1ec1196de3df37bb4714ceb4e837919062fe344f007be938a125b3e79fffb26d

General

Target
1ec1196de3df37bb4714ceb4e837919062fe344f007be938a125b3e79fffb26d
Size 3.7MB
Sample260531-gbg5vaas21
SHA256 1ec1196de3df37bb4714ceb4e837919062fe344f007be938a125b3e79fffb26d
MD5 74c3bea51459efac62da7dfb46f2b9fc
SHA1 f8f60eb68eeaa181574afc891a9b46da2ae06532
SHA512 8050a1361abf02af3033ddc821a97beb438487ee5bc2c27aefbcf40f11401f7f8dd26876729c71d9534f02ec7b410ff11013272ee371ca1f06018d887c4f0005
SSDEEP 98304:jBAw/JTrIJSlNOhc1dnFnjcCPQcuuGzrDlUDr:jBAw/JQS3XFnQWtuuur5UDr
TLSH
T1D20633868F4083FBE446433ED1A357613B78EBB567270B6B8A1DB3304EA23C93D95549
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1ec1196de3df37bb4714ceb4e837919062fe344f007be938a125b3e79fffb26d

File Explorer

1ec1196de3df37bb4714ceb4e837919062fe344f007be938a125b3e79fffb26d

.exe 3.7MB

1ec1196de3df37bb4714ceb4e837919062fe344f007be938a125b3e79fffb26d

IMPHASH b478294cc4faca643865f2a902e8a802
SHA256 1ec1196de3df37bb4714ceb4e837919062fe344f007be938a125b3e79fffb26d
MD5 74c3bea51459efac62da7dfb46f2b9fc
SHA1 f8f60eb68eeaa181574afc891a9b46da2ae06532
SHA512 8050a1361abf02af3033ddc821a97beb438487ee5bc2c27aefbcf40f11401f7f8dd26876729c71d9534f02ec7b410ff11013272ee371ca1f06018d887c4f0005
SSDEEP 98304:jBAw/JTrIJSlNOhc1dnFnjcCPQcuuGzrDlUDr:jBAw/JQS3XFnQWtuuur5UDr
TLSH
T1D20633868F4083FBE446433ED1A357613B78EBB567270B6B8A1DB3304EA23C93D95549
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

17973392

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

VirtualAlloc VirtualFree VirtualProtect MapViewOfFile UnmapViewOfFile GetModuleFileNameA GetModuleFileNameW GetModuleHandleA GetProcAddress LoadLibraryA CreateFileA CreateFileW WriteFile CloseHandle GetLocalTime VirtualQuery CreateFileMappingW InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetCurrentProcess FlushInstructionCache GetSystemInfo VirtualProtectEx

user32

wsprintfA

shlwapi

ord158

msvbvm60

EVENT_SINK_GetIDsOfNames __vbaStrI2 __vbaLateIdCall __vbaVarIndexStore __vbaLineInputVar __vbaI2Abs __vbaStrCat __vbaInStrVarB ord660 __vbaSetSystemError __vbaHresultCheckObj __vbaLenVar __vbaVarTstLe __vbaVarCmpGe __vbaVarForInit __vbaI4Abs __vbaObjSet _adj_fdiv_m16i __vbaObjSetAddref __vbaFpR4 __vbaForEachCollVar __vbaFpR8 __vbaErase __vbaFileClose __vbaVarAbs __vbaCyI2 __vbaStrCmp __vbaNextEachCollVar __vbaObjVar __vbaVarLateMemSt __vbaR8Cy __vbaNew __vbaUI1I2 _CIsqrt __vbaVarMul __vbaStrToUnicode __vbaDateStr __vbaI2Str ord608 __vbaVarCmpLe __vbaInStrVar __vbaUbound __vbaVarCat __vbaCheckType _CIlog __vbaVarLateMemCallLdRf _adj_fdiv_m32i __vbaVarSetObj __vbaVarNot _adj_fdivr_m32 __vbaVarTstNe __vbaVarCmpEq __vbaAryLock __vbaStrToAnsi __vbaFpI2 __vbaVarTstGe __vbaCastObj __vbaVarNeg _allmul _CItan __vbaFPInt

Name

.text

Size

Virtual Size

14.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

Virtual Size

324KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.virbox

Size

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.vdata0

Size

Virtual Size

161KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.vdata1

Size

Virtual Size

176KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.virbox3

Size

220KB

Virtual Size

218KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

1ec1196de3df37bb4714ceb4e837919062fe344f007be938a125b3e79fffb26d

kernel32

user32

shlwapi

msvbvm60

generic