187679

Sharing

Copy URL Twitter E-mail

General

Target
187679
Size 46KB
Sample260428-kjt16afv21
SHA256 1657f67eed171ba1a2968654dc52c1cbfc17cce7f9e61091e8024a901c5cb1fe
MD5 a0723613b2616afd69e2b3cd25afa294
SHA1 21d74e86a44c55dd84ddda0c828c36f6de7042cd
SHA512 a70faf2f546b58e6e0c4914a59e7d42ac88a2ae240e03e57e573dd6d5baf4e086af827ebae6be85d9f054b945a260ebabb9830fe35aa51309f8b1af5ddc1cdaa
SSDEEP 768:EpyA5wtweFWeF98YVzHa5R+DdlcQ1QX11zh0eibmbPt/L7PV3iPK4x0dwEwf4d:EpyA5wtweFWeFnHER+DdlcQ1QF1zYKbt
TLSH
T16A23FA94928609E0FFE5097539EE3A9B383E0F10A3E00CCB676726D42C565D7AE74B47
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
187679

File Explorer

187679

.dll 46KB

IMPHASH 842ea60a9e0a0d113df14f536b404c6d
SHA256 1657f67eed171ba1a2968654dc52c1cbfc17cce7f9e61091e8024a901c5cb1fe
MD5 a0723613b2616afd69e2b3cd25afa294
SHA1 21d74e86a44c55dd84ddda0c828c36f6de7042cd
SHA512 a70faf2f546b58e6e0c4914a59e7d42ac88a2ae240e03e57e573dd6d5baf4e086af827ebae6be85d9f054b945a260ebabb9830fe35aa51309f8b1af5ddc1cdaa
SSDEEP 768:EpyA5wtweFWeF98YVzHa5R+DdlcQ1QX11zh0eibmbPt/L7PV3iPK4x0dwEwf4d:EpyA5wtweFWeFnHER+DdlcQ1QF1zYKbt
TLSH
T16A23FA94928609E0FFE5097539EE3A9B383E0F10A3E00CCB676726D42C565D7AE74B47
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

37536

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

fwcfg.pdb

msvcrt

_amsg_exit _callnewh malloc free wcsstr _initterm _except_handler4_common _wtoi _XcptFilter memset

ntdll

WinSqmAddToStream

api-ms-win-core-com-l1-1-1

CoUninitialize CoInitializeEx

api-ms-win-eventing-classicprovider-l1-1-0

GetTraceEnableFlags RegisterTraceGuidsW GetTraceLoggerHandle UnregisterTraceGuids GetTraceEnableLevel

api-ms-win-core-libraryloader-l1-2-0

LoadStringW DisableThreadLibraryCalls

oleaut32

SysFreeString

api-ms-win-core-errorhandling-l1-1-1

SetUnhandledExceptionFilter GetLastError UnhandledExceptionFilter

api-ms-win-core-synch-l1-2-0

Sleep

api-ms-win-core-profile-l1-1-0

QueryPerformanceCounter

api-ms-win-core-processthreads-l1-1-2

GetCurrentThreadId GetCurrentProcess GetCurrentProcessId TerminateProcess

api-ms-win-core-sysinfo-l1-2-1

GetTickCount GetSystemTimeAsFileTime

firewallapi

FwMulticastBroadcastResponsesSet IcfGetDynamicFwPorts IcfDisconnect IcfConnect IcfFreeTickets FwGetAddressesAsString IcfGetTickets IcfFreeProfile IcfFreeDynamicFwPorts IcfGetProfile FwPortOpeningsAdd FwNotificationsEnum FWFreeFirewallRules FwIcmpSettingsSet FWClosePolicyStore FwProfileTypeCurrentGet FWOpenPolicyStore FwMulticastBroadcastResponsesEnum FWEnumFirewallRules FwOpModesSet FwServicesSet FwOpModesEnum FwNotificationsSet FwServicesEnum FwRestoreDefaults FwAllowedProgramsAdd FwAllowedProgramsDelete FwLogSettingsSet FwApiHelperInit FwIcmpSettingsEnum FwProfileTypeGet FwPortOpeningsDelete FwApiHelperFree FwAlloc FWGetConfig FwFree

netsh.exe

PrintError RegisterContext PrintMessageFromModule MatchEnumTag MatchTagsInCmdLine RegisterHelper

api-ms-win-core-delayload-l1-1-1

ResolveDelayLoadedAPI DelayLoadFailureHook

Name

.text

Size

35KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

1024B

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.didat

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

187679

msvcrt

ntdll

api-ms-win-core-com-l1-1-1

api-ms-win-eventing-classicprovider-l1-1-0

api-ms-win-core-libraryloader-l1-2-0

oleaut32

api-ms-win-core-errorhandling-l1-1-1

api-ms-win-core-synch-l1-2-0

api-ms-win-core-profile-l1-1-0

api-ms-win-core-processthreads-l1-1-2

api-ms-win-core-sysinfo-l1-2-1

firewallapi

netsh.exe

api-ms-win-core-delayload-l1-1-1

generic