486e9ef2abf7cbeb06c7a2aa9664b8acf139eef4d4e6a9dee596ff98426a60f7

Sharing

Copy URL Twitter E-mail

General

Target
486e9ef2abf7cbeb06c7a2aa9664b8acf139eef4d4e6a9dee596ff98426a60f7
Size 2.0MB
Sample241108-n5rdyasarr
SHA256 486e9ef2abf7cbeb06c7a2aa9664b8acf139eef4d4e6a9dee596ff98426a60f7
MD5 44abe4d73380279d87ad9d55f3191130
SHA1 5d09ebc70512eb16d97f52470cc7fe01fc570a51
SHA512 f43b8a7534f73017df2aeb4c7ec844499b5215f14cc60102bd68966ca05b7b12b4798ca761281a98398e0a6bfc31071d04a4211cf93c5bda4aef26f843e98f20
SSDEEP 24576:wBxcqhG/e37rZ83+zdToZJoAOM08/85RkptVIJqoSkQ/7Gb8NLEbeZ:wQi7tbYOMjUfkptVxBkQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
486e9ef2abf7cbeb06c7a2aa9664b8acf139eef4d4e6a9dee596ff98426a60f7

File Explorer

486e9ef2abf7cbeb06c7a2aa9664b8acf139eef4d4e6a9dee596ff98426a60f7

.exe 2.0MB

486e9ef2abf7cbeb06c7a2aa9664b8acf139eef4d4e6a9dee596ff98426a60f7

IMPHASH 8b4f04d2d9e704a8f296770909ee197e
SHA256 486e9ef2abf7cbeb06c7a2aa9664b8acf139eef4d4e6a9dee596ff98426a60f7
MD5 44abe4d73380279d87ad9d55f3191130
SHA1 5d09ebc70512eb16d97f52470cc7fe01fc570a51
SHA512 f43b8a7534f73017df2aeb4c7ec844499b5215f14cc60102bd68966ca05b7b12b4798ca761281a98398e0a6bfc31071d04a4211cf93c5bda4aef26f843e98f20
SSDEEP 24576:wBxcqhG/e37rZ83+zdToZJoAOM08/85RkptVIJqoSkQ/7Gb8NLEbeZ:wQi7tbYOMjUfkptVxBkQ/qoLEw
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

263932

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

ole32

StringFromGUID2 IIDFromString

shell32

SHGetFolderPathW CommandLineToArgvW

user32

MessageBoxW

kernel32

FindClose GetFileAttributesA CloseHandle SetLastError GetCommandLineW GetTempPathA GetCurrentProcess GetSystemDirectoryA GetNativeSystemInfo GetModuleFileNameA GetModuleHandleExW LocalFree Sleep GetCurrentProcessId GetCurrentThreadId GetLocalTime FormatMessageW ReadFile PeekNamedPipe WaitForSingleObject TerminateProcess GetExitCodeProcess CreateProcessA GetProcessId WideCharToMultiByte GetModuleHandleExA FreeLibrary GetProcAddress LoadLibraryW LoadLibraryExW OpenMutexA OpenProcess LoadResource LockResource SizeofResource FindResourceA QueryPerformanceCounter QueryPerformanceFrequency CreateFileW SetFilePointerEx InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetStringTypeW InitializeCriticalSectionEx EncodePointer LCMapStringEx GetCPInfo IsDebuggerPresent OutputDebugStringW RaiseException TlsAlloc DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetLastError DecodePointer GetUserDefaultLCID EnumSystemLocalesW FlushFileBuffers GetFileSizeEx ReadConsoleW GetCurrentDirectoryW HeapReAlloc GetTimeZoneInformation HeapSize FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetProcessHeap TlsGetValue TlsSetValue TlsFree RtlUnwind MultiByteToWideChar RtlUnwindEx RtlPcToFileHeader InitializeSListHead IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW FlsFree FlsSetValue FlsGetValue FlsAlloc HeapAlloc HeapFree ExitProcess SetStdHandle CreateDirectoryW GetFullPathNameW WriteConsoleW GetModuleFileNameW GetStdHandle GetConsoleMode GetConsoleOutputCP WriteFile SetEndOfFile FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetFileType GetFileInformationByHandle RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetStartupInfoW GetModuleHandleW GetSystemTimeAsFileTime GetDriveTypeW

advapi32

ConvertStringSecurityDescriptorToSecurityDescriptorW RegQueryValueExA RegOpenKeyExA RegCreateKeyExA RegCloseKey CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextA

version

GetFileVersionInfoSizeA VerQueryValueW GetFileVersionInfoA

msi

ord137 ord8 ord67 ord91 ord189 ord204 ord115 ord117 ord31 ord159 ord160 ord168 ord44 ord141

Name

.text

Size

446KB

Virtual Size

446KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

154KB

Virtual Size

153KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

22KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

348B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

800KB

Virtual Size

799KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

568KB

Virtual Size

572KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

486e9ef2abf7cbeb06c7a2aa9664b8acf139eef4d4e6a9dee596ff98426a60f7

ole32

shell32

user32

kernel32

advapi32

version

msi

generic