1bd80ac9b25684d8a761d999933f416fb8afa628980eb1d06413685799944e10

Sharing

Copy URL Twitter E-mail

General

Target
1bd80ac9b25684d8a761d999933f416fb8afa628980eb1d06413685799944e10
Size 3.7MB
Sample260227-bf48aae19h
SHA256 1bd80ac9b25684d8a761d999933f416fb8afa628980eb1d06413685799944e10
MD5 37ad8a7cd6f814af764aaf9eed8e1779
SHA1 4c4ed19877cd1b315327925028070df7836ddf60
SHA512 bdae82c0bb63318103fdebdb0c8b9d0eed29d17818b78048f09d17ad22791e4aed60933b46f906d8b144998367bb2ea130af3f34549fcab7791b55e99b2bfc7b
SSDEEP 49152:GQkSbazOng5cqPGK5fjTJkyYJYI7SmpcC5buktY3m79Zkwcf:3bazOgWqPbfRKJimv5bH6275w
TLSH
T1C806AE15FC36D18AECE34071BF3AD221D5722E37DF28226B91DC89900555DEEB62E07A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1bd80ac9b25684d8a761d999933f416fb8afa628980eb1d06413685799944e10

File Explorer

1bd80ac9b25684d8a761d999933f416fb8afa628980eb1d06413685799944e10

.exe 3.7MB

1bd80ac9b25684d8a761d999933f416fb8afa628980eb1d06413685799944e10

IMPHASH 8cd0ffc23a93d40428f4277ead307c71
SHA256 1bd80ac9b25684d8a761d999933f416fb8afa628980eb1d06413685799944e10
MD5 37ad8a7cd6f814af764aaf9eed8e1779
SHA1 4c4ed19877cd1b315327925028070df7836ddf60
SHA512 bdae82c0bb63318103fdebdb0c8b9d0eed29d17818b78048f09d17ad22791e4aed60933b46f906d8b144998367bb2ea130af3f34549fcab7791b55e99b2bfc7b
SSDEEP 49152:GQkSbazOng5cqPGK5fjTJkyYJYI7SmpcC5buktY3m79Zkwcf:3bazOgWqPbfRKJimv5bH6275w
TLSH
T1C806AE15FC36D18AECE34071BF3AD221D5722E37DF28226B91DC89900555DEEB62E07A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3072680

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

AcquireSRWLockExclusive CloseHandle CreateFileW DecodePointer DeleteCriticalSection EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetFileSizeEx GetFileType GetLastError GetLocaleInfoW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTimeAsFileTime GetUserDefaultLCID HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryExW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetEndOfFile SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VirtualProtect WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

Name

.text

Size

3.1MB

Virtual Size

3.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

76KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.retplne

Size

512B

Virtual Size

200B

Characteristics

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

_RDATA

Size

512B

Virtual Size

500B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.TLS

Size

563KB

Virtual Size

563KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

1bd80ac9b25684d8a761d999933f416fb8afa628980eb1d06413685799944e10

kernel32

generic