61c734269d76eff25d60d8da4ab107bddec931a9dbf00cad8dd23e60ce2e7011

Sharing

Copy URL Twitter E-mail

General

Target
61c734269d76eff25d60d8da4ab107bddec931a9dbf00cad8dd23e60ce2e7011
Size 13.4MB
Sample260531-pc65csav4q
SHA256 61c734269d76eff25d60d8da4ab107bddec931a9dbf00cad8dd23e60ce2e7011
MD5 8a9ae3875892ff06a045f5922f0265a4
SHA1 9825aeb22e0cb8ab7d0a10e6f923080effe98a7d
SHA512 168d48c6b3087b09576a4ee8387a3f5b6d4668c7be5bf688de91caf4e5043aa4e633364dc82e73520661b28696a311baed639fac7bf26216a64c0331ee020887
SSDEEP 196608:gSgITYIdAVUvRZHbB4hYOL6PXkc1NTx9Pe20/aVHMiu6E:9BTYIdAVUZhQX6vkc3dCahMie
TLSH
T191E6E156EA822135D9792A30153C3EAB96246DC91F300BCBD7ED7CA44A747C31836B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
61c734269d76eff25d60d8da4ab107bddec931a9dbf00cad8dd23e60ce2e7011

File Explorer

61c734269d76eff25d60d8da4ab107bddec931a9dbf00cad8dd23e60ce2e7011

.exe 13.4MB

61c734269d76eff25d60d8da4ab107bddec931a9dbf00cad8dd23e60ce2e7011

IMPHASH 15315652b109019248690eae3d1d1c3a
SHA256 61c734269d76eff25d60d8da4ab107bddec931a9dbf00cad8dd23e60ce2e7011
MD5 8a9ae3875892ff06a045f5922f0265a4
SHA1 9825aeb22e0cb8ab7d0a10e6f923080effe98a7d
SHA512 168d48c6b3087b09576a4ee8387a3f5b6d4668c7be5bf688de91caf4e5043aa4e633364dc82e73520661b28696a311baed639fac7bf26216a64c0331ee020887
SSDEEP 196608:gSgITYIdAVUvRZHbB4hYOL6PXkc1NTx9Pe20/aVHMiu6E:9BTYIdAVUZhQX6vkc3dCahMie
TLSH
T191E6E156EA822135D9792A30153C3EAB96246DC91F300BCBD7ED7CA44A747C31836B9F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

3862480

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

web_lite_installer.exe.pdb

kernel32

AcquireSRWLockExclusive AreFileApisANSI AssignProcessToJobObject CloseHandle CompareStringW ConnectNamedPipe CopyFileW CreateDirectoryW CreateEventA CreateEventW CreateFileA CreateFileMappingW CreateFileW CreateIoCompletionPort CreateMutexW CreateNamedPipeW CreateProcessW CreateThread CreateTimerQueueTimer CreateToolhelp32Snapshot DecodePointer DeleteCriticalSection DeleteFileA DeleteFileW DeleteProcThreadAttributeList DeleteTimerQueueTimer DeviceIoControl DisconnectNamedPipe DuplicateHandle EncodePointer EnterCriticalSection EnumResourceLanguagesW EnumSystemLocalesW ExitProcess ExitThread ExpandEnvironmentStringsW FileTimeToSystemTime FindClose FindFirstFileExW FindNextFileW FindResourceExW FindResourceW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FlushViewOfFile FormatMessageA FormatMessageW FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetComputerNameExW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetDateFormatW GetDiskFreeSpaceA GetDiskFreeSpaceExW GetDiskFreeSpaceW GetDriveTypeW GetEnvironmentStringsW GetEnvironmentVariableW GetExitCodeProcess GetFileAttributesA GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetFileSize GetFileSizeEx GetFileType GetFinalPathNameByHandleW GetFullPathNameA GetFullPathNameW GetGeoInfoW GetLastError GetLocalTime GetLocaleInfoEx GetLocaleInfoW GetLogicalDriveStringsW GetLogicalProcessorInformation GetLogicalProcessorInformationEx GetLongPathNameW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetNamedPipeClientProcessId GetNativeSystemInfo GetOEMCP GetProcAddress GetProcessHeap GetProcessId GetProductInfo GetQueuedCompletionStatus GetStartupInfoW GetStdHandle GetStringTypeW GetSystemDirectoryW GetSystemInfo GetSystemTime GetSystemTimeAsFileTime GetTempFileNameW GetTempPathA GetTempPathW GetThreadId GetThreadPriority GetTickCount GetTimeFormatW GetTimeZoneInformation GetUserDefaultLCID GetUserDefaultLangID GetUserDefaultUILanguage GetUserGeoID GetVersionExW GetWindowsDirectoryW GlobalAlloc GlobalFree GlobalLock GlobalMemoryStatusEx GlobalUnlock HeapAlloc HeapCompact HeapCreate HeapDestroy HeapFree HeapReAlloc HeapSize HeapValidate InitOnceExecuteOnce InitializeConditionVariable InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeProcThreadAttributeList InitializeSListHead InterlockedPushEntrySList IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale IsWow64Process K32GetModuleInformation K32GetProcessMemoryInfo LCMapStringW LeaveCriticalSection LoadLibraryExA LoadLibraryExW LoadLibraryW LoadResource LocalFree LockFile LockFileEx LockResource MapViewOfFile MoveFileExW MoveFileW MultiByteToWideChar OpenEventA OpenEventW OpenMutexW OpenProcess OpenThread OutputDebugStringA OutputDebugStringW PostQueuedCompletionStatus Process32FirstW Process32NextW QueryDosDeviceW QueryFullProcessImageNameW QueryPerformanceCounter QueryPerformanceFrequency QueryThreadCycleTime QueryUnbiasedInterruptTime RaiseException ReOpenFile ReadConsoleW ReadFile ReleaseMutex ReleaseSRWLockExclusive RemoveDirectoryW ReplaceFileW ResetEvent RtlCaptureStackBackTrace RtlUnwind SetDllDirectoryW SetEndOfFile SetEnvironmentVariableW SetEvent SetFileAttributesW SetFileInformationByHandle SetFilePointer SetFilePointerEx SetHandleInformation SetInformationJobObject SetLastError SetStdHandle SetThreadPriority SetUnhandledExceptionFilter SizeofResource Sleep SleepConditionVariableSRW SwitchToThread SystemTimeToFileTime SystemTimeToTzSpecificLocalTime TerminateProcess TerminateThread Thread32First Thread32Next TlsAlloc TlsFree TlsGetValue TlsSetValue TryAcquireSRWLockExclusive TryEnterCriticalSection UnhandledExceptionFilter UnlockFile UnlockFileEx UnmapViewOfFile UnregisterWaitEx UpdateProcThreadAttribute VirtualAlloc VirtualFree VirtualProtect VirtualQuery WTSGetActiveConsoleSessionId WaitForMultipleObjects WaitForSingleObject WaitForSingleObjectEx WaitNamedPipeW WakeAllConditionVariable WakeConditionVariable WideCharToMultiByte WriteConsoleW WriteFile lstrcmpA lstrcpynA lstrcpynW lstrlenW

oleacc

AccessibleObjectFromWindow LresultFromObject

ntdll

NtClose NtOpenKeyEx NtQueryObject NtQueryValueKey RtlFormatCurrentUserKeyPath RtlFreeUnicodeString RtlGetLastNtStatus RtlInitUnicodeString

secur32

GetUserNameExW

wtsapi32

WTSQueryUserToken

Name

.text

Size

4.2MB

Virtual Size

4.2MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

716KB

Virtual Size

715KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

29KB

Virtual Size

180KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rodata

Size

512B

Virtual Size

192B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

333B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

SHARED

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Shared

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

malloc_h

Size

1024B

Virtual Size

704B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

8.3MB

Virtual Size

8.3MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

133KB

Virtual Size

132KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

61c734269d76eff25d60d8da4ab107bddec931a9dbf00cad8dd23e60ce2e7011

kernel32

oleacc

ntdll

secur32

wtsapi32

generic