2f206642f20c935ce5e82951be704c03e1cc94aec0550390ad2d2ba54244cff6

Sharing

Copy URL Twitter E-mail

General

Target
2f206642f20c935ce5e82951be704c03e1cc94aec0550390ad2d2ba54244cff6
Size 209KB
Sample260508-j7clcaex2s
SHA256 2f206642f20c935ce5e82951be704c03e1cc94aec0550390ad2d2ba54244cff6
MD5 ceef362c0207315b9028a6cb13cc0cff
SHA1 db24df6a46282e210be3e313a3935527cae398ad
SHA512 2cc26077181446f58eaedec04f0659c8e55a82f2dc26fe75064233d15cb5ef1825754f3abf1e2200b180f4f47f753a841df4312856bb4d425e697a0581fc11f3
SSDEEP 3072:FTmyoMO3QAE64G507ryBY11GMuvC0z7GBmYzmijHWpolev8wt24xi+4USwaW:1CQ44G67ry41GMgXzurjwth7aW
TLSH
T1DA24390072C19874F8BB1E395AB4866A4E3E7D601F65EDDF97C01D1A0A786E1DB30E72
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2f206642f20c935ce5e82951be704c03e1cc94aec0550390ad2d2ba54244cff6

File Explorer

2f206642f20c935ce5e82951be704c03e1cc94aec0550390ad2d2ba54244cff6

.dll 209KB

2f206642f20c935ce5e82951be704c03e1cc94aec0550390ad2d2ba54244cff6

IMPHASH b63c3b26ef958f173551f0d893389a60
SHA256 2f206642f20c935ce5e82951be704c03e1cc94aec0550390ad2d2ba54244cff6
MD5 ceef362c0207315b9028a6cb13cc0cff
SHA1 db24df6a46282e210be3e313a3935527cae398ad
SHA512 2cc26077181446f58eaedec04f0659c8e55a82f2dc26fe75064233d15cb5ef1825754f3abf1e2200b180f4f47f753a841df4312856bb4d425e697a0581fc11f3
SSDEEP 3072:FTmyoMO3QAE64G507ryBY11GMuvC0z7GBmYzmijHWpolev8wt24xi+4USwaW:1CQ44G67ry41GMgXzurjwth7aW
TLSH
T1DA24390072C19874F8BB1E395AB4866A4E3E7D601F65EDDF97C01D1A0A786E1DB30E72
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

44485

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

E:\work\DSE-V6-6.8.6-R2\Enterprise\bin\MgrDll.pdb

advapi32

SetServiceStatus RegisterServiceCtrlHandlerA DuplicateTokenEx SetTokenInformation RegCloseKey RegOpenKeyExA RegQueryValueExA OpenProcessToken AdjustTokenPrivileges LookupPrivilegeValueA

kernel32

WriteConsoleW GetConsoleMode GetConsoleCP FlushFileBuffers SetStdHandle GetStringTypeW HeapSize SetFilePointerEx FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP IsValidCodePage FindFirstFileExA LCMapStringW InterlockedExchange SetEvent WaitForSingleObject Sleep CloseHandle lstrcpyA GetProcAddress ResetEvent CreateEventA LoadLibraryA GetSystemDirectoryA InitializeCriticalSection EnterCriticalSection LeaveCriticalSection DeleteCriticalSection GetSystemTimes DecodePointer LocalAlloc LocalFree RaiseException GetLastError InitializeCriticalSectionAndSpinCount GetLogicalDriveStringsA GetModuleHandleA OutputDebugStringA LocalReAlloc WriteFile FindClose lstrlenA GetDriveTypeA GetDiskFreeSpaceExA FindNextFileA GetVolumeInformationA GetModuleFileNameA GlobalMemoryStatusEx GetVersionExA TerminateThread GetTickCount GetProcessHandleCount OpenProcess GetCurrentProcess CreateThread CreateToolhelp32Snapshot Process32First Process32Next HeapAlloc HeapFree GetProcessHeap LocalSize TerminateProcess GetCurrentThreadId SetUnhandledExceptionFilter SetErrorMode ReleaseMutex MapViewOfFile UnmapViewOfFile CreateMutexA OpenEventA CreateWaitableTimerA OpenFileMappingA FreeConsole UnhandledExceptionFilter IsProcessorFeaturePresent CreateEventW GetModuleHandleW IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead OutputDebugStringW GetFileType GetStdHandle GetACP HeapReAlloc MultiByteToWideChar WideCharToMultiByte ExitProcess GetModuleHandleExW FreeLibraryAndExitThread ExitThread LoadLibraryExW FreeLibrary TlsFree TlsSetValue TlsGetValue TlsAlloc EncodePointer SetLastError InterlockedFlushSList RtlUnwind CreateFileW

user32

OpenDesktopA GetLastInputInfo wsprintfA MessageBoxA OpenInputDesktop GetProcessWindowStation SetProcessWindowStation OpenWindowStationA GetUserObjectInformationA GetThreadDesktop CloseDesktop SetThreadDesktop

psapi

EnumProcessModules GetModuleFileNameExA

wtsapi32

WTSQueryUserToken

Sharing

General

Malware Config

Signatures

File Explorer

2f206642f20c935ce5e82951be704c03e1cc94aec0550390ad2d2ba54244cff6

advapi32

kernel32

user32

psapi

wtsapi32

generic