14f1d4817d8bcd890f51fba39156a64ef69a33cee1bd4db6f0eafd0836be9b08

General

Target
14f1d4817d8bcd890f51fba39156a64ef69a33cee1bd4db6f0eafd0836be9b08
Size 1.5MB
Sample260703-ld91vsbt7k
SHA256 14f1d4817d8bcd890f51fba39156a64ef69a33cee1bd4db6f0eafd0836be9b08
MD5 97d4a78af8f8c257098d50be6a5630e7
SHA1 8c36ea95c6f4a139b1a9f453905fb563078b746c
SHA512 30a0e7e2a69270b3bbefd1eb604d22a647f712d6ad88198f06d203bb0f15f70bdee0febbab0d204a87b20059ee88e0eaa982f23c76ab7dddb89a491b7715ab52
SSDEEP 24576:iLdhlp3Ebx/NggExb6z63nh5xCSi1W2ihaN3ALq/ZIxXvML8Y8KgSa4m0MEFE6XF:iLHP3G/Nib6G3DxCSBhaN3AGEXvw8vkZ
TLSH
T12765337163F49C9CCD3BA63F7C7A0CCE2312266629EEB1141E007A69CD7795BD596E00
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
14f1d4817d8bcd890f51fba39156a64ef69a33cee1bd4db6f0eafd0836be9b08

File Explorer

14f1d4817d8bcd890f51fba39156a64ef69a33cee1bd4db6f0eafd0836be9b08

.dll 1.5MB

14f1d4817d8bcd890f51fba39156a64ef69a33cee1bd4db6f0eafd0836be9b08

IMPHASH baa93d47220682c04d92f7797d9224ce
SHA256 14f1d4817d8bcd890f51fba39156a64ef69a33cee1bd4db6f0eafd0836be9b08
MD5 97d4a78af8f8c257098d50be6a5630e7
SHA1 8c36ea95c6f4a139b1a9f453905fb563078b746c
SHA512 30a0e7e2a69270b3bbefd1eb604d22a647f712d6ad88198f06d203bb0f15f70bdee0febbab0d204a87b20059ee88e0eaa982f23c76ab7dddb89a491b7715ab52
SSDEEP 24576:iLdhlp3Ebx/NggExb6z63nh5xCSi1W2ihaN3ALq/ZIxXvML8Y8KgSa4m0MEFE6XF:iLHP3G/Nib6G3DxCSBhaN3AGEXvw8vkZ
TLSH
T12765337163F49C9CCD3BA63F7C7A0CCE2312266629EEB1141E007A69CD7795BD596E00
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

4165632

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

AngelicaGet1076SharedNodePoolFreeCount AngelicaGet1076SharedNodePoolInUseCount AngelicaGet1076SharedNodePoolTotalCount AngelicaGetAttachProbeLastError AngelicaGetDiagnosticFlags AngelicaGetInitializationStage AngelicaGetLastErrorMessage AngelicaGetManagedCommittedMegabytes AngelicaGetManagedMappedCacheMegabytes AngelicaGetManagedMappedFileCount AngelicaGetManagedMappedViewCount AngelicaGetManagedMemoryCacheMegabytes AngelicaGetManagedMemoryFileCount AngelicaGetManagedReservedMegabytes AngelicaGetRuntimeLogLastError AngelicaInitialize AngelicaSetDebugMode AngelicaStartHook AngelicaStopHook _AngelicaCloseEncryptedDataMemoryFile@4 _AngelicaCloseEncryptedDataMemoryHandle@4 _AngelicaGetCharEncryptedDataMemoryFile@4 _AngelicaGetEncryptedDataMemoryFileError@4 _AngelicaGetEncryptedDataMemoryFileSize@8 _AngelicaGetsEncryptedDataMemoryFile@12 _AngelicaInitializeThread@4 _AngelicaIsEncryptedDataMemoryFileEof@4 _AngelicaIsEncryptedDataMemoryFileHandle@4 _AngelicaOpenEncryptedDataAsMemoryFileA@4 _AngelicaOpenEncryptedDataAsMemoryFileW@4 _AngelicaReadEncryptedDataMemoryFile@16 _AngelicaReadEncryptedDataMemoryHandle@16 _AngelicaSeekEncryptedDataMemoryFile@12 _AngelicaSetEncryptedDataMemoryFilePointer@16 _AngelicaStatEncryptedDataMemoryFile@8 _AngelicaTellEncryptedDataMemoryFile@4 _AngelicaTransformFileWithGatewayDataKeyW@32 _AngelicaTransformFileWithKeyW@24 _AngelicaUngetCharEncryptedDataMemoryFile@8 do_AddFileToPckFile do_CreatePckFile do_DeleteFromPck do_ExtractAllFiles do_ExtractPartFiles do_RebuildPckFileWithScript do_RenameEntry do_StripPck do_listPathInPck log_regShowFunc pck_DeleteEntry pck_DeleteEntrySubmit pck_ExtractAllFiles pck_ExtractFilesByEntrys pck_GetAdditionalInfo pck_GetAdditionalInfoMaxSize pck_GetCurrentVersionName pck_GetSingleFileData pck_IsValidPck pck_RebuildPckFile pck_RebuildPckFileWithScript pck_RenameEntry pck_RenameSubmit pck_SetAdditionalInfo pck_StringArrayAppend pck_StringArrayReset pck_StripPck pck_TestScript pck_UpdatePckFileSubmit pck_addVersionAlgorithmId pck_addVersionAlgorithmIdByKeys pck_close pck_file_data_area_size pck_file_redundancy_data_size pck_filecount pck_filesize pck_forceBreakThreadWorking pck_getCompressLevel pck_getCompressedSizeInEntry pck_getDefaultCompressLevel pck_getFileEntryByPath pck_getFileOffset pck_getFileSizeInEntry pck_getFilelenBytesOfEntry pck_getFilelenLeftBytesOfEntry pck_getFilesCountInEntry pck_getFoldersCountInEntry pck_getLastErrorMsg pck_getMTMaxMemory pck_getMTMemoryUsed pck_getMaxCompressLevel pck_getMaxMemoryAllowed pck_getMaxThread pck_getMaxThreadUpperLimit pck_getNodeRelativePath pck_getRootNode pck_getUIProgress pck_getUIProgressUpper pck_getUpdateResult_ChangedFileCount pck_getUpdateResult_DuplicateFileCount pck_getUpdateResult_FinalFileCount pck_getUpdateResult_OldFileCount pck_getUpdateResult_PrepareToAddFileCount pck_getVersion pck_getVersionCount pck_getVersionNameById pck_isLastOptSuccess pck_isSupportAddFileToPck pck_isThreadWorking pck_listByNode pck_logDA pck_logDW pck_logEA pck_logEW pck_logIA pck_logIW pck_logNA pck_logNW pck_logWA pck_logWW pck_open pck_regMsgFeedback pck_searchByName pck_setCompressLevel pck_setMTMaxMemory pck_setMaxThread pck_setUIProgress pck_setVersion pck_version

Name

Size

341KB

Virtual Size

812KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

952B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

Size

512B

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

paxjmpyj

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

mpmkbohn

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

14f1d4817d8bcd890f51fba39156a64ef69a33cee1bd4db6f0eafd0836be9b08

kernel32

comctl32

generic

Sharing

General

Malware Config

Signatures

File Explorer

14f1d4817d8bcd890f51fba39156a64ef69a33cee1bd4db6f0eafd0836be9b08

kernel32

comctl32

generic