1eb3a81ebd16f5913f59b45a8ca225bda970b5752aa95c26868f850ae2c58c92

General

Target
1eb3a81ebd16f5913f59b45a8ca225bda970b5752aa95c26868f850ae2c58c92
Size 365KB
Sample260702-3sz8msgw7v
SHA256 1eb3a81ebd16f5913f59b45a8ca225bda970b5752aa95c26868f850ae2c58c92
MD5 e310117c3619e508269e02d3a4f7e3df
SHA1 636318a97e589734c5405823e3c5f2eb3f4c5df9
SHA512 c68c9243a347aee9a6980f0dd6f28d5aa3f511fd1e5d774b22a3877c386afa5ad0ad434264441ec59b47065aeb26217fcb2f6e262be52f41e5c3167484dcbcdb
SSDEEP 6144:0a0pzalReFb3Xes/bzORBsWiiAorMPbh/j+s945LAOZP3OZluzOcMBW:0aAee//bzcBsfh/ql33scMBW
TLSH
T109849D207542C437D5BE02706878DBAB452D7AA10B3588E7E3DC1E6F1E792C26731E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1eb3a81ebd16f5913f59b45a8ca225bda970b5752aa95c26868f850ae2c58c92

File Explorer

1eb3a81ebd16f5913f59b45a8ca225bda970b5752aa95c26868f850ae2c58c92

.dll 365KB

1eb3a81ebd16f5913f59b45a8ca225bda970b5752aa95c26868f850ae2c58c92

IMPHASH ade2dc8b1713ce00eab5617a3e130679
SHA256 1eb3a81ebd16f5913f59b45a8ca225bda970b5752aa95c26868f850ae2c58c92
MD5 e310117c3619e508269e02d3a4f7e3df
SHA1 636318a97e589734c5405823e3c5f2eb3f4c5df9
SHA512 c68c9243a347aee9a6980f0dd6f28d5aa3f511fd1e5d774b22a3877c386afa5ad0ad434264441ec59b47065aeb26217fcb2f6e262be52f41e5c3167484dcbcdb
SSDEEP 6144:0a0pzalReFb3Xes/bzORBsWiiAorMPbh/j+s945LAOZP3OZluzOcMBW:0aAee//bzcBsfh/ql33scMBW
TLSH
T109849D207542C437D5BE02706878DBAB452D7AA10B3588E7E3DC1E6F1E792C26731E6B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

132111

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

advapi32

AllocateAndInitializeSid SetEntriesInAclW InitializeSecurityDescriptor SetSecurityDescriptorDacl

kernel32

GetCurrentProcess GetModuleFileNameW K32GetProcessImageFileNameA OpenProcess GetModuleHandleExA GetLastError K32GetModuleInformation LoadLibraryW GetProcAddress GetCurrentProcessId GetModuleHandleW FreeLibrary WriteFile GetTempPathW CreateFileW GetFileAttributesW DeleteFileW CloseHandle RemoveVectoredExceptionHandler Thread32Next GetCurrentThreadId SuspendThread ResumeThread CreateToolhelp32Snapshot GetCurrentThread AddVectoredExceptionHandler GetThreadContext TerminateThread FlushInstructionCache SetThreadContext OpenThread TerminateProcess GetModuleHandleA Module32FirstW Module32NextW K32GetModuleBaseNameW VirtualQuery ReadFile GetTickCount64 QueryPerformanceCounter GetTickCount WaitForSingleObject WaitForMultipleObjects VirtualFree CreateThread LocalAlloc CreateEventW CancelSynchronousIo HeapCreate HeapFree Thread32First HeapReAlloc HeapAlloc HeapDestroy VirtualAlloc HeapSize Sleep VirtualProtect WriteConsoleW GetThreadId InitializeConditionVariable ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx TryEnterCriticalSection DeleteCriticalSection MultiByteToWideChar WideCharToMultiByte LCMapStringEx EncodePointer DecodePointer CompareStringEx GetCPInfo GetSystemTimeAsFileTime GetStringTypeW UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead RtlUnwind RaiseException InterlockedFlushSList SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW SetCurrentDirectoryW GetModuleHandleExW GetStdHandle GetFileType LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCommandLineA GetCommandLineW GetEnvironmentStringsW FreeEnvironmentStringsW GetProcessHeap SetStdHandle ReadConsoleW

mscoree

CLRCreateInstance

Name

.text

Size

253KB

Virtual Size

256KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

87KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.data

Size

4KB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.mackt

Size

3KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

1eb3a81ebd16f5913f59b45a8ca225bda970b5752aa95c26868f850ae2c58c92

advapi32

kernel32

mscoree

generic