tmpzkihvgk7

Sharing

Copy URL Twitter E-mail

General

Target
tmpzkihvgk7
Size 246KB
Sample260522-v2f75ady91
SHA256 59d688da85736ff7236189319f69e04350201f8d48adb2fb7bad8d2dd0962756
MD5 91b65e2be868d85bb583413ff6d5d7c1
SHA1 591c02b902d525444fd1c4e470d00966e9189a8f
SHA512 bb28ae79746d51df334ab406b369f9024afbd9228ccbfc99e0c39d1f36940ee7c9b1ff5074762c918adbdeafdfd0fc4b4a832952446f4e14685ce0fe82b6dfff
SSDEEP 6144:lh/W35vSV6Bui97AdB+xgf7Oy7tJlL3aVXGT2p3wZWv:KJv6i976HfN7rl2VXPp3E
TLSH
T127342343E962AEF0D74512B03D22495D92EE5FE41D37D90FBF82305CAA76CE1BA18271
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
tmpzkihvgk7

File Explorer

tmpzkihvgk7

.exe 246KB

IMPHASH d5a771212f81228efbbced6562ccb43e
SHA256 59d688da85736ff7236189319f69e04350201f8d48adb2fb7bad8d2dd0962756
MD5 91b65e2be868d85bb583413ff6d5d7c1
SHA1 591c02b902d525444fd1c4e470d00966e9189a8f
SHA512 bb28ae79746d51df334ab406b369f9024afbd9228ccbfc99e0c39d1f36940ee7c9b1ff5074762c918adbdeafdfd0fc4b4a832952446f4e14685ce0fe82b6dfff
SSDEEP 6144:lh/W35vSV6Bui97AdB+xgf7Oy7tJlL3aVXGT2p3wZWv:KJv6i976HfN7rl2VXPp3E
TLSH
T127342343E962AEF0D74512B03D22495D92EE5FE41D37D90FBF82305CAA76CE1BA18271
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

13810

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegSetValueExW RegQueryValueExA GetTraceEnableFlags RegisterTraceGuidsW RegCreateKeyExW RegOpenKeyExW UnregisterTraceGuids RegQueryInfoKeyW ControlTraceW TraceMessage RegCloseKey RegEnumKeyExW RegDeleteValueW RegDeleteKeyW GetTraceLoggerHandle RegQueryValueExW GetTraceEnableLevel

kernel32

GetSystemTime CloseHandle FindResourceW UnhandledExceptionFilter LeaveCriticalSection LoadLibraryExW HeapReAlloc GetCurrentThreadId FindResourceExW CreateFileW HeapSize GetSystemTimeAsFileTime IsDebuggerPresent RaiseException SetUnhandledExceptionFilter LoadResource lstrlenW GetProcessHeap HeapFree DeviceIoControl LockResource DeleteCriticalSection SizeofResource EnterCriticalSection LocalAlloc GetACP FreeLibrary SetLastError WideCharToMultiByte HeapAlloc HeapDestroy lstrcmpiW DisableThreadLibraryCalls lstrlenA GetModuleHandleW VirtualAllocEx IsBadWritePtr

iphlpapi

GetAdaptersAddresses GetIpForwardTable GetIpAddrTable GetAdaptersInfo

shlwapi

PathAddBackslashW SHDeleteKeyW

ole32

IIDFromString CoTaskMemAlloc CoTaskMemRealloc CLSIDFromString CoTaskMemFree CoCreateInstance

oleaut32

VarUI4FromStr

user32

CharNextW

userenv

GetAllUsersProfileDirectoryA RsopResetPolicySettingStatus DllCanUnloadNow DllUnregisterServer GetGPOListA

dsound

DirectSoundCreate8

Name

.text

Size

222KB

Virtual Size

221KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.KbNK

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rdata

Size

2KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.mMPya

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

8KB

Virtual Size

201KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.ZBwRRYc

Size

1024B

Virtual Size

654B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.CeFeRYc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

tmpzkihvgk7

advapi32

kernel32

iphlpapi

shlwapi

ole32

oleaut32

user32

userenv

dsound

generic