tmp26zhq9yt

Sharing

Copy URL Twitter E-mail

General

Target
tmp26zhq9yt
Size 188KB
Sample260522-nb4geahv2j
SHA256 381a6c52b52b0fdc7a2c37eecb36ea65ff14384b57127d79210770222b2003de
MD5 ebb5b44a3bf781fc8bbdf214c42acdb3
SHA1 60a320b95796a30f922942b61829295f9a334071
SHA512 134edcaed46a24e134a593021af6235a9da133c334bb1d1ed2300b3499f0090ce9a502afe93398d0df95e46b5d893c58c823dab22c914aac9a13643420f1d294
SSDEEP 3072:uQYsF6tqeViNtUOw1e1Hoakci1YeAoEnO4rC7tT7oerHcpI5qfPWXQ8RtEugCVit:uQVbe2tUJd3c+AoqO4fe4IMiJRCu0
TLSH
T179146C07BA082251D46E1B7640F83B59D27C9C293B27774B19297BBCE8753C26E1E2CD
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
tmp26zhq9yt

File Explorer

tmp26zhq9yt

.exe 188KB

IMPHASH 1b0090f7784edbe92eda073ef8f1c3ce
SHA256 381a6c52b52b0fdc7a2c37eecb36ea65ff14384b57127d79210770222b2003de
MD5 ebb5b44a3bf781fc8bbdf214c42acdb3
SHA1 60a320b95796a30f922942b61829295f9a334071
SHA512 134edcaed46a24e134a593021af6235a9da133c334bb1d1ed2300b3499f0090ce9a502afe93398d0df95e46b5d893c58c823dab22c914aac9a13643420f1d294
SSDEEP 3072:uQYsF6tqeViNtUOw1e1Hoakci1YeAoEnO4rC7tT7oerHcpI5qfPWXQ8RtEugCVit:uQVbe2tUJd3c+AoqO4fe4IMiJRCu0
TLSH
T179146C07BA082251D46E1B7640F83B59D27C9C293B27774B19297BBCE8753C26E1E2CD
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

77828

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

lstrlenW MultiByteToWideChar AreFileApisANSI GetModuleHandleA FreeLibrary lstrcpyA lstrlenA CloseHandle CreateMutexA SetLastError GetFileAttributesA LocalFree GetProcAddress InterlockedDecrement GetStartupInfoA lstrcpynA LoadLibraryA CancelWaitableTimer GetTickCount ActivateActCtx GlobalFindAtomA GetACP OpenWaitableTimerA OpenWaitableTimerW GetOEMCP VirtualProtect GetFullPathNameA GetLastError GetModuleFileNameA WideCharToMultiByte GetCurrentThreadId

user32

GetForegroundWindow IsWindowUnicode GetDesktopWindow IsWindowVisible IsZoomed GetDlgCtrlID EnableWindow UpdateWindow SetRect ReleaseCapture SetCapture SetWindowTextA wsprintfW GetWindowRect EnumChildWindows DefWindowProcA GrayStringA GetParent PtInRect IsWindow FillRect GetSystemMetrics GetWindowTextA GetSystemMenu SetForegroundWindow IsWindowEnabled CharUpperA GetTopWindow SendMessageA TabbedTextOutA DrawTextA OffsetRect

gdi32

LPtoDP CreatePalette CreateFontIndirectA SetPixel Polyline GetTextColor BitBlt PtVisible PtInRegion TextOutA DPtoLP CreatePolygonRgn SetRectRgn CombineRgn RectVisible CreateRectRgn GetObjectA

advapi32

RegDeleteValueA CryptDeriveKey CryptAcquireContextA CryptDecrypt RegOpenKeyExA RegDeleteValueW RegCreateKeyExA FreeSid IsTextUnicode CryptCreateHash LsaFreeMemory RegCloseKey RegSetValueExW RegOpenCurrentUser LsaOpenPolicy RegEnumValueW RegDeleteKeyW RegOpenKeyExW RegCreateKeyExW RegEnumKeyW RegQueryValueExW LsaClose CryptDestroyHash CryptReleaseContext EqualSid CryptDestroyKey CryptHashData RegEnumValueA RegSetValueExA RegQueryValueExA CryptEncrypt RegOpenKeyA

shell32

ShellExecuteA SHGetMalloc SHGetDesktopFolder SHGetPathFromIDListA

ole32

CoUninitialize CoCreateInstance StringFromCLSID CoInitialize CoTaskMemFree CLSIDFromProgID

comctl32

_TrackMouseEvent InitCommonControlsEx

version

GetFileVersionInfoA VerQueryValueA GetFileVersionInfoSizeA

oledlg

ord8 OleUIBusyW

msvcrt

_adjust_fdiv _CIcos _controlfp exit free _vsnprintf _strdup _initterm _mbscmp __getmainargs _splitpath _acmdln __dllonexit _onexit _except_handler3 __setusermatherr __CxxFrameHandler _exit ??1type_info@@UAE@XZ _setmbcp _mbsicmp _CxxThrowException _XcptFilter ?terminate@@YAXXZ __p__commode __p__fmode __set_app_type

Name

.text

Size

71KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.text

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

28KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

18KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data2

Size

512B

Virtual Size

152B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

57KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

tmp26zhq9yt

kernel32

user32

gdi32

advapi32

shell32

ole32

comctl32

version

oledlg

msvcrt

generic