f10d404c81ab884341c8c2dc49a8b49370bea9dc601ecd0b9f970a6d635e5da1

General

Target
f10d404c81ab884341c8c2dc49a8b49370bea9dc601ecd0b9f970a6d635e5da1
Size 1.2MB
Sample260219-xlc7msgz7h
SHA256 f10d404c81ab884341c8c2dc49a8b49370bea9dc601ecd0b9f970a6d635e5da1
MD5 cb7d153e0b6288be03b05d92c9636b04
SHA1 1dc5beb369f0af15c1fbf792060ae782d5b7c14c
SHA512 e2a447811e35275e25c7907f1ddc0a9fa7a1c682f7fb562234603754350cf2fd0cec5ff4778e3d496f86be0c55f91c60856c20ec55ca3d8dcbfc87490f935fc0
SSDEEP 24576:igHo19TDgiST8sj8PCVLz0iCUIxLtvuwIXmjMRxG:igKkT8o0lWwqmn
TLSH
T1E545E035904262DAF1A680B35A455680F563B83747392FEF42F4E7751E0AEE80F3E716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f10d404c81ab884341c8c2dc49a8b49370bea9dc601ecd0b9f970a6d635e5da1

File Explorer

f10d404c81ab884341c8c2dc49a8b49370bea9dc601ecd0b9f970a6d635e5da1

.exe 1.2MB

f10d404c81ab884341c8c2dc49a8b49370bea9dc601ecd0b9f970a6d635e5da1

IMPHASH 82c087080422decfaeb58e6a93d707b4
SHA256 f10d404c81ab884341c8c2dc49a8b49370bea9dc601ecd0b9f970a6d635e5da1
MD5 cb7d153e0b6288be03b05d92c9636b04
SHA1 1dc5beb369f0af15c1fbf792060ae782d5b7c14c
SHA512 e2a447811e35275e25c7907f1ddc0a9fa7a1c682f7fb562234603754350cf2fd0cec5ff4778e3d496f86be0c55f91c60856c20ec55ca3d8dcbfc87490f935fc0
SSDEEP 24576:igHo19TDgiST8sj8PCVLz0iCUIxLtvuwIXmjMRxG:igKkT8o0lWwqmn
TLSH
T1E545E035904262DAF1A680B35A455680F563B83747392FEF42F4E7751E0AEE80F3E716
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

400920

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

AcquireSRWLockExclusive CheckRemoteDebuggerPresent CloseHandle CreateFileW DecodePointer DeleteCriticalSection EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FreeConsole FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetFileSizeEx GetFileType GetLastError GetLocaleInfoW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTimeAsFileTime GetThreadContext GetUserDefaultLCID HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryExW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetEndOfFile SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VirtualProtect WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

Name

.text

Size

533KB

Virtual Size

536KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

80KB

Virtual Size

80KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.eof

Size

563KB

Virtual Size

563KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

f10d404c81ab884341c8c2dc49a8b49370bea9dc601ecd0b9f970a6d635e5da1

kernel32

generic