tmpab7aztpj

Sharing

Copy URL Twitter E-mail

General

Target
tmpab7aztpj
Size 254KB
Sample260602-ffe1lsdy61
SHA256 557882f400e69f505471263300390961df62255dc1ada499fa3be5b5192f22f3
MD5 0a4d00d6b3f4e24db0e02b71f654ca44
SHA1 173d7f4f10b334aaf573588f2e676d2de3cbf5e7
SHA512 80563fa8e4178df79060110473eba222d6c3ccf0d06bbb1ae9cf04fa5c53b833b2f073224c845931ab93d64d79b48ffdef2026b79fc196e3eca1046bb9d39d19
SSDEEP 6144:IlHRK6RZ/LuFzEDTMZZfIZXNjNsRJNaNWx0IKaZhWZKln10j:IlHg63/LuAMQjsNaIxNTZhCA10j
TLSH
T1B8441363B30AED66E13C16B88CA3082403BB47A4660F576B585C1CB666AF3534F1EDDC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
tmpab7aztpj

File Explorer

tmpab7aztpj

.exe 254KB

IMPHASH 50f763d828d1e1a7b372651b0f5de0b9
SHA256 557882f400e69f505471263300390961df62255dc1ada499fa3be5b5192f22f3
MD5 0a4d00d6b3f4e24db0e02b71f654ca44
SHA1 173d7f4f10b334aaf573588f2e676d2de3cbf5e7
SHA512 80563fa8e4178df79060110473eba222d6c3ccf0d06bbb1ae9cf04fa5c53b833b2f073224c845931ab93d64d79b48ffdef2026b79fc196e3eca1046bb9d39d19
SSDEEP 6144:IlHRK6RZ/LuFzEDTMZZfIZXNjNsRJNaNWx0IKaZhWZKln10j:IlHg63/LuAMQjsNaIxNTZhCA10j
TLSH
T1B8441363B30AED66E13C16B88CA3082403BB47A4660F576B585C1CB666AF3534F1EDDC
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4096

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

netapi32

NetApiBufferFree NetUserEnum

kernel32

lstrcmpW CompareFileTime lstrlenA lstrlenW lstrcpynW FreeLibrary CreateDirectoryW LocalAlloc RemoveDirectoryW GetWindowsDirectoryW LocalFree IsDebuggerPresent GetCurrentThreadId WaitForSingleObject CreateEventW ExpandEnvironmentStringsA OpenEventW GetModuleHandleW GetTempPathW SetUnhandledExceptionFilter GetVersion GetProcAddress

user32

GetForegroundWindow GetSystemMetrics CopyRect RegisterWindowMessageW GetCursorPos InvalidateRect GetFocus LoadCursorW DestroyIcon GetSysColor MoveWindow IsWindow GetTopWindow SetTimer OffsetRect PostMessageW SetWindowPos SendMessageW EnableWindow

gdi32

CreateFontIndirectW CreateRectRgn CreateCompatibleDC DeleteObject CreatePatternBrush CreateSolidBrush

advapi32

IsValidSecurityDescriptor FreeSid RegOpenKeyExA RegQueryValueExA OpenServiceW StartServiceW QueryServiceStatus OpenSCManagerW CloseServiceHandle RegCreateKeyExW RegDeleteValueW RegSetValueExW RegOpenKeyExW RegQueryValueExW RegCloseKey RevertToSelf AddAccessAllowedAce SetSecurityDescriptorOwner AllocateAndInitializeSid InitializeAcl ImpersonateSelf SetSecurityDescriptorDacl InitializeSecurityDescriptor AccessCheck SetSecurityDescriptorGroup OpenThreadToken OpenProcessToken GetLengthSid

shell32

ShellExecuteW

usp10

UspFreeMem ScriptApplyDigitSubstitution ScriptCPtoX ScriptJustify

icmp

IcmpCloseHandle IcmpParseReplies

Name

.text

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.IjU

Size

2KB

Virtual Size

207KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.kXA

Size

2KB

Virtual Size

395KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.ze

Size

2KB

Virtual Size

543KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

2KB

Virtual Size

35KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.UsAk

Size

2KB

Virtual Size

310KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.CW

Size

93KB

Virtual Size

138KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.XLbC

Size

2KB

Virtual Size

74KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

7KB

Virtual Size

72KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

122KB

Virtual Size

156KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

tmpab7aztpj

netapi32

kernel32

user32

gdi32

advapi32

shell32

usp10

icmp

generic