56ada2730511fe547d2e3225e4a8779d091d5ce144e10eb3c7940ac167b98a39

Sharing

Copy URL Twitter E-mail

General

Target
56ada2730511fe547d2e3225e4a8779d091d5ce144e10eb3c7940ac167b98a39
Size 323KB
Sample260702-mshqlags4v
SHA256 56ada2730511fe547d2e3225e4a8779d091d5ce144e10eb3c7940ac167b98a39
MD5 623487fb08110560089032beb607d4a5
SHA1 cf57017e28fd2dc186f341450698653c451e88d8
SHA512 e2d996abb1f851940fac503e40c5e4db0fc064de946eb50eab5d1b80f8cf54b7e9c26d738896451e0ecded8f856840371af3ff9da95ca18aee0af3d3871a7124
SSDEEP 6144:w1vfFGtXWcpBfM7Ggc3gScJRcPzij8JpN/cCXkjrjH:GFGTBfRgc3FcpoUrH
TLSH
T163648E02B482F079DA4F05707539D7795A3E7AB14B60DDEBE7844EB94B30AD04B34E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
56ada2730511fe547d2e3225e4a8779d091d5ce144e10eb3c7940ac167b98a39

File Explorer

56ada2730511fe547d2e3225e4a8779d091d5ce144e10eb3c7940ac167b98a39

.dll 323KB

56ada2730511fe547d2e3225e4a8779d091d5ce144e10eb3c7940ac167b98a39

IMPHASH 36af67d587cd838eb0a0e9440c6c9880
SHA256 56ada2730511fe547d2e3225e4a8779d091d5ce144e10eb3c7940ac167b98a39
MD5 623487fb08110560089032beb607d4a5
SHA1 cf57017e28fd2dc186f341450698653c451e88d8
SHA512 e2d996abb1f851940fac503e40c5e4db0fc064de946eb50eab5d1b80f8cf54b7e9c26d738896451e0ecded8f856840371af3ff9da95ca18aee0af3d3871a7124
SSDEEP 6144:w1vfFGtXWcpBfM7Ggc3gScJRcPzij8JpN/cCXkjrjH:GFGTBfRgc3FcpoUrH
TLSH
T163648E02B482F079DA4F05707539D7795A3E7AB14B60DDEBE7844EB94B30AD04B34E2A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

146888

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

AcquireSRWLockExclusive CheckRemoteDebuggerPresent CloseHandle CreateFileW CreateThread DecodePointer DeleteCriticalSection EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess ExitThread FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FlushInstructionCache FreeEnvironmentStringsW FreeLibrary FreeLibraryAndExitThread GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetFileSizeEx GetFileType GetLastError GetLocaleInfoW GetModuleFileNameA GetModuleFileNameW GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTimeAsFileTime GetUserDefaultLCID GlobalMemoryStatusEx HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead InterlockedFlushSList IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale K32GetModuleInformation LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryExW MultiByteToWideChar QueryPerformanceCounter RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive RtlUnwind SetEndOfFile SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VirtualAlloc VirtualProtect WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile WriteProcessMemory

user32

MessageBoxW

wininet

InternetCloseHandle InternetOpenW InternetSetOptionW

Name

.text

Size

233KB

Virtual Size

232KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

51KB

Virtual Size

50KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

23KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.00cfg

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

920B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

13KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

56ada2730511fe547d2e3225e4a8779d091d5ce144e10eb3c7940ac167b98a39

kernel32

user32

wininet

generic