17fdb55462b3a7e43678d3251711b056083bde9a961d4e1b88223975c32aa81b

General

Target
17fdb55462b3a7e43678d3251711b056083bde9a961d4e1b88223975c32aa81b
Size 293KB
Sample241110-vwegca1jft
SHA256 17fdb55462b3a7e43678d3251711b056083bde9a961d4e1b88223975c32aa81b
MD5 a80d7a56c38425a2ed50326b8be2e05f
SHA1 9138555eeea783c156ef5e56cafe330185fb99a8
SHA512 2d5607c1ea1a9b99db6736d0297d5d75d3dbd72b9bffdf318c7c399db7994cde0ee8428379ded39a0fb04a273b90ec4c77050ea6021bbad6f49a9cdb76acf0a5
SSDEEP 6144:CLaS0U0uK3XyxqmFnNfEkUM8M+ShuSz6abPuzbgwuvjB:CuS0Uqn+FGk/8Mfh5OWunn0
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
17fdb55462b3a7e43678d3251711b056083bde9a961d4e1b88223975c32aa81b

File Explorer

17fdb55462b3a7e43678d3251711b056083bde9a961d4e1b88223975c32aa81b

.exe 293KB

17fdb55462b3a7e43678d3251711b056083bde9a961d4e1b88223975c32aa81b

IMPHASH 085d4aa5e29579ffcd8f5171fcc76b83
SHA256 17fdb55462b3a7e43678d3251711b056083bde9a961d4e1b88223975c32aa81b
MD5 a80d7a56c38425a2ed50326b8be2e05f
SHA1 9138555eeea783c156ef5e56cafe330185fb99a8
SHA512 2d5607c1ea1a9b99db6736d0297d5d75d3dbd72b9bffdf318c7c399db7994cde0ee8428379ded39a0fb04a273b90ec4c77050ea6021bbad6f49a9cdb76acf0a5
SSDEEP 6144:CLaS0U0uK3XyxqmFnNfEkUM8M+ShuSz6abPuzbgwuvjB:CuS0Uqn+FGk/8Mfh5OWunn0
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

5

Entry point

10911

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\defaje 83\ceg27\nigerapo\piyeh\sezi_fepevedez\guvanetewag.pdb

kernel32

SetDefaultCommConfigA GetLocaleInfoA GetStringTypeA FindResourceExW ZombifyActCtx GetEnvironmentStringsW WaitForSingleObject WriteConsoleInputA SetVolumeMountPointW EnumCalendarInfoExW GetConsoleAliasesA TerminateThread GetProcessHandleCount GetVersionExW GetConsoleAliasW GetWriteWatch FileTimeToSystemTime ReplaceFileA DeleteFiber GetLastError GetProcAddress VirtualAlloc HeapSize GetComputerNameExW LoadLibraryA WriteConsoleA LocalAlloc GlobalAddAtomW MultiByteToWideChar UnhandledExceptionFilter SetUnhandledExceptionFilter HeapReAlloc HeapAlloc GetStartupInfoW RaiseException RtlUnwind TerminateProcess GetCurrentProcess IsDebuggerPresent HeapFree GetCPInfo InterlockedIncrement InterlockedDecrement GetACP GetOEMCP IsValidCodePage GetModuleHandleW TlsGetValue TlsAlloc TlsSetValue TlsFree SetLastError GetCurrentThreadId Sleep ExitProcess WriteFile GetStdHandle GetModuleFileNameA DeleteCriticalSection LeaveCriticalSection EnterCriticalSection HeapCreate VirtualFree GetModuleFileNameW FreeEnvironmentStringsW GetCommandLineW SetHandleCount GetFileType GetStartupInfoA QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LCMapStringA WideCharToMultiByte LCMapStringW GetStringTypeW InitializeCriticalSectionAndSpinCount GetModuleHandleA

winhttp

WinHttpSetOption

Sharing

General

Malware Config

Signatures

File Explorer

17fdb55462b3a7e43678d3251711b056083bde9a961d4e1b88223975c32aa81b

kernel32

winhttp

generic