cb90a725fbbc095fc5748744d044f61642a629167a44cf0ee9680e4532c8363e

Sharing

Copy URL Twitter E-mail

General

Target
cb90a725fbbc095fc5748744d044f61642a629167a44cf0ee9680e4532c8363e
Size 2.1MB
Sample260305-eaay2abw2m
SHA256 cb90a725fbbc095fc5748744d044f61642a629167a44cf0ee9680e4532c8363e
MD5 d05b1ee51c7cf449900c8f983fe0ef57
SHA1 76513ebb2bfd42fdc541e4df9412a865b5d21b67
SHA512 e2985ea8c4098f68f1ce32bd77b67baaf253c8c87562140680d89c4e788a91945902f5b82f36ca7f3ce667bf6645945ab9c96c5b35599c6cb0eb682690c9f512
SSDEEP 49152:UZ3d0h+AV/ABM55Gyj4hg4uAQrvRr5Gyj4hg4uAQrvR:8dI+1s6IrvR96IrvR
TLSH
T1F1A5F1399292A2D6FC7740B640A1A595B472BA32C62D1FFF9290E3336E073C41F6975C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
cb90a725fbbc095fc5748744d044f61642a629167a44cf0ee9680e4532c8363e

File Explorer

cb90a725fbbc095fc5748744d044f61642a629167a44cf0ee9680e4532c8363e

.exe 2.1MB

cb90a725fbbc095fc5748744d044f61642a629167a44cf0ee9680e4532c8363e

IMPHASH df533905651d4d38e2f1c6b89a7d3c6a
SHA256 cb90a725fbbc095fc5748744d044f61642a629167a44cf0ee9680e4532c8363e
MD5 d05b1ee51c7cf449900c8f983fe0ef57
SHA1 76513ebb2bfd42fdc541e4df9412a865b5d21b67
SHA512 e2985ea8c4098f68f1ce32bd77b67baaf253c8c87562140680d89c4e788a91945902f5b82f36ca7f3ce667bf6645945ab9c96c5b35599c6cb0eb682690c9f512
SSDEEP 49152:UZ3d0h+AV/ABM55Gyj4hg4uAQrvRr5Gyj4hg4uAQrvR:8dI+1s6IrvR96IrvR
TLSH
T1F1A5F1399292A2D6FC7740B640A1A595B472BA32C62D1FFF9290E3336E073C41F6975C
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

454392

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

AcquireSRWLockExclusive CloseHandle CreateFileW CreateThread DecodePointer DeleteCriticalSection EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FreeConsole FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetFileSizeEx GetFileType GetLastError GetLocaleInfoW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTimeAsFileTime GetUserDefaultLCID HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryExW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetEndOfFile SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive UnhandledExceptionFilter WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

user32

BeginPaint CreateWindowExA DefWindowProcW EndPaint LoadCursorW MessageBoxA PostQuitMessage RegisterClassExA ShowWindow UpdateWindow

gdi32

BitBlt CreateCompatibleDC DeleteDC DeleteObject SelectObject TextOutA

Name

.text

Size

587KB

Virtual Size

588KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

65KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

13KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gxfg

Size

9KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.time

Size

743KB

Virtual Size

743KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.time

Size

743KB

Virtual Size

743KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

756B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

cb90a725fbbc095fc5748744d044f61642a629167a44cf0ee9680e4532c8363e

kernel32

user32

gdi32

generic