tmprb73gblw

Sharing

Copy URL Twitter E-mail

General

Target
tmprb73gblw
Size 267KB
Sample260602-e8fl6sfs2j
SHA256 372f23855c34c386f150b407ead48c0df971a60033d6523413d22cde7a5404e0
MD5 153e9e10b92c557f07d3e089442bbd0a
SHA1 2881b8b1140c267dfbb4118354a482952915051a
SHA512 9a7b987c91523965f3417c45b06a151d9d088da416afc9c2a3a1313d2a458a7dadd80bc7319789a43b2f1da7391fde4baa1118586673caf205f43f6673fdbe85
SSDEEP 3072:3GlxnBz9w8A1jwDHmcAB+F2SHp13GqlVkRm3l7Vt57deWxLX9l2QOKRs9UE+4y/R:Sq5wDdCn6PlVDPuWxhh5aMyAWmOyR
TLSH
T15044EF732699F5CCD0DA6834D826CE9D0A93782D0BCA600D59FF044EF84772E26EE55E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
tmprb73gblw

File Explorer

tmprb73gblw

.exe 267KB

IMPHASH 239199da8d7b8456b323bf501b3c091d
SHA256 372f23855c34c386f150b407ead48c0df971a60033d6523413d22cde7a5404e0
MD5 153e9e10b92c557f07d3e089442bbd0a
SHA1 2881b8b1140c267dfbb4118354a482952915051a
SHA512 9a7b987c91523965f3417c45b06a151d9d088da416afc9c2a3a1313d2a458a7dadd80bc7319789a43b2f1da7391fde4baa1118586673caf205f43f6673fdbe85
SSDEEP 3072:3GlxnBz9w8A1jwDHmcAB+F2SHp13GqlVkRm3l7Vt57deWxLX9l2QOKRs9UE+4y/R:Sq5wDdCn6PlVDPuWxhh5aMyAWmOyR
TLSH
T15044EF732699F5CCD0DA6834D826CE9D0A93782D0BCA600D59FF044EF84772E26EE55E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

18577

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CancelWaitableTimer HeapSize SetWaitableTimer FormatMessageW RegisterWaitForSingleObject GetCurrentThreadId RaiseException LockResource LoadResource GlobalUnlock ResetEvent FindResourceW WriteFile UnhandledExceptionFilter CreateProcessW SetUnhandledExceptionFilter QueueUserAPC WaitForMultipleObjects InitializeCriticalSectionAndSpinCount FindResourceExW HeapReAlloc LoadLibraryExW HeapDestroy GetModuleHandleW SleepEx lstrlenW TlsSetValue CreateNamedPipeW HeapFree IsDebuggerPresent DisconnectNamedPipe CreateFileW CloseHandle TerminateThread DuplicateHandle UnregisterWaitEx ConnectNamedPipe GlobalLock CancelIo CreateEventW FreeLibrary LocalAlloc SizeofResource CreateSemaphoreW DeleteCriticalSection GetSystemTimeAsFileTime HeapAlloc WaitForSingleObject EnterCriticalSection GetProcessHeap ReadFile GlobalSize LocalFree ResumeThread LeaveCriticalSection SetNamedPipeHandleState GetExitCodeThread ReleaseSemaphore lstrlenA OpenThread CreateWaitableTimerW GetOverlappedResult WaitForMultipleObjectsEx GetTimeFormatA VirtualAllocEx GetModuleHandleA

advapi32

TraceMessage GetTraceLoggerHandle RegQueryValueExW GetTraceEnableFlags ControlTraceW UnregisterTraceGuids RegOpenKeyExW OpenProcessToken RegisterTraceGuidsW GetTraceEnableLevel RegCloseKey GetTokenInformation ConvertSidToStringSidW

user32

CloseClipboard RegisterClipboardFormatW DestroyWindow CharNextW GetWindowThreadProcessId UnregisterClassW ChangeClipboardChain PostThreadMessageW IsWindow TranslateMessage DispatchMessageW GetActiveWindow PostMessageW EnumWindows DefWindowProcW GetOpenClipboardWindow IsClipboardFormatAvailable SendMessageW OpenClipboard RegisterClassExW GetClipboardData GetMessageW CreateWindowExW EmptyClipboard SetClipboardViewer

oleaut32

VariantClear

shlwapi

PathAddBackslashW

iphlpapi

GetAdaptersInfo

ole32

IIDFromString

winspool.drv

DocumentEvent GetPrinterA EXTDEVICEMODE EnumFormsW StartDocDlgA PrinterMessageBoxA AddPrinterDriverExW ClosePrinter AddPrinterW AddPrinterConnectionW SetPortA DeletePrintProcessorA DeletePrinterDataW SetPrinterDataExW

tapi3

DllUnregisterServer

Name

.RINL

Size

2KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_MEM_READ

Name

.text

Size

16KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.IZRX

Size

1024B

Virtual Size

746B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bbFc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.FmeaFg

Size

1024B

Virtual Size

672B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.IKbndOu

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.urRr

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.YsLvTY

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

108KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.iHgb

Size

512B

Virtual Size

464B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xPLULCD

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rdata

Size

209KB

Virtual Size

208KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.GtQUiIX

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gIfquFO

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

tmprb73gblw

kernel32

advapi32

user32

oleaut32

shlwapi

iphlpapi

ole32

winspool.drv

tapi3

generic