d231a385059afa6806713b75e56492a4f2c93bf9fc7c8ac67fad4d7304311de1

Sharing

Copy URL Twitter E-mail

General

Target
d231a385059afa6806713b75e56492a4f2c93bf9fc7c8ac67fad4d7304311de1
Size 218KB
Sample241120-ev5ddazrfs
SHA256 d231a385059afa6806713b75e56492a4f2c93bf9fc7c8ac67fad4d7304311de1
MD5 55ea8c0f6d3622494b44b4335d31b145
SHA1 2633d874518085928c761c6aacf4718e3349caa4
SHA512 db6cafdc1a5a1033e214da9fad2d8e3efbfe78c6029462fcf63ad3e5e0f381be3e65d2b59438d85ab1bf0eec56302aa46a0ec0c8fe38f239209df30798a239f8
SSDEEP 6144:yEQBDdO1z7L/EIhZDE9oLfFWlMZT7+DGaMwIC:yEGDdQNHEwWlMxYG/wI
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d231a385059afa6806713b75e56492a4f2c93bf9fc7c8ac67fad4d7304311de1

File Explorer

d231a385059afa6806713b75e56492a4f2c93bf9fc7c8ac67fad4d7304311de1

.exe 218KB

d231a385059afa6806713b75e56492a4f2c93bf9fc7c8ac67fad4d7304311de1

IMPHASH 2e5df9fb7e893bd2efa286b6326edce6
SHA256 d231a385059afa6806713b75e56492a4f2c93bf9fc7c8ac67fad4d7304311de1
MD5 55ea8c0f6d3622494b44b4335d31b145
SHA1 2633d874518085928c761c6aacf4718e3349caa4
SHA512 db6cafdc1a5a1033e214da9fad2d8e3efbfe78c6029462fcf63ad3e5e0f381be3e65d2b59438d85ab1bf0eec56302aa46a0ec0c8fe38f239209df30798a239f8
SSDEEP 6144:yEQBDdO1z7L/EIhZDE9oLfFWlMZT7+DGaMwIC:yEGDdQNHEwWlMxYG/wI
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

570996

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

GetStartupInfoA EnumCalendarInfoA DisconnectNamedPipe MoveFileA lstrcpyn GetCommandLineA GetSystemDirectoryW GetEnvironmentVariableA IsBadStringPtrA FindAtomW ReadDirectoryChangesW GetFullPathNameW GetFileAttributesA ExitThread LoadLibraryA lstrlenA lstrlen FindResourceA FindResourceW GetTempPathW GetFullPathNameA OpenMutexW SearchPathW GetProcAddress EnumTimeFormatsW GetLocaleInfoW EnumTimeFormatsA GetCPInfo OpenMutexA GetThreadPriority LoadResource CreateFileMappingA GetNamedPipeInfo lstrcpynW CompareStringW OpenFile IsBadCodePtr GetDiskFreeSpaceA GetTimeFormatW FindAtomA GlobalGetAtomNameW MultiByteToWideChar CreateMailslotW

user32

LoadMenuIndirectW GetDC SetCursorPos OpenClipboard CreateAcceleratorTableA OffsetRect IsDlgButtonChecked LoadMenuIndirectA GetMessageW WinHelpA UpdateWindow IsMenu GetKeyState UnregisterClassA DestroyIcon ShowWindow SetFocus TrackPopupMenuEx

gdi32

GetLogColorSpaceW EnumFontFamiliesW CreateICW OffsetClipRgn SetRectRgn SetTextColor PlayEnhMetaFile CreateFontIndirectExW GetOutlineTextMetricsW GetBrushOrgEx SetEnhMetaFileBits StartDocW GetObjectA

advapi32

RegQueryInfoKeyW RegOpenKeyExA RegQueryValueW RegReplaceKeyW RegOpenKeyExA RegQueryInfoKeyA RegDeleteKeyA RegQueryValueA RegDeleteValueA RegOpenKeyExW RegReplaceKeyA RegRestoreKeyW

shell32

SHGetDataFromIDListA SHGetFileInfoA

shlwapi

StrStrW SHOpenRegStream2A StrToIntA PathParseIconLocationA PathSkipRootW StrToIntExA PathCreateFromUrlA StrCmpNIW StrChrNIW UrlIsOpaqueA

ole32

CoGetCurrentProcess CLSIDFromString

winmm

midiOutSetVolume mxd32Message mmioClose mciSendStringW mmioSendMessage mixerGetLineControlsW mmTaskBlock

Name

.ma

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.obptK

Size

5KB

Virtual Size

197KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.Wv

Size

2KB

Virtual Size

341KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.UeARA

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rddrej

Size

3KB

Virtual Size

396KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.roXfGq

Size

3KB

Virtual Size

458KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.BOJdrg

Size

3KB

Virtual Size

37KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.IU

Size

3KB

Virtual Size

473KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

512B

Virtual Size

148KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

109KB

Virtual Size

332KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.kzG

Size

1KB

Virtual Size

205KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.cMrd

Size

512B

Virtual Size

162KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

68KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

634B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

d231a385059afa6806713b75e56492a4f2c93bf9fc7c8ac67fad4d7304311de1

kernel32

user32

gdi32

advapi32

shell32

shlwapi

ole32

winmm

generic