184388

General

Target
184388
Size 73KB
Sample260424-j5ja4scs21
SHA256 078dec0bcecb6d7da04dd7e047ab0e8f6cd132bb70e19c241e5128a2d5cc1dca
MD5 8324af18bf562512af2e31bf6ce395d1
SHA1 d05287d632b84b74c49ae769e91b643ac9284969
SHA512 f3ad16ecbad6747b82ace83252e4d60f7ded51c0eccc259eac73db0423eb48a0629bebe0cab76780a8ff8f32bb4cfe664d98aedbeaee58f913fab7fb971bcb78
SSDEEP 768:1zgKPcryUJieCYFOMkVxGLi83O3K4Mehv+Hop8hLgJqhklif2Ubxt02sR:1Zcr3YeCjxGux3xDhWIOZNyU2IC2e
TLSH
T1F37382D63BCD5CE6EA5211BCC9B5D372293DF9E00A138B07A67849364B53E863DE5203
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
184388

File Explorer

184388

.exe 73KB

IMPHASH d8b1bbf4ff622f9f9c4cd72ef3b7d210
SHA256 078dec0bcecb6d7da04dd7e047ab0e8f6cd132bb70e19c241e5128a2d5cc1dca
MD5 8324af18bf562512af2e31bf6ce395d1
SHA1 d05287d632b84b74c49ae769e91b643ac9284969
SHA512 f3ad16ecbad6747b82ace83252e4d60f7ded51c0eccc259eac73db0423eb48a0629bebe0cab76780a8ff8f32bb4cfe664d98aedbeaee58f913fab7fb971bcb78
SSDEEP 768:1zgKPcryUJieCYFOMkVxGLi83O3K4Mehv+Hop8hLgJqhklif2Ubxt02sR:1Zcr3YeCjxGux3xDhWIOZNyU2IC2e
TLSH
T1F37382D63BCD5CE6EA5211BCC9B5D372293DF9E00A138B07A67849364B53E863DE5203
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

4640

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

libpq

PQerrorMessage PQfinish PQsetdbLogin PQstatus

advapi32

CloseServiceHandle CreateServiceA DeleteService OpenSCManagerA OpenServiceA RegisterEventSourceA RegisterServiceCtrlHandlerA ReportEventA SetServiceStatus StartServiceCtrlDispatcherA

libintl-2

libintl_bindtextdomain libintl_gettext libintl_textdomain

kernel32

AddAtomA CallNamedPipeA CloseHandle CreateEventA CreatePipe CreateProcessA DuplicateHandle ExitProcess FindAtomA GetAtomNameA GetCurrentProcess GetLastError ReadFile SetEvent SetUnhandledExceptionFilter SleepEx WaitForMultipleObjects WaitForSingleObject

msvcrt

_getcwd _getpid _isatty _putenv _stat _strdup _umask __getmainargs __mb_cur_max __p___argv __p__environ __p__fmode __set_app_type _cexit _errno _iob _isctype _onexit _pclose _pctype _setmode abort atexit atol exit fclose fflush fgetc fgets fopen fprintf fputc fputs free fscanf fwrite getenv malloc memmove memset perror rewind setlocale setvbuf signal sprintf strcat strchr strcmp strcpy strcspn strerror strlen strncmp strncpy strstr system tolower toupper vfprintf

shfolder

SHGetFolderPathA

user32

wsprintfA

Name

.text

Size

28KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

184388

libpq

advapi32

libintl-2

kernel32

msvcrt

shfolder

user32

generic