60093511cb46c3197087c0b7f2eb4640a74731361e4ed9c3b46bc43228209120

Sharing

Copy URL Twitter E-mail

General

Target
60093511cb46c3197087c0b7f2eb4640a74731361e4ed9c3b46bc43228209120
Size 418KB
Sample260509-e6qdlaax3x
SHA256 60093511cb46c3197087c0b7f2eb4640a74731361e4ed9c3b46bc43228209120
MD5 7953214882568b121e992d0db31fd6b5
SHA1 5618c4ff97145d22e698b568e7d14d600c771e44
SHA512 330ed9deeacd5c45264fd2e8a2dc3c1b887d6b9f2c30196f58e1c92a3bf5c806dbf90bc24ff125eb6022c40d2f2c7e44895396acf13beaf887cea36aa402710d
SSDEEP 6144:SRTi00GgDSUzneySUBWT0xHxG/YJ1me2k6StBHUWq+9yNWAKvKIGl9AvXZq2qOqC:SRTiqUzneStfqXmxfF9Z
TLSH
T111943B8776E85CE7EA15833D05D7D332223EF99083129B172A20E7360E17ED17F8665A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
60093511cb46c3197087c0b7f2eb4640a74731361e4ed9c3b46bc43228209120

File Explorer

60093511cb46c3197087c0b7f2eb4640a74731361e4ed9c3b46bc43228209120

.exe 418KB

60093511cb46c3197087c0b7f2eb4640a74731361e4ed9c3b46bc43228209120

IMPHASH b6ecfb87d69f4e9b87f483b93b7deb15
SHA256 60093511cb46c3197087c0b7f2eb4640a74731361e4ed9c3b46bc43228209120
MD5 7953214882568b121e992d0db31fd6b5
SHA1 5618c4ff97145d22e698b568e7d14d600c771e44
SHA512 330ed9deeacd5c45264fd2e8a2dc3c1b887d6b9f2c30196f58e1c92a3bf5c806dbf90bc24ff125eb6022c40d2f2c7e44895396acf13beaf887cea36aa402710d
SSDEEP 6144:SRTi00GgDSUzneySUBWT0xHxG/YJ1me2k6StBHUWq+9yNWAKvKIGl9AvXZq2qOqC:SRTiqUzneStfqXmxfF9Z
TLSH
T111943B8776E85CE7EA15833D05D7D332223EF99083129B172A20E7360E17ED17F8665A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

GetTokenInformation OpenProcessToken

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC DeleteDC DeleteObject SelectObject

gdiplus

GdipAlloc GdipCloneImage GdipCreateBitmapFromHBITMAP GdipDisposeImage GdipFree GdipGetImageEncoders GdipGetImageEncodersSize GdipSaveImageToStream GdiplusStartup

kernel32

AddAtomA CloseHandle CreateEventA CreateMutexA CreatePipe CreateProcessA CreateSemaphoreA CreateThread DeleteCriticalSection DuplicateHandle EnterCriticalSection FindAtomA FlushFileBuffers GetAtomNameA GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetExitCodeProcess GetHandleInformation GetLastError GetModuleFileNameA GetProcessAffinityMask GetStartupInfoA GetSystemTimeAsFileTime GetThreadContext GetThreadPriority GetTickCount GlobalAlloc GlobalLock GlobalSize GlobalUnlock InitializeCriticalSection LeaveCriticalSection PeekNamedPipe QueryPerformanceCounter RaiseException ReadFile ReleaseMutex ReleaseSemaphore ResetEvent ResumeThread RtlAddFunctionTable RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetCriticalSectionSpinCount SetEvent SetLastError SetProcessAffinityMask SetThreadContext SetThreadPriority SetUnhandledExceptionFilter Sleep SuspendThread TerminateProcess TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection UnhandledExceptionFilter VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WriteFile

msvcrt

__C_specific_handler __dllonexit __getmainargs __initenv __iob_func __lconv_init __set_app_type __setusermatherr _acmdln _amsg_exit _beginthreadex _cexit _endthreadex _fmode _ftime _initterm _lock _onexit _setjmp _unlock _vsnprintf _write abort calloc exit fflush fprintf fputc fputs free fwrite longjmp malloc memcmp memcpy memmove memset printf puts realloc signal sprintf strcmp strlen strncmp strstr vfprintf wcscmp

ole32

CreateStreamOnHGlobal

user32

GetDC GetSystemMetrics ReleaseDC

ws2_32

WSAGetLastError WSAStartup closesocket connect htonl htons inet_addr recv recvfrom send sendto socket

Name

.text

Size

101KB

Virtual Size

101KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

73KB

Virtual Size

73KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

14KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

112B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

104B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

58KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

1024B

Virtual Size

806B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

15KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/92

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

60093511cb46c3197087c0b7f2eb4640a74731361e4ed9c3b46bc43228209120

advapi32

gdi32

gdiplus

kernel32

msvcrt

ole32

user32

ws2_32

generic