260ce3c79d17bbf7db66f6d91b2142886d2023c3bc98a2e4dd653db25c7e760aN[.]exe

General

Target
260ce3c79d17bbf7db66f6d91b2142886d2023c3bc98a2e4dd653db25c7e760aN.exe
Size 562KB
Sample250116-mdsl9awkfw
SHA256 260ce3c79d17bbf7db66f6d91b2142886d2023c3bc98a2e4dd653db25c7e760a
MD5 7a0dec1b9d3854b30367a221a5117430
SHA1 c5d9f5fe63cd258a6c3fa6f423d18875b8d64eea
SHA512 0afa794f909e306e462b9ba54e0846dd53757ba2edec2f44f9a8dee4a2afb05201fb95c541fa443a929d3eee678ff6010e523836937a9ad2989ad88d04c5f061
SSDEEP 12288:Zew76RBfeL8GRVAsArkRHLwEQzm8LtnScuK+QZOGOBhYWzod5Cmvq:Zew2RBfeL8GRVAsArk25zm8duCkFmv
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
260ce3c79d17bbf7db66f6d91b2142886d2023c3bc98a2e4dd653db25c7e760aN.exe

File Explorer

260ce3c79d17bbf7db66f6d91b2142886d2023c3bc98a2e4dd653db25c7e760aN.exe

.dll 562KB

260ce3c79d17bbf7db66f6d91b2142886d2023c3bc98a2e4dd653db25c7e760aN.exe

IMPHASH 59d282b27fb192890b4d78ddab0e3040
SHA256 260ce3c79d17bbf7db66f6d91b2142886d2023c3bc98a2e4dd653db25c7e760a
MD5 7a0dec1b9d3854b30367a221a5117430
SHA1 c5d9f5fe63cd258a6c3fa6f423d18875b8d64eea
SHA512 0afa794f909e306e462b9ba54e0846dd53757ba2edec2f44f9a8dee4a2afb05201fb95c541fa443a929d3eee678ff6010e523836937a9ad2989ad88d04c5f061
SSDEEP 12288:Zew76RBfeL8GRVAsArkRHLwEQzm8LtnScuK+QZOGOBhYWzod5Cmvq:Zew2RBfeL8GRVAsArk25zm8duCkFmv
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

114161

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

c:\bright\occur\moon\Similar\gave\cause\Grandred.pdb

kernel32

GetModuleFileNameA TlsSetValue Sleep GetTempPathA GetSystemDirectoryA TlsAlloc VirtualProtectEx WriteConsoleW CreateFileW HeapSize ReadConsoleW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetTimeZoneInformation ReadFile GetConsoleMode GetConsoleCP WriteFile FlushFileBuffers SetFilePointerEx GetFileSizeEx GetProcessHeap GetFileType GetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetTimeFormatW GetDateFormatW GetModuleFileNameW GetModuleHandleExW ExitProcess HeapFree HeapReAlloc HeapAlloc InterlockedFlushSList LoadLibraryExW FreeLibrary GetLastError RtlUnwind RaiseException InitializeSListHead GetCurrentThreadId GetCurrentProcessId QueryPerformanceCounter GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter WaitForSingleObjectEx ResetEvent SetEvent CloseHandle GetCPInfo GetLocaleInfoW LCMapStringW CompareStringW GetProcAddress GetModuleHandleW MultiByteToWideChar WideCharToMultiByte GetStringTypeW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer SetLastError InitializeCriticalSectionAndSpinCount CreateEventW TlsGetValue TlsFree GetSystemTimeAsFileTime

ole32

StgCreateDocfile CoSuspendClassObjects OleInitialize CoUninitialize OleCreate CoInitialize OleUninitialize

winspool.drv

AddPrinterDriverA EnumPrinterDataExA DeletePrinterDataExA DeletePortA SetPrinterDataA DeletePrinterDataA DeletePrinterDriverA SetJobA DeletePrinterDriverExA EnumFormsA DeletePrinterConnectionA DeletePrintProcessorA EnumPrintProcessorDatatypesA DeletePrinterKeyA FlushPrinter SetPrinterDataExA GetPrinterA OpenPrinterA StartDocPrinterA DeletePrinter EnumMonitorsA AddPortA GetFormA EndPagePrinter AddMonitorA EnumPrintProcessorsA AddPrinterConnectionA GetPrinterDriverDirectoryA EndDocPrinter GetPrinterDriverA AddJobA AddFormA GetPrinterDataExA EnumPortsA FindClosePrinterChangeNotification AddPrinterA ConfigurePortA SetPortA StartPagePrinter DeleteFormA EnumJobsA EnumPrinterDriversA AddPrinterDriverExA GetPrintProcessorDirectoryA DeletePrintProvidorA ClosePrinter PrinterMessageBoxA ResetPrinterA GetJobA ReadPrinter EnumPrinterKeyA SetFormA AddPrintProvidorA GetPrinterDataA DeleteMonitorA ScheduleJob EnumPrintersA AddPrintProcessorA EnumPrinterDataA

Name

.text

Size

403KB

Virtual Size

402KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

96KB

Virtual Size

95KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

43KB

Virtual Size

1015KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

9B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

260ce3c79d17bbf7db66f6d91b2142886d2023c3bc98a2e4dd653db25c7e760aN.exe

kernel32

ole32

winspool.drv

generic