dda43221ffe326ed76859afba2c8534a5eda8ea0a241b133e036e1b26a609d34

Sharing

Copy URL Twitter E-mail

General

Target
dda43221ffe326ed76859afba2c8534a5eda8ea0a241b133e036e1b26a609d34
Size 769KB
Sample241117-skea4asera
SHA256 dda43221ffe326ed76859afba2c8534a5eda8ea0a241b133e036e1b26a609d34
MD5 bd7c776f8d78efcbbd1b939d89ac8eea
SHA1 c89c3349cabe95d8ab5451f84fe8dfa387242b11
SHA512 cba7ff8ccceeea66dcbed1aaeceb7689403b973a67f06e5a2bb1ffa197ecc7cd92b69ff2540c1d554a988071694728d794074ddaae66969be9a213acdbd36cfe
SSDEEP 12288:z761GcLmnB+5JEpmxopBnS2B/bTNBFVFxRkwuSI8OKm59cF+GogeO0ngdEIlSaUu:z7KLmnsTEUo+IbhVFkv/34p6BSL
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
dda43221ffe326ed76859afba2c8534a5eda8ea0a241b133e036e1b26a609d34

File Explorer

dda43221ffe326ed76859afba2c8534a5eda8ea0a241b133e036e1b26a609d34

.exe 769KB

dda43221ffe326ed76859afba2c8534a5eda8ea0a241b133e036e1b26a609d34

IMPHASH 958c2a9b1453bda1d16ee4d06228bab6
SHA256 dda43221ffe326ed76859afba2c8534a5eda8ea0a241b133e036e1b26a609d34
MD5 bd7c776f8d78efcbbd1b939d89ac8eea
SHA1 c89c3349cabe95d8ab5451f84fe8dfa387242b11
SHA512 cba7ff8ccceeea66dcbed1aaeceb7689403b973a67f06e5a2bb1ffa197ecc7cd92b69ff2540c1d554a988071694728d794074ddaae66969be9a213acdbd36cfe
SSDEEP 12288:z761GcLmnB+5JEpmxopBnS2B/bTNBFVFxRkwuSI8OKm59cF+GogeO0ngdEIlSaUu:z7KLmnsTEUo+IbhVFkv/34p6BSL
MD5 SHA1 SHA512 SSDEEP

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

19606

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

mi_exe_stub.pdb

kernel32

GetProcAddress ExitProcess WriteFile GetStdHandle GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW WideCharToMultiByte GetLastError GetEnvironmentStringsW SetHandleCount GetFileType DeleteCriticalSection TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError GetCurrentThreadId InterlockedDecrement HeapCreate HeapDestroy VirtualFree HeapFree QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime LeaveCriticalSection EnterCriticalSection TerminateProcess Sleep UnhandledExceptionFilter IsDebuggerPresent LoadLibraryA InitializeCriticalSectionAndSpinCount GetCPInfo GetACP GetOEMCP IsValidCodePage HeapAlloc VirtualAlloc HeapReAlloc RtlUnwind HeapSize GetLocaleInfoA LCMapStringA MultiByteToWideChar LCMapStringW GetStringTypeA GetStringTypeW GetProcessHeap InitializeCriticalSection ReadFile GetModuleHandleW SetUnhandledExceptionFilter GetStartupInfoA GetCurrentProcess GetCommandLineA GetTempFileNameW FindResourceExW FindResourceW LoadResource VerSetConditionMask SetFilePointerEx CreateDirectoryW SizeofResource FormatMessageW GetVersionExW GetModuleFileNameW CreateFileW lstrlenW GetTempPathW RaiseException VerifyVersionInfoW Process32FirstW LockResource RemoveDirectoryW Process32NextW CreateToolhelp32Snapshot CloseHandle DeleteFileW LocalFree CreateProcessW WaitForSingleObject GetExitCodeProcess GetStartupInfoW MapViewOfFile UnmapViewOfFile VirtualQuery CreateFileMappingW SetFilePointer

shlwapi

PathAppendW PathQuoteSpacesW

advapi32

OpenServiceW OpenSCManagerW CloseServiceHandle QueryServiceStatusEx

ole32

CoUninitialize CoInitializeEx

shell32

ord680 SHGetFolderPathW

user32

wvsprintfW CharLowerBuffW MessageBoxW

Sharing

General

Malware Config

Signatures

File Explorer

dda43221ffe326ed76859afba2c8534a5eda8ea0a241b133e036e1b26a609d34

kernel32

shlwapi

advapi32

ole32

shell32

user32

generic