveCriticalSection ReadFile RtlUnwind SetFilePointer CloseHandle ExitProcess WriteFile GetModuleFileNameA FreeEnvironmentStringsW HeapCreate QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime GetConsoleCP GetConsoleMode GetCPInfo GetACP GetOEMCP IsValidCodePage MultiByteToWideChar CreateFileA SetStdHandle FlushFileBuffers HeapSize LoadLibraryW WriteConsoleW GetStringTypeW HeapReAlloc SetEndOfFile CreateFileW

Sharing

General

Malware Config

Signatures

File Explorer

a36348cc45b8973a15d160062c72c4abcda1b297bbf44c0668f1bfbf13a7e353

kernel32

generic