1f8dcfaebbcd7e71c2872e0ba2fc6db81d651cf654a21d33c78eae6662e62392[.]exe

General

Target
1f8dcfaebbcd7e71c2872e0ba2fc6db81d651cf654a21d33c78eae6662e62392.exe
Size 457KB
Sample251020-drkdcszlgl
SHA256 1f8dcfaebbcd7e71c2872e0ba2fc6db81d651cf654a21d33c78eae6662e62392
MD5 4df757390adf71abdd084d3e9718c153
SHA1 00331e5f972a98755811c02ec47301336a824a34
SHA512 4590344d7dad82a4edf62d6262a8dc2c5dc2cf119c8b21831c93b7371118558defee813e1af360cba39cee3e0ede6c99f6e95da949270cc79ae76a9337c678ef
SSDEEP 6144:kDZSfTWQ2Rsgc4iqgjjjjjUwW7D4cs/5ZRBAD6rZbdQc8XAXz40R5SVt1WskvLOl:QZS7DbW705ZTu6Vd0wXk0RwL1OO+gZ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1f8dcfaebbcd7e71c2872e0ba2fc6db81d651cf654a21d33c78eae6662e62392.exe

File Explorer

1f8dcfaebbcd7e71c2872e0ba2fc6db81d651cf654a21d33c78eae6662e62392.exe

.exe 457KB

1f8dcfaebbcd7e71c2872e0ba2fc6db81d651cf654a21d33c78eae6662e62392.exe

IMPHASH 47d612847dc9f9ce71631333113d4d39
SHA256 1f8dcfaebbcd7e71c2872e0ba2fc6db81d651cf654a21d33c78eae6662e62392
MD5 4df757390adf71abdd084d3e9718c153
SHA1 00331e5f972a98755811c02ec47301336a824a34
SHA512 4590344d7dad82a4edf62d6262a8dc2c5dc2cf119c8b21831c93b7371118558defee813e1af360cba39cee3e0ede6c99f6e95da949270cc79ae76a9337c678ef
SSDEEP 6144:kDZSfTWQ2Rsgc4iqgjjjjjUwW7D4cs/5ZRBAD6rZbdQc8XAXz40R5SVt1WskvLOl:QZS7DbW705ZTu6Vd0wXk0RwL1OO+gZ
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

19540

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

CloseHandle GetTickCount Sleep CreateProcessA VirtualFree LoadResource SizeofResource VirtualAlloc LockResource CreateFileA GetFileSize FindResourceExW FindResourceW WriteFile WideCharToMultiByte ReadFile GetModuleFileNameA GetProcAddress LoadLibraryA GetSystemTimeAsFileTime GetSystemTime LocalFileTimeToFileTime GetModuleHandleA WriteConsoleW SetFilePointerEx FlushFileBuffers SetStdHandle GetConsoleMode GetConsoleCP GetStringTypeW LCMapStringW FreeEnvironmentStringsW GetEnvironmentStringsW GetCurrentProcessId QueryPerformanceCounter GetFileType GetCurrentThreadId GetCPInfo GetOEMCP GetACP IsValidCodePage LoadLibraryExW GetModuleFileNameW GetStdHandle GetModuleHandleW GetStartupInfoW DeleteCriticalSection DecodePointer HeapSize GetLastError RaiseException InitializeCriticalSectionEx HeapDestroy GetProcessHeap HeapFree HeapAlloc CreateFileW HeapReAlloc IsDebuggerPresent OutputDebugStringW EnterCriticalSection LeaveCriticalSection EncodePointer ExitProcess GetModuleHandleExW MultiByteToWideChar GetCommandLineA RtlPcToFileHeader RtlLookupFunctionEntry RtlUnwindEx IsProcessorFeaturePresent RtlCaptureContext RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter SetLastError InitializeCriticalSectionAndSpinCount GetCurrentProcess TerminateProcess TlsAlloc TlsGetValue TlsSetValue TlsFree

user32

FillRect GetParent GetDC SetRect ReleaseDC GetSysColorBrush GetActiveWindow GetCursor GetSystemMetrics LoadImageA ChangeDisplaySettingsA LoadCursorFromFileA TranslateMessage GetRawInputDeviceList

gdi32

CreateFontIndirectA CreateBitmap GetFontUnicodeRanges GetSystemPaletteEntries CreateDIBitmap CreateSolidBrush

Name

.text

Size

63KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

45KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

25KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

data

Size

329KB

Virtual Size

328KB

Characteristics

Sharing

General

Malware Config

Signatures

File Explorer

1f8dcfaebbcd7e71c2872e0ba2fc6db81d651cf654a21d33c78eae6662e62392.exe

kernel32

user32

gdi32

generic