6f5fe2a8785d236ff161521a3758658be6dbc9da9808e11233b4e9209ce60985

General

Target
6f5fe2a8785d236ff161521a3758658be6dbc9da9808e11233b4e9209ce60985
Size 241KB
Sample241109-164rwatdlf
SHA256 6f5fe2a8785d236ff161521a3758658be6dbc9da9808e11233b4e9209ce60985
MD5 574cd5829756306a50ab1798c76127ef
SHA1 d5cc621f0e81f15e3b2907c539d1789ef04c4546
SHA512 5f80a46e1e7923956a2b088067f36756a938a5784cce9c2afe8e31b6af22a3cfd462bc760e3cf9a643e48a1932808d9d288dcca77057910af6150da76b36c115
SSDEEP 6144:B7FLBInmeyZvG1mrZuNOS5PJGMGhQ+BxMPax3:JBsByZvG8k/GhQ1PE
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/feb87f71e1a8522ec1c77710ab9d6d70b3a5f4713911c4c870d0d9699e444421.exe

File Explorer

6f5fe2a8785d236ff161521a3758658be6dbc9da9808e11233b4e9209ce60985

.zip 241KB
feb87f71e1a8522ec1c77710ab9d6d70b3a5f4713911c4c870d0d9699e444421.exe

.exe 388KB

6f5fe2a8785d236ff161521a3758658be6dbc9da9808e11233b4e9209ce60985

SHA256 6f5fe2a8785d236ff161521a3758658be6dbc9da9808e11233b4e9209ce60985
MD5 574cd5829756306a50ab1798c76127ef
SHA1 d5cc621f0e81f15e3b2907c539d1789ef04c4546
SHA512 5f80a46e1e7923956a2b088067f36756a938a5784cce9c2afe8e31b6af22a3cfd462bc760e3cf9a643e48a1932808d9d288dcca77057910af6150da76b36c115
SSDEEP 6144:B7FLBInmeyZvG1mrZuNOS5PJGMGhQ+BxMPax3:JBsByZvG8k/GhQ1PE
MD5 SHA1 SHA512 SSDEEP

Password

infected

feb87f71e1a8522ec1c77710ab9d6d70b3a5f4713911c4c870d0d9699e444421.exe

IMPHASH 158a612a52d4365bdc88fe279a20e1a3
SHA256 feb87f71e1a8522ec1c77710ab9d6d70b3a5f4713911c4c870d0d9699e444421
MD5 fdb1079f281cfde3d9984167331a6919
SHA1 d29500d4d712dd5e28e13086ea82ccdf697aa75a
SHA512 dd40452d7e0a02274d22ff05855ddd989cc37c5d2829010f8221ff2064f8aba759ccc37689236e18dd59807b95bc535922ab742520bffef6f3f9ce956150a3bf
SSDEEP 6144:oR1LHvkRMOB2222pAikkVELsTAVJTfvP8LWTSN6ApVS8vA:oR1LMRMOB2xIzV6s0f3PyWTe6ApVHA
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

30464

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\gif.pdb

kernel32

LoadLibraryA CreateSemaphoreW RequestWakeupLatency AddAtomA CreateFileA FindActCtxSectionStringA WriteConsoleInputW GetSystemWindowsDirectoryA WriteFile FindFirstVolumeMountPointW CreateDirectoryExW GlobalSize GetLogicalDriveStringsW ReadConsoleInputW GetComputerNameExA FreeUserPhysicalPages GetCurrentDirectoryA ContinueDebugEvent LCMapStringA GetProcAddress GlobalAlloc GetCommandLineW GetBinaryTypeW InterlockedExchange ReadConsoleOutputCharacterW CreateMutexA GetConsoleTitleA SearchPathA FindResourceW FormatMessageW GetModuleHandleA EndUpdateResourceW GetLastError SetCommMask LocalReAlloc GetConsoleAliasA GetConsoleTitleW GlobalFlags GetConsoleAliasesLengthA GetVolumePathNameW SetVolumeMountPointW HeapAlloc GetLocaleInfoA GetComputerNameW GetCurrentProcessId DosDateTimeToFileTime EnumResourceLanguagesW LoadModule _hwrite QueryDosDeviceW CreateActCtxA DeleteVolumeMountPointA MoveFileWithProgressW AddRefActCtx WritePrivateProfileStringA GetUserDefaultLangID QueryMemoryResourceNotification WaitForSingleObject GetLongPathNameW InterlockedCompareExchange EnumTimeFormatsW VerifyVersionInfoW EnumCalendarInfoW FindNextFileW SetLastError TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RaiseException RtlUnwind HeapFree MoveFileA GetStartupInfoW GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement GetCurrentThreadId InterlockedDecrement GetCPInfo GetACP GetOEMCP IsValidCodePage HeapCreate VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc Sleep ExitProcess GetStdHandle GetModuleFileNameA GetModuleFileNameW FreeEnvironmentStringsW GetEnvironmentStringsW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetTickCount GetSystemTimeAsFileTime HeapSize WideCharToMultiByte MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW InitializeCriticalSectionAndSpinCount GetConsoleCP GetConsoleMode FlushFileBuffers SetFilePointer CloseHandle WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle DeleteFileA

user32

GetMenuBarInfo

Sharing

General

Malware Config

Signatures

File Explorer

6f5fe2a8785d236ff161521a3758658be6dbc9da9808e11233b4e9209ce60985

feb87f71e1a8522ec1c77710ab9d6d70b3a5f4713911c4c870d0d9699e444421.exe

kernel32

user32

generic