5c1c58f198e3bb909cf4e23cfd566d7674ea56ad3ba259efcd2d57a876a11e93

Sharing

Copy URL Twitter E-mail

General

Target
5c1c58f198e3bb909cf4e23cfd566d7674ea56ad3ba259efcd2d57a876a11e93
Size 22KB
Sample260528-sveplset2y
SHA256 5c1c58f198e3bb909cf4e23cfd566d7674ea56ad3ba259efcd2d57a876a11e93
MD5 595126f6039362bb4cbddfe3ad67350d
SHA1 7ee8e8b158dedc923d5f709090a9932b35d06e8b
SHA512 05fbfa4a9e7f3f2fafc0419b7ccb90643176e180a69293bad6e021f9c5883012847ec5116c379b5a7dd6e1b537fbc19c3636be1bd0dd1bdcfe38bf2b72d32922
SSDEEP 384:qpUkBayZhivh/zBStLy6buN/tgS1krphFOt0M9yVIIy7h+wb:qGkAyZgZILbu5tgTr7FOt3Q+Dh+
TLSH
T1C3A2F847B99AC0BAD5A70D700C6AFB2E055F3D219F6950FB36D4972E1DB00E144BE14B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5c1c58f198e3bb909cf4e23cfd566d7674ea56ad3ba259efcd2d57a876a11e93

File Explorer

5c1c58f198e3bb909cf4e23cfd566d7674ea56ad3ba259efcd2d57a876a11e93

.dll 22KB

5c1c58f198e3bb909cf4e23cfd566d7674ea56ad3ba259efcd2d57a876a11e93

IMPHASH 65ca07e8a00f22048f652c6702ef0100
SHA256 5c1c58f198e3bb909cf4e23cfd566d7674ea56ad3ba259efcd2d57a876a11e93
MD5 595126f6039362bb4cbddfe3ad67350d
SHA1 7ee8e8b158dedc923d5f709090a9932b35d06e8b
SHA512 05fbfa4a9e7f3f2fafc0419b7ccb90643176e180a69293bad6e021f9c5883012847ec5116c379b5a7dd6e1b537fbc19c3636be1bd0dd1bdcfe38bf2b72d32922
SSDEEP 384:qpUkBayZhivh/zBStLy6buN/tgS1krphFOt0M9yVIIy7h+wb:qGkAyZgZILbu5tgTr7FOt3Q+Dh+
TLSH
T1C3A2F847B99AC0BAD5A70D700C6AFB2E055F3D219F6950FB36D4972E1DB00E144BE14B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

11598

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\winapps\gu6\dll\vc\ConfigDll\sourcecode\Release\Config.pdb

mfc90u

ord6801 ord4173 ord6803 ord4747 ord2251 ord2206 ord6035 ord4179 ord1048 ord5548 ord6741 ord5830 ord4213 ord2087 ord3217 ord5674 ord5676 ord2447 ord4347 ord4996 ord5680 ord5663 ord6018 ord2771 ord2983 ord3112 ord4728 ord4423 ord3115 ord2774 ord2893 ord2764 ord4080 ord4081 ord4071 ord2891 ord4348 ord4905 ord4681 ord3670 ord286 ord280 ord811 ord5851 ord2694 ord4211 ord600 ord296 ord710 ord462 ord794 ord589 ord4043 ord4448 ord4405 ord5979 ord938 ord813 ord2966 ord935 ord605 ord1274 ord321 ord1241 ord1239 ord1264 ord1180 ord1233 ord2084 ord391 ord1152 ord1273 ord1271 ord1145 ord1076 ord1137 ord322 ord802 ord1088 ord801

msvcr90

_initterm __clean_type_info_names_internal ?_type_info_dtor_internal_method@type_info@@QAEXXZ _except_handler4_common _crt_debugger_hook ?terminate@@YAXXZ __CppXcptFilter _adjust_fdiv _amsg_exit _initterm_e _local_unwind4 _encoded_null free _malloc_crt _decode_pointer _onexit _lock _encode_pointer __dllonexit _unlock ??2@YAPAXI@Z __CxxFrameHandler3 wcscpy_s _wcsnicmp

kernel32

GetCurrentProcessId GetSystemTimeAsFileTime SetLastError GetCurrentThreadId GetTickCount QueryPerformanceCounter IsDebuggerPresent SetUnhandledExceptionFilter UnhandledExceptionFilter GetCurrentProcess TerminateProcess InterlockedCompareExchange Sleep InterlockedExchange LocalAlloc LocalFree GetPrivateProfileStringW GetPrivateProfileIntW GetLastError GetModuleFileNameW

advapi32

RegEnumValueW RegRestoreKeyW RegSaveKeyW RegSetValueExW RegQueryValueExW RegQueryInfoKeyW RegFlushKey RegCloseKey RegEnumKeyW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegCreateKeyW RegOpenKeyExW RegOpenKeyW

shlwapi

SHCopyKeyW SHDeleteKeyW SHDeleteValueW SHSetValueW PathFileExistsW SHGetValueW

Sharing

General

Malware Config

Signatures

File Explorer

5c1c58f198e3bb909cf4e23cfd566d7674ea56ad3ba259efcd2d57a876a11e93

mfc90u

msvcr90

kernel32

advapi32

shlwapi

generic