5ce23b2a954a3803aa90be4fec60be105e09d15fd24bfca1420db12d65f8e0e9[.]exe

General

Target
5ce23b2a954a3803aa90be4fec60be105e09d15fd24bfca1420db12d65f8e0e9.exe
Size 276KB
Sample241217-dpe1vszlap
SHA256 5ce23b2a954a3803aa90be4fec60be105e09d15fd24bfca1420db12d65f8e0e9
MD5 d713d347658a4744e01eb2f9e169ce1c
SHA1 77777460a0b41f505de6cf8a3144b64df87ba01b
SHA512 387d0ab83c48d45ab3bc9abf7f5b0d9dc5b7a04944d2d319bb4d2978630829cd369bda6349737ca67980856a0a76a2279892d67134a96e1acbb47b6e7e64b5a1
SSDEEP 3072:FdcQ2ZNMSQvbajUTUItjT68+xQEVulys593oI8mmwXrPbh:VATSOjUQKculy8uI9fbPN
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5ce23b2a954a3803aa90be4fec60be105e09d15fd24bfca1420db12d65f8e0e9.exe

File Explorer

5ce23b2a954a3803aa90be4fec60be105e09d15fd24bfca1420db12d65f8e0e9.exe

.dll 276KB

5ce23b2a954a3803aa90be4fec60be105e09d15fd24bfca1420db12d65f8e0e9.exe

IMPHASH ca18db68559e6df04db61c68d78399a9
SHA256 5ce23b2a954a3803aa90be4fec60be105e09d15fd24bfca1420db12d65f8e0e9
MD5 d713d347658a4744e01eb2f9e169ce1c
SHA1 77777460a0b41f505de6cf8a3144b64df87ba01b
SHA512 387d0ab83c48d45ab3bc9abf7f5b0d9dc5b7a04944d2d319bb4d2978630829cd369bda6349737ca67980856a0a76a2279892d67134a96e1acbb47b6e7e64b5a1
SSDEEP 3072:FdcQ2ZNMSQvbajUTUItjT68+xQEVulys593oI8mmwXrPbh:VATSOjUQKculy8uI9fbPN
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

159744

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\Perforce\HelpClient\Browser\Source\lib\windows\AdobeHelpLib\MT\Release\ahclient.pdb

kernel32

GetFileAttributesExW MultiByteToWideChar CreateProcessW CloseHandle SetEndOfFile TerminateProcess GetCurrentProcess UnhandledExceptionFilter SetUnhandledExceptionFilter IsDebuggerPresent RaiseException RtlUnwind GetLastError HeapFree HeapAlloc GetCurrentThreadId GetCommandLineA GetVersionExA GetProcessHeap GetModuleHandleA GetProcAddress TlsGetValue TlsAlloc TlsSetValue TlsFree InterlockedIncrement SetLastError InterlockedDecrement Sleep HeapSize ExitProcess HeapDestroy HeapCreate VirtualFree DeleteCriticalSection LeaveCriticalSection EnterCriticalSection VirtualAlloc HeapReAlloc SetHandleCount GetStdHandle GetFileType GetStartupInfoA WriteFile WideCharToMultiByte GetConsoleCP GetConsoleMode FlushFileBuffers ReadFile SetFilePointer GetModuleFileNameA FreeEnvironmentStringsA GetEnvironmentStrings FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetTickCount GetCurrentProcessId GetSystemTimeAsFileTime GetCPInfo GetACP GetOEMCP IsValidCodePage LoadLibraryA InitializeCriticalSection WriteConsoleA GetConsoleOutputCP WriteConsoleW SetStdHandle CreateFileW GetUserDefaultLCID GetLocaleInfoA EnumSystemLocalesA IsValidLocale GetStringTypeA GetStringTypeW LCMapStringA LCMapStringW GetLocaleInfoW CreateFileA

user32

wsprintfW

advapi32

RegQueryValueExW RegCloseKey RegOpenKeyW

shell32

SHGetFolderPathW

Name

.text

Size

104KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.text

Size

128KB

Virtual Size

128KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

5ce23b2a954a3803aa90be4fec60be105e09d15fd24bfca1420db12d65f8e0e9.exe

kernel32

user32

advapi32

shell32

generic