df7e87baa56e08ae6e7c963c8c3deeb03c7c9930427e9ca96f752d3f02baba97

General

Target
df7e87baa56e08ae6e7c963c8c3deeb03c7c9930427e9ca96f752d3f02baba97
Size 423KB
Sample241108-ea62gaxlhm
SHA256 df7e87baa56e08ae6e7c963c8c3deeb03c7c9930427e9ca96f752d3f02baba97
MD5 2b83fdf849a15357e085376003f65a3a
SHA1 e0614c7fdd80b4df3f21d29c5183135099e234b3
SHA512 92b6f1f86cf699cfb999e425d2187c4e20c17cc0ef7d1f79052d5216cd0b7a4ea249a2f1be28c7fc47dc315a2d706ac804c026ba9428653528bb18b826b71a8f
SSDEEP 6144:XQ5ARa6ocV7kZpW6LX3Y0BxY3e2zGM/4MYmrgkN+k0DLltf3qefeh:XQORZhkZ8w3FBx2aVMYmrgkN+kgtf3
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
df7e87baa56e08ae6e7c963c8c3deeb03c7c9930427e9ca96f752d3f02baba97

File Explorer

df7e87baa56e08ae6e7c963c8c3deeb03c7c9930427e9ca96f752d3f02baba97

.exe 423KB

df7e87baa56e08ae6e7c963c8c3deeb03c7c9930427e9ca96f752d3f02baba97

IMPHASH 5da563873972430c247e0379344310f5
SHA256 df7e87baa56e08ae6e7c963c8c3deeb03c7c9930427e9ca96f752d3f02baba97
MD5 2b83fdf849a15357e085376003f65a3a
SHA1 e0614c7fdd80b4df3f21d29c5183135099e234b3
SHA512 92b6f1f86cf699cfb999e425d2187c4e20c17cc0ef7d1f79052d5216cd0b7a4ea249a2f1be28c7fc47dc315a2d706ac804c026ba9428653528bb18b826b71a8f
SSDEEP 6144:XQ5ARa6ocV7kZpW6LX3Y0BxY3e2zGM/4MYmrgkN+k0DLltf3qefeh:XQORZhkZ8w3FBx2aVMYmrgkN+kgtf3
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

214496

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\mupegut\gotu.pdb

kernel32

ExitProcess GetComputerNameA GetFullPathNameA LocalUnlock EnumResourceNamesW UnregisterWait CreateTimerQueue FindResourceA FindFirstFileW SetThreadContext FindFirstChangeNotificationW SetFilePointer TryEnterCriticalSection EnumDateFormatsExW CopyFileExW GetNumaProcessorNode TlsGetValue GetStringTypeA SetLocalTime UnmapViewOfFile MoveFileExA CommConfigDialogA BuildCommDCBAndTimeoutsA SetUnhandledExceptionFilter GlobalAddAtomA InterlockedIncrement MoveFileExW GetCommState WritePrivateProfileSectionA SetDefaultCommConfigW SetFirmwareEnvironmentVariableA CreateJobObjectW QueryDosDeviceA GetNamedPipeHandleStateA GlobalLock WriteConsoleInputA SetVolumeMountPointW GetComputerNameW SetThreadExecutionState SleepEx FreeEnvironmentStringsA _lclose OutputDebugStringW GetCommConfig GetPrivateProfileStringW CreateRemoteThread GetCompressedFileSizeW WaitNamedPipeW EnumTimeFormatsA GetSystemWow64DirectoryA WriteFileGather TzSpecificLocalTimeToSystemTime TlsSetValue AllocateUserPhysicalPages FindResourceExA GetConsoleCP GetPrivateProfileIntA LoadLibraryW GetConsoleMode GetThreadSelectorEntry CopyFileW GetPrivateProfileStructW GetCalendarInfoA SetSystemTimeAdjustment GetProcessHandleCount GetSystemWindowsDirectoryA ReadConsoleOutputW GetConsoleAliasExesLengthW GetSystemTimeAdjustment GetVersionExW SetConsoleCP DeleteVolumeMountPointW InterlockedPopEntrySList LeaveCriticalSection GetFileAttributesA lstrcpynW SetDllDirectoryA SetConsoleMode HeapValidate GetVolumePathNamesForVolumeNameW SetConsoleCursorPosition VerifyVersionInfoA GetBinaryTypeA IsBadWritePtr TerminateProcess GetModuleFileNameW CreateActCtxA GetBinaryTypeW lstrcmpW lstrlenW IsBadStringPtrA GetTempPathW VerifyVersionInfoW InterlockedExchange SetCurrentDirectoryA FindFirstFileA GetCPInfoExW OpenMutexW GetLastError GetLongPathNameW SetLastError GetProcAddress GetProcessHeaps VirtualAlloc HeapSize PeekConsoleInputW BackupWrite CreateNamedPipeA EnumDateFormatsExA CreateTimerQueueTimer CreateJobSet LocalLock SetStdHandle EnterCriticalSection VerLanguageNameW SearchPathA BuildCommDCBW DefineDosDeviceA GetPrivateProfileStringA ResetEvent GetAtomNameA OpenMutexA CreateSemaphoreW LocalAlloc WritePrivateProfileStringA CreateHardLinkW GetExitCodeThread GetNumberFormatW SetCurrentDirectoryW SetFileApisToANSI VirtualLock GetCurrentConsoleFont HeapWalk GetPrivateProfileStructA SetSystemTime SetEnvironmentVariableA GetVolumePathNamesForVolumeNameA GetModuleFileNameA GetPrivateProfileSectionNamesA GetDefaultCommConfigA FindNextFileA WriteProfileStringA WTSGetActiveConsoleSessionId EnumDateFormatsA GlobalUnWire CreateIoCompletionPort SetConsoleTitleW GetModuleHandleA ContinueDebugEvent lstrcatW HeapSetInformation FatalExit FreeEnvironmentStringsW GetConsoleTitleW RequestWakeupLatency EnumDateFormatsW CompareStringA GetFileAttributesExW GetConsoleCursorInfo FatalAppExitA WriteConsoleOutputAttribute OutputDebugStringA DuplicateHandle SetProcessShutdownParameters OpenSemaphoreW FindFirstVolumeA TerminateJobObject DeleteTimerQueueTimer DeleteFileW GetCurrentProcessId SetFileValidData FindActCtxSectionStringW ResetWriteWatch UnregisterWaitEx EnumSystemLocalesW CopyFileExA lstrcpyA MoveFileA DeleteFileA EncodePointer DecodePointer GetCommandLineW GetStartupInfoW InterlockedDecrement GetModuleHandleW GetCurrentProcess UnhandledExceptionFilter IsDebuggerPresent WriteFile GetStdHandle IsBadReadPtr TlsAlloc GetCurrentThreadId TlsFree SetHandleCount InitializeCriticalSectionAndSpinCount GetFileType DeleteCriticalSection QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime GetEnvironmentStringsW HeapCreate GetACP GetOEMCP GetCPInfo IsValidCodePage RtlUnwind HeapAlloc HeapReAlloc HeapQueryInformation HeapFree WideCharToMultiByte WriteConsoleW LCMapStringW MultiByteToWideChar GetStringTypeW IsProcessorFeaturePresent FlushFileBuffers RaiseException CloseHandle CreateFileW

Sharing

General

Malware Config

Signatures

File Explorer

df7e87baa56e08ae6e7c963c8c3deeb03c7c9930427e9ca96f752d3f02baba97

kernel32

generic