57ae49e4d308ac50d1b5387ebc360ef1b56e759fe6307b89ef4c3cae56bc5e9b

General

Target
57ae49e4d308ac50d1b5387ebc360ef1b56e759fe6307b89ef4c3cae56bc5e9b
Size 407KB
Sample241107-dp72mstkaw
SHA256 57ae49e4d308ac50d1b5387ebc360ef1b56e759fe6307b89ef4c3cae56bc5e9b
MD5 d580bf652eb4024d6208731f482546a3
SHA1 e732648e5d54f07ac9ebb7fa4f02f1e99949a37b
SHA512 32f36c3282fd6b7f1f3b81d3be3a131e84a82a6391a1c39ab5d7aae72ba83f2c26629972a0be3671f3e75a741c7699df2f95dbe04020dff3806df9dc18211939
SSDEEP 6144:tiiP+ODzH42IiXhTAoUFrpwcjIvS5IBaMw4qZb+s194Q:tiiP+ODzH42IiXhTA0eIBaMRc+s1
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
57ae49e4d308ac50d1b5387ebc360ef1b56e759fe6307b89ef4c3cae56bc5e9b

File Explorer

57ae49e4d308ac50d1b5387ebc360ef1b56e759fe6307b89ef4c3cae56bc5e9b

.exe 407KB

57ae49e4d308ac50d1b5387ebc360ef1b56e759fe6307b89ef4c3cae56bc5e9b

IMPHASH af44a736a4a4f0f9c9631d1a8f0018a5
SHA256 57ae49e4d308ac50d1b5387ebc360ef1b56e759fe6307b89ef4c3cae56bc5e9b
MD5 d580bf652eb4024d6208731f482546a3
SHA1 e732648e5d54f07ac9ebb7fa4f02f1e99949a37b
SHA512 32f36c3282fd6b7f1f3b81d3be3a131e84a82a6391a1c39ab5d7aae72ba83f2c26629972a0be3671f3e75a741c7699df2f95dbe04020dff3806df9dc18211939
SSDEEP 6144:tiiP+ODzH42IiXhTAoUFrpwcjIvS5IBaMw4qZb+s194Q:tiiP+ODzH42IiXhTA0eIBaMRc+s1
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

5424

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

VirtualAlloc EnumUILanguagesW CreateFileW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter SetUnhandledExceptionFilter GetStartupInfoW IsProcessorFeaturePresent GetModuleHandleW GetCurrentProcess TerminateProcess RtlUnwindEx GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetStdHandle WriteFile GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW HeapAlloc HeapSize HeapValidate GetSystemInfo FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetFileType OutputDebugStringW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetStringTypeW GetProcessHeap HeapFree HeapReAlloc HeapQueryInformation WriteConsoleW FlushFileBuffers GetConsoleOutputCP GetConsoleMode GetFileSizeEx SetFilePointerEx CloseHandle

Name

.text

Size

282KB

Virtual Size

282KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

82KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gxfg

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gehcont

Size

512B

Virtual Size

20B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

57ae49e4d308ac50d1b5387ebc360ef1b56e759fe6307b89ef4c3cae56bc5e9b

kernel32

generic