tmp5yqo40if

Sharing

Copy URL Twitter E-mail

General

Target
tmp5yqo40if
Size 273KB
Sample260522-taa2csay5x
SHA256 617ffe45051f1349e2052b6dec6701b61951e53b193bd2fbf7cc1f8c3c6006e6
MD5 37e4c2e54a827a37a04ebb9a5eaebed6
SHA1 67688a550f8a0075c35e505d81f654a0cac0c1d7
SHA512 cbabf509a0eb6aec3bdd314fb3cf703a6443a9796fd1e7fbe5c26e0a70d1a6853dec48b8ca71619e6b9c59e2be85db3835580cb44bc94e0777b12c86f10886bf
SSDEEP 6144:4sBFm+fWQX6VpYlaC0H2FLaOyaeYeflemO+r4RmdT3hl/FTYSkN1:brfWVWlngwLaFaZef1r4RYRl/Nj
TLSH
T13E549CD2FF2F509BEEFE633D75BE32936205690ADA5126132881C433889D52863175BF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
tmp5yqo40if

File Explorer

tmp5yqo40if

.exe 273KB

IMPHASH f3ad8c1d2d1b3f683bc0c68e3cb54257
SHA256 617ffe45051f1349e2052b6dec6701b61951e53b193bd2fbf7cc1f8c3c6006e6
MD5 37e4c2e54a827a37a04ebb9a5eaebed6
SHA1 67688a550f8a0075c35e505d81f654a0cac0c1d7
SHA512 cbabf509a0eb6aec3bdd314fb3cf703a6443a9796fd1e7fbe5c26e0a70d1a6853dec48b8ca71619e6b9c59e2be85db3835580cb44bc94e0777b12c86f10886bf
SSDEEP 6144:4sBFm+fWQX6VpYlaC0H2FLaOyaeYeflemO+r4RmdT3hl/FTYSkN1:brfWVWlngwLaFaZef1r4RYRl/Nj
TLSH
T13E549CD2FF2F509BEEFE633D75BE32936205690ADA5126132881C433889D52863175BF
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

12861

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

oleaut32

SysFreeString

ole32

CoCreateGuid StringFromCLSID CoGetMalloc CoTaskMemFree

kernel32

DeleteCriticalSection GetTimeZoneInformation CloseHandle GetModuleHandleW VirtualQuery CopyFileW TlsFree WaitForSingleObject UnhandledExceptionFilter FormatMessageW ReadFile WTSGetActiveConsoleSessionId GetProcessHeap GetTempPathW InitializeCriticalSectionAndSpinCount SetLastError TlsAlloc OpenProcess DisableThreadLibraryCalls DeviceIoControl LoadLibraryExW FindFirstFileW CreateFileW OpenThread SetProcessAffinityMask GetTempFileNameW LeaveCriticalSection LoadResource TlsGetValue LockResource DeleteFileW IsDebuggerPresent CreateFileMappingW FindResourceW RaiseException UnmapViewOfFile QueryDosDeviceW OutputDebugStringW HeapFree HeapSize LocalAlloc SizeofResource GetSystemInfo HeapAlloc FreeLibrary GetSystemTimeAsFileTime EnterCriticalSection GetVolumeInformationW HeapDestroy GetDriveTypeW GetCurrentThreadId GetProcessAffinityMask IsBadStringPtrW SetFileAttributesW GetFileSize SystemTimeToFileTime TlsSetValue MapViewOfFile lstrlenW ExpandEnvironmentStringsW FindCloseChangeNotification GetSystemTime FindResourceExW FindClose FindFirstChangeNotificationW GetThreadPriority FileTimeToSystemTime GetUserDefaultUILanguage FindNextChangeNotification LocalFree WideCharToMultiByte GetShortPathNameW SetUnhandledExceptionFilter SetThreadPriority GetLogicalDrives TryEnterCriticalSection HeapReAlloc GetFileAttributesExW FindNextFileW GetVersion VirtualAllocEx

user32

MsgWaitForMultipleObjects DispatchMessageA IsWindowUnicode DispatchMessageW GetDesktopWindow GetMessageA PeekMessageW GetSystemMetrics TranslateMessage GetMessageW

dbghelp

MakeSureDirectoryPathExists SymRegisterFunctionEntryCallback64 SymLoadModule64 WinDbgExtensionDllInit DbgHelpCreateUserDump SymGetLineFromName SymGetModuleBase64 SymLoadModule SymEnumerateSymbolsW64 ImageRvaToVa SymUnloadModule64 SymGetTypeFromName

dfsshlex

DllCanUnloadNow DllUnregisterServer

Name

.text

Size

94KB

Virtual Size

94KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.TmyIJuZ

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pLeW

Size

1024B

Virtual Size

631B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ODkL

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.iFtr

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

130KB

Virtual Size

130KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.sVZxM

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.XSZcc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.NaKWH

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ghVZOjc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.ueYo

Size

512B

Virtual Size

436B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

tmp5yqo40if

oleaut32

ole32

kernel32

user32

dbghelp

dfsshlex

generic