185890

General

Target
185890
Size 18KB
Sample260424-n27lragy21
SHA256 0e2c1fd9a66b3355d366d6dab5570620f34eeb17cb7f5fe2815dd4a8d5489294
MD5 905a016adc43e6cbf61f25d0451c245c
SHA1 951ec2a0cbe7d89a4da33f490cdb6cb33bd4518c
SHA512 0b95645bdb095cb8ec11c708341fd8ede71698263cfddd2668fb3e166307214a1faa3839bb6dff68558de62e9d1cd1e17a38b90ff1f027f58c5702ec3ba759cc
SSDEEP 384:QuiOMgc0Y1BVQCFD5XBKMIn9nvAVnVWIJW5Moo:ziOMg5Y1BVQCEME1AVnRs
TLSH
T14A822A06B3858535F8F3167829BE6626926EBA211F40C5D7F788178A3970ED1AC3437F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
185890

File Explorer

185890

.exe 18KB

IMPHASH 9baa1661e6156ffc752a1f23b01afe5c
SHA256 0e2c1fd9a66b3355d366d6dab5570620f34eeb17cb7f5fe2815dd4a8d5489294
MD5 905a016adc43e6cbf61f25d0451c245c
SHA1 951ec2a0cbe7d89a4da33f490cdb6cb33bd4518c
SHA512 0b95645bdb095cb8ec11c708341fd8ede71698263cfddd2668fb3e166307214a1faa3839bb6dff68558de62e9d1cd1e17a38b90ff1f027f58c5702ec3ba759cc
SSDEEP 384:QuiOMgc0Y1BVQCFD5XBKMIn9nvAVnVWIJW5Moo:ziOMg5Y1BVQCEME1AVnRs
TLSH
T14A822A06B3858535F8F3167829BE6626926EBA211F40C5D7F788178A3970ED1AC3437F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

10

Entry point

13568

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

diskperf.pdb

advapi32

RegQueryValueExW RegConnectRegistryW RegDeleteValueW RegOpenKeyExW RegCloseKey RegSetValueExW RegCreateKeyExW

kernel32

GetCommandLineW FindVolumeClose GetModuleHandleW SetThreadUILanguage GetVersionExW FindNextVolumeW WriteConsoleW CreateFileW lstrlenW GetStdHandle GetLastError GetFileType DeviceIoControl HeapSetInformation CloseHandle FindFirstVolumeW

msvcrt

__setusermatherr _initterm ?terminate@@YAXXZ _controlfp _except_handler4_common __p__fmode _cexit _exit __set_app_type __getmainargs _amsg_exit __p__commode exit wcstok setlocale _wcsupr _vsnwprintf malloc free _wtoi vfwprintf _wcsicmp _XcptFilter __iob_func memset

api-ms-win-core-libraryloader-l1-2-0

GetModuleHandleA LoadStringW

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-errorhandling-l1-1-1

UnhandledExceptionFilter SetUnhandledExceptionFilter

api-ms-win-core-processthreads-l1-1-2

GetCurrentThreadId GetCurrentProcessId GetCurrentProcess TerminateProcess

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-sysinfo-l1-2-1

GetTickCount GetSystemTimeAsFileTime

ntdll

NtOpenFile NtQuerySystemInformation NtClose RtlInitUnicodeString

Sharing