2ad7138d2b7d752947a4bb0b6fbdf5ba00d2804db7fee392f13e04ee2e72451e

Sharing

Copy URL Twitter E-mail

General

Target
2ad7138d2b7d752947a4bb0b6fbdf5ba00d2804db7fee392f13e04ee2e72451e
Size 2.4MB
Sample260531-e6l16sbv4m
SHA256 2ad7138d2b7d752947a4bb0b6fbdf5ba00d2804db7fee392f13e04ee2e72451e
MD5 4f61363cd0e9f818666c410aa000820a
SHA1 c6cf86c7ee0cf5db9e257d64e4768f66f30cb62b
SHA512 47bebb2f4c854f2a2a988d9358940adbd45b487300825fce880a167943caa4ac63247e3e8da46b245e4a4bd54479e3b53533fe3ca4bcb33cd54bdd09d11b3f44
SSDEEP 49152:0Zqw7ajPZ258ictA+L6kCHIceaHN46IgEyqhfbFZHS3niIPNe0ms:IMhXi0A+8HIceiOdPZHQiIk0
TLSH
T1D8C5026353644095E1E1DD3E963B7EF871FA4756CB80E47996EEDCC228219E2E323903
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2ad7138d2b7d752947a4bb0b6fbdf5ba00d2804db7fee392f13e04ee2e72451e

File Explorer

2ad7138d2b7d752947a4bb0b6fbdf5ba00d2804db7fee392f13e04ee2e72451e

.dll 2.4MB

2ad7138d2b7d752947a4bb0b6fbdf5ba00d2804db7fee392f13e04ee2e72451e

IMPHASH f540a2e43d9750b4e81bc2d4ba4a2633
SHA256 2ad7138d2b7d752947a4bb0b6fbdf5ba00d2804db7fee392f13e04ee2e72451e
MD5 4f61363cd0e9f818666c410aa000820a
SHA1 c6cf86c7ee0cf5db9e257d64e4768f66f30cb62b
SHA512 47bebb2f4c854f2a2a988d9358940adbd45b487300825fce880a167943caa4ac63247e3e8da46b245e4a4bd54479e3b53533fe3ca4bcb33cd54bdd09d11b3f44
SSDEEP 49152:0Zqw7ajPZ258ictA+L6kCHIceaHN46IgEyqhfbFZHS3niIPNe0ms:IMhXi0A+8HIceiOdPZHQiIk0
TLSH
T1D8C5026353644095E1E1DD3E963B7EF871FA4756CB80E47996EEDCC228219E2E323903
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

172897

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

VirtualQuery GetCurrentProcessId CreateToolhelp32Snapshot Module32First Module32Next CloseHandle RtlMoveMemory GetEnvironmentVariableA SetEnvironmentVariableA IsBadCodePtr TlsAlloc TlsGetValue TlsSetValue VirtualAlloc ExitProcess lstrcmpiA IsBadReadPtr GlobalAlloc GetCurrentThreadId GlobalFree GetModuleHandleA GetProcAddress GetCurrentThread ExitThread GetComputerNameA GlobalMemoryStatusEx GlobalSize DeviceIoControl RtlZeroMemory VirtualAllocEx TerminateProcess OpenThread GetThreadTimes VirtualFree GetCurrentProcess FlushInstructionCache VirtualProtect GetProcessHeap HeapAlloc HeapReAlloc HeapFree GetLocalTime FreeLibrary LoadLibraryA LCMapStringA FlushFileBuffers SetStdHandle LCMapStringW SetUnhandledExceptionFilter GetStringTypeW GetStringTypeA MultiByteToWideChar InterlockedIncrement InterlockedDecrement SetFilePointer GetOEMCP GetACP GetCPInfo GetCommandLineA GetVersion RtlUnwind TlsFree SetLastError GetLastError SetHandleCount GetStdHandle GetFileType GetStartupInfoA DeleteCriticalSection GetModuleFileNameA FreeEnvironmentStringsA FreeEnvironmentStringsW WideCharToMultiByte GetEnvironmentStrings GetEnvironmentStringsW GetVersionExA HeapDestroy HeapCreate WriteFile RaiseException InitializeCriticalSection EnterCriticalSection LeaveCriticalSection

user32

GetWindow GetWindowThreadProcessId GetClassNameA wsprintfA MessageBoxA wvsprintfA GetDesktopWindow

ole32

CoInitialize

ws2_32

htons inet_addr closesocket WSAStartup connect select recv gethostbyname WSACleanup inet_ntoa socket send

oleaut32

SystemTimeToVariantTime VariantTimeToSystemTime

Name

.text

Size

204KB

Virtual Size

208KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

18KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

QQFhpZ0

Size

2.2MB

Virtual Size

2.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

1024B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

2ad7138d2b7d752947a4bb0b6fbdf5ba00d2804db7fee392f13e04ee2e72451e

kernel32

user32

ole32

ws2_32

oleaut32

generic