c49eb21ed61c75a7174227879e2059dbbd273070caecad6267a6b64011706bb2

Sharing

Copy URL Twitter E-mail

General

Target
c49eb21ed61c75a7174227879e2059dbbd273070caecad6267a6b64011706bb2
Size 213KB
Sample250315-kqhayaspx4
SHA256 c49eb21ed61c75a7174227879e2059dbbd273070caecad6267a6b64011706bb2
MD5 75465c8b7b9c2595465ddc13bfbb03ef
SHA1 bf388e942f68ac35421bc15304215d9d603b61f1
SHA512 84e6b7bbbd1535c6f1c405662390a19af2baf4f7a9767f7529f390d5616c982f88fd3f806921f81ca69da5a20d7a43cccacb534f7b52d8c2e73c397e62189836
SSDEEP 6144:LQfbXnEreyARNf+fIfvEEDi3EJ3FzbPotDy:sXkej+f4VDOEVdbgt
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c49eb21ed61c75a7174227879e2059dbbd273070caecad6267a6b64011706bb2

File Explorer

c49eb21ed61c75a7174227879e2059dbbd273070caecad6267a6b64011706bb2

.exe 213KB

c49eb21ed61c75a7174227879e2059dbbd273070caecad6267a6b64011706bb2

IMPHASH cd7fcdda5ab111ed483e93c44d1d1ae1
SHA256 c49eb21ed61c75a7174227879e2059dbbd273070caecad6267a6b64011706bb2
MD5 75465c8b7b9c2595465ddc13bfbb03ef
SHA1 bf388e942f68ac35421bc15304215d9d603b61f1
SHA512 84e6b7bbbd1535c6f1c405662390a19af2baf4f7a9767f7529f390d5616c982f88fd3f806921f81ca69da5a20d7a43cccacb534f7b52d8c2e73c397e62189836
SSDEEP 6144:LQfbXnEreyARNf+fIfvEEDi3EJ3FzbPotDy:sXkej+f4VDOEVdbgt
MD5 SHA1 SHA512 SSDEEP

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

282624

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CompareFileTime GetVersion GetProcAddress FindResourceW CompareStringA HeapCreate lstrcatW RemoveDirectoryA LoadLibraryA SetComputerNameW RemoveDirectoryW lstrcpynW GlobalFindAtomW ExitProcess SetCalendarInfoA

user32

GetMenuItemCount CharUpperA GetTopWindow GetDC GetDlgItemTextW UnregisterClassW LoadIconA CreateDesktopA FillRect GetCapture InsertMenuItemA GetMenuItemID GetClassLongW RegisterClassExW

gdi32

SetDeviceGammaRamp UpdateICMRegKeyA GetPolyFillMode CreateRectRgn EnumFontFamiliesExW GetEnhMetaFileW RemoveFontResourceExA MoveToEx UpdateColors GetAspectRatioFilterEx GetCharWidth32W WidenPath SetPixel GetKerningPairsA SetBkMode GetEnhMetaFileDescriptionA CreateEnhMetaFileA

advapi32

RegSaveKeyW RegEnumValueA RegOpenKeyA RegQueryInfoKeyW RegOpenKeyExA RegDeleteValueW

shell32

SHGetFileInfoA SHGetDataFromIDListA

shlwapi

UrlCompareA SHOpenRegStreamW PathIsRootA StrRChrW PathIsLFNFileSpecA PathIsRelativeA StrNCatA UrlCombineW

setupapi

CM_Free_Res_Des SetupPromptForDiskW SetupDiCreateDeviceInfoW SetupDiGetDeviceInstallParamsA SetupDiSelectDevice

version

VerInstallFileW GetFileVersionInfoW GetFileVersionInfoSizeW VerFindFileA

inetcomm

CreateNNTPTransport MimeOleUnEscapeStringInPlace MimeOleCreateMessage HrSaveAttachmentAs

wsock32

TransmitFile gethostname WSAAsyncGetHostByName rcmd ntohl GetNameByTypeA s_perror setsockopt WSASetBlockingHook WSAAsyncSelect

Name

.vjNlbf

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.kudd

Size

3KB

Virtual Size

260KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.FeE

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.kbVKK

Size

3KB

Virtual Size

159KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.WKQ

Size

3KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

4KB

Virtual Size

446KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.UXAdns

Size

2KB

Virtual Size

430KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

95KB

Virtual Size

404KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.jFpzOB

Size

1024B

Virtual Size

392KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.cmF

Size

2KB

Virtual Size

99KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

82KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

1024B

Virtual Size

690B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

c49eb21ed61c75a7174227879e2059dbbd273070caecad6267a6b64011706bb2

kernel32

user32

gdi32

advapi32

shell32

shlwapi

setupapi

version

inetcomm

wsock32

generic