tmpjl2jia4e

Sharing

Copy URL Twitter E-mail

General

Target
tmpjl2jia4e
Size 266KB
Sample260522-vm2khsbs7k
SHA256 f4ee17b86878a8ff0b395c76b2e88dbb5edcfa0e8dd57ff4794c01a3ad0aeb24
MD5 b17a19766f57baa8ed903f01e3d1d419
SHA1 271b1ec704f25443f782a844ed21c41680dce132
SHA512 c69e0c35b8d305dfc7738b03fc2f6850c066eb4cd899116ea943dca66c659026ba68b12800618cb76b6f5f3a711764dd8af5004377e4b52a93ec7ade8030d36a
SSDEEP 6144:7HuU/QKjlTAjV+1gAfuV81/2PhKFt8VlPGd:TuU/PjN99fG81qKXsGd
TLSH
T1D4440287E693A592E1B056785F5366D2F92CEC0323952267DBC034C93CB2EA1F570F62
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
tmpjl2jia4e

File Explorer

tmpjl2jia4e

.exe 266KB

IMPHASH 2077126de2671ebeaaf420d106d4e53c
SHA256 f4ee17b86878a8ff0b395c76b2e88dbb5edcfa0e8dd57ff4794c01a3ad0aeb24
MD5 b17a19766f57baa8ed903f01e3d1d419
SHA1 271b1ec704f25443f782a844ed21c41680dce132
SHA512 c69e0c35b8d305dfc7738b03fc2f6850c066eb4cd899116ea943dca66c659026ba68b12800618cb76b6f5f3a711764dd8af5004377e4b52a93ec7ade8030d36a
SSDEEP 6144:7HuU/QKjlTAjV+1gAfuV81/2PhKFt8VlPGd:TuU/PjN99fG81qKXsGd
TLSH
T1D4440287E693A592E1B056785F5366D2F92CEC0323952267DBC034C93CB2EA1F570F62
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16062

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

lstrcmpA SetStdHandle GlobalLock FindClose WriteFile IsDebuggerPresent GetConsoleMode GetOEMCP VirtualFree ReleaseMutex GetSystemInfo HeapReAlloc LCMapStringW DeleteFileW GetCurrentThreadId GetLocalTime UnhandledExceptionFilter GetFileType GetModuleHandleA FreeEnvironmentStringsA TlsAlloc LCMapStringA IsProcessorFeaturePresent WriteConsoleW WritePrivateProfileStringA TlsSetValue SetLastError TlsGetValue WaitForSingleObject SizeofResource GetConsoleOutputCP lstrcmpiA lstrcatA LoadResource CreateFileA CreateFileW SetFileAttributesA FlushFileBuffers WriteConsoleA GetThreadLocale lstrcpyA CreateMutexA GlobalAlloc WaitForMultipleObjects CreateDirectoryW GetCommandLineA SetUnhandledExceptionFilter SetHandleCount HeapFree IsDBCSLeadByte DeleteFileA FreeEnvironmentStringsW GetACP WaitForSingleObjectEx WideCharToMultiByte GetProcessHeap RaiseException TlsFree HeapDestroy DeleteCriticalSection GetSystemTimeAsFileTime GetConsoleCP RtlUnwind VirtualAlloc HeapSize GetStdHandle CreateMutexW GetTempPathW lstrlenW HeapAlloc ReadFile GlobalUnlock FreeLibrary SetFilePointer FindNextFileA EnterCriticalSection VirtualProtect VirtualQuery lstrlenA TerminateThread LeaveCriticalSection OutputDebugStringA LoadLibraryExA CreateThread FlushInstructionCache MulDiv GetTempFileNameW IsValidCodePage CloseHandle GetTempPathA FindResourceA FindFirstFileA CreateEventA GetStartupInfoA VirtualAllocEx

user32

SetCursor EqualRect GetForegroundWindow SetWindowRgn ShowWindow GetKeyState OffsetRect GetWindowLongA DefWindowProcA SetWindowPos UnregisterClassA CallWindowProcA DestroyWindow IsChild wsprintfA PtInRect MessageBoxA IsWindow GetDC CharNextA GetFocus LoadCursorA UnionRect SetFocus GetParent InvalidateRect GetClientRect IntersectRect SetWindowLongA ReleaseDC

advapi32

RegCloseKey RegQueryValueExW RegDeleteValueA RegCreateKeyExA RegOpenKeyA RegEnumKeyExA RegDeleteKeyA RegQueryInfoKeyA RegOpenKeyExA RegQueryValueExA RegSetValueExA RegOpenKeyExW RegOpenCurrentUser GetSidSubAuthority ClearEventLogA LsaQuerySecret ConvertSidToStringSidA EqualDomainSid CopySid GetFileSecurityW RegCreateKeyA RegReplaceKeyA LsaOpenTrustedDomainByName BackupEventLogA GetNamedSecurityInfoExW RegEnumValueA GetServiceKeyNameA OpenServiceW RegQueryValueA MakeAbsoluteSD BuildExplicitAccessWithNameW IsTokenUntrusted CryptImportKey CloseCodeAuthzLevel SetEntriesInAclA OpenEncryptedFileRawA SetAclInformation NotifyChangeEventLog GetEventLogInformation StopTraceA GetSecurityDescriptorControl ConvertStringSDToSDDomainA LsaICLookupSidsWithCreds UpdateTraceW LsaEnumerateAccountsWithUserRight GetSidIdentifierAuthority CryptSetProviderExA TrusteeAccessToObjectA LsaStorePrivateData QueryServiceLockStatusW LsaAddPrivilegesToAccount ImpersonateSelf ConvertAccessToSecurityDescriptorW IsValidSecurityDescriptor AdjustTokenGroups CredIsMarshaledCredentialW GetExplicitEntriesFromAclA SystemFunction002 InitiateSystemShutdownExA QueryServiceConfig2A QueryServiceStatus CredpEncodeCredential CryptGetHashParam SystemFunction041

oleaut32

SysAllocStringByteLen SysAllocString VarUI4FromStr LoadTypeLi VariantInit OleCreatePropertyFrame SysFreeString LoadRegTypeLi UnRegisterTypeLi DispCallFunc VariantClear VariantChangeType SysStringLen RegisterTypeLi SysStringByteLen VariantCopy

ole32

OleRegGetUserType OleSaveToStream CoCreateInstance CoTaskMemFree CoTaskMemRealloc WriteClassStm StringFromGUID2 CreateOleAdviseHolder CreateDataAdviseHolder CoTaskMemAlloc OleLoadFromStream OleRegEnumVerbs OleRegGetMiscStatus

gdi32

CreateRectRgnIndirect DeleteMetaFile SetWindowExtEx DeleteDC CreateMetaFileA SaveDC SetTextAlign SetViewportOrgEx CreateDCA RestoreDC CloseMetaFile GetDeviceCaps SetWindowOrgEx TextOutA SetMapMode LPtoDP

msieftp

DllCanUnloadNow

Name

.text

Size

20KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.DYGMKZV

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.NnBiof

Size

1024B

Virtual Size

724B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.NPQN

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.QrVSnYc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.jyhI

Size

1024B

Virtual Size

660B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rdata

Size

211KB

Virtual Size

211KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.VwsItm

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.UYcjIK

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.GTPmKT

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

139KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.nUqEyu

Size

512B

Virtual Size

302B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.VZXf

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.Wvsxyo

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

tmpjl2jia4e

kernel32

user32

advapi32

oleaut32

ole32

gdi32

msieftp

generic