34021249eb5977343ae5de4e30e0817f37824009561b3eaa4e90130430ce8615

General

Target
34021249eb5977343ae5de4e30e0817f37824009561b3eaa4e90130430ce8615
Size 133KB
Sample260506-c7pscady5p
SHA256 34021249eb5977343ae5de4e30e0817f37824009561b3eaa4e90130430ce8615
MD5 c9fd0a9370d77b1eef1630a67dd02933
SHA1 de098f4d74cddd45070917e6f4f6bd241481a60c
SHA512 91b040efc43130685d645dd28263e0a1f86e1a6658ff340a4e4b530def3e6c5c1818e49dc6ca5c3c2f601fc1fa6ffe2695153a808bbe51547e9444ec7405b6b7
SSDEEP 3072:Bzqbn5LHYID9n2RhK7hwZFUf6v8wWT5Vwp7+uC8H/W:BGbnhHYIVCK764yt1oud/W
TLSH
T13DD36C11B582D831D17E183806B9D6265B6EBCB0DF65ADDF9BC409690E782C1DE30EB3
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
34021249eb5977343ae5de4e30e0817f37824009561b3eaa4e90130430ce8615

File Explorer

34021249eb5977343ae5de4e30e0817f37824009561b3eaa4e90130430ce8615

.dll 133KB

34021249eb5977343ae5de4e30e0817f37824009561b3eaa4e90130430ce8615

IMPHASH 697a9252a86a79b2712074baa67e5f6d
SHA256 34021249eb5977343ae5de4e30e0817f37824009561b3eaa4e90130430ce8615
MD5 c9fd0a9370d77b1eef1630a67dd02933
SHA1 de098f4d74cddd45070917e6f4f6bd241481a60c
SHA512 91b040efc43130685d645dd28263e0a1f86e1a6658ff340a4e4b530def3e6c5c1818e49dc6ca5c3c2f601fc1fa6ffe2695153a808bbe51547e9444ec7405b6b7
SSDEEP 3072:Bzqbn5LHYID9n2RhK7hwZFUf6v8wWT5Vwp7+uC8H/W:BGbnhHYIVCK764yt1oud/W
TLSH
T13DD36C11B582D831D17E183806B9D6265B6EBCB0DF65ADDF9BC409690E782C1DE30EB3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

5

Entry point

17960

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

E:\work\DSE-V6-6.8.6-R2\Enterprise\bin\MgrDll.pdb

advapi32

RegOpenKeyA RegQueryValueExA StartServiceCtrlDispatcherA RegCloseKey

ws2_32

getsockname htonl WSAGetLastError WSACleanup gethostname closesocket gethostbyname socket setsockopt send select recv ntohs ntohl htons connect WSAStartup

user32

SetProcessWindowStation OpenWindowStationA wsprintfA GetProcessWindowStation

kernel32

WriteConsoleW FlushFileBuffers SetFilePointerEx GetConsoleMode GetConsoleCP WriteFile HeapReAlloc HeapSize SetStdHandle GetStringTypeW GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage InterlockedExchange SetEvent ResetEvent WaitForSingleObject Sleep CloseHandle lstrcpyA CreateEventA CancelIo VirtualAlloc VirtualFree InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection TerminateThread GetTickCount lstrlenA GlobalMemoryStatusEx SetUnhandledExceptionFilter SetErrorMode ReleaseMutex GetSystemInfo GetTickCount64 MapViewOfFile CreateMutexA OpenMutexA OpenEventA OpenFileMappingA OutputDebugStringA GetDiskFreeSpaceExA GetVersionExA UnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW FindNextFileA RaiseException RtlUnwind InterlockedFlushSList GetLastError SetLastError EncodePointer InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetModuleFileNameA MultiByteToWideChar WideCharToMultiByte DecodePointer HeapAlloc HeapFree LCMapStringW GetACP GetStdHandle GetFileType FindClose FindFirstFileExA CreateFileW

Sharing

General

Malware Config

Signatures

File Explorer

34021249eb5977343ae5de4e30e0817f37824009561b3eaa4e90130430ce8615

advapi32

ws2_32

user32

kernel32

generic