e838202ca503049c05029cdbda5eec4571e39d85d3448bbbf57875a9bf54bfa1

Sharing

Copy URL Twitter E-mail

General

Target
e838202ca503049c05029cdbda5eec4571e39d85d3448bbbf57875a9bf54bfa1
Size 311KB
Sample260706-e4b37ahx8y
SHA256 e838202ca503049c05029cdbda5eec4571e39d85d3448bbbf57875a9bf54bfa1
MD5 f07386d1ac419082a1b9ae3a9adeeb9a
SHA1 a508a19713fb915d52e6c02e69e45793a0174d92
SHA512 7a46be6ce5ae40e4972055af82a439a3a45b4c974a97fc723530039dab63cab6e3910d52ec11b228cf3c11448369e7c89d250f26143c9248e46c32078c9013b7
SSDEEP 3072:ODy4tngFazM0u5IHCBuEoGSBxc7PLEqnk5dHYElTSKLZ388G7Od37YipbB6AG37h:ODVG+Fu54CBtKBxmszm
TLSH
T1C864C56267D49516F9B25B3C89FB13212B39FD92DA75C70F95003A4E0C72B909DA233B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e838202ca503049c05029cdbda5eec4571e39d85d3448bbbf57875a9bf54bfa1

File Explorer

e838202ca503049c05029cdbda5eec4571e39d85d3448bbbf57875a9bf54bfa1

.dll 311KB

e838202ca503049c05029cdbda5eec4571e39d85d3448bbbf57875a9bf54bfa1

IMPHASH f8d702fc2cceaae4128f1cd07a37fc59
SHA256 e838202ca503049c05029cdbda5eec4571e39d85d3448bbbf57875a9bf54bfa1
MD5 f07386d1ac419082a1b9ae3a9adeeb9a
SHA1 a508a19713fb915d52e6c02e69e45793a0174d92
SHA512 7a46be6ce5ae40e4972055af82a439a3a45b4c974a97fc723530039dab63cab6e3910d52ec11b228cf3c11448369e7c89d250f26143c9248e46c32078c9013b7
SSDEEP 3072:ODy4tngFazM0u5IHCBuEoGSBxc7PLEqnk5dHYElTSKLZ388G7Od37YipbB6AG37h:ODVG+Fu54CBtKBxmszm
TLSH
T1C864C56267D49516F9B25B3C89FB13212B39FD92DA75C70F95003A4E0C72B909DA233B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4736

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

advapi32

RegCloseKey RegCreateKeyExW RegDeleteValueW RegEnumValueW RegGetValueW RegQueryInfoKeyW RegSetValueExW

combase

RoGetActivationFactory RoInitialize RoUninitialize WindowsCreateString WindowsDeleteString WindowsGetStringRawBuffer

comctl32

InitCommonControlsEx PropertySheetW

dinput8

DirectInput8Create

gdi32

CreateFontIndirectW DeleteObject Ellipse GetStockObject LineTo MoveToEx Polygon Rectangle RoundRect SelectObject SetBkMode SetDCBrushColor SetDCPenColor SetTextColor

kernel32

ActivateActCtx CloseHandle CreateActCtxW CreateEventW CreateThread DeactivateActCtx DisableThreadLibraryCalls EnterCriticalSection GetModuleHandleW GetProcAddress GetTickCount HeapAlloc HeapReAlloc LeaveCriticalSection MulDiv ReleaseActCtx SetEvent WaitForMultipleObjects WaitForSingleObject

ntdll

_vsnprintf

ole32

OleInitialize OleUninitialize

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vswprintf _strdup calloc free fwrite getenv memcmp memmove round strchr strcmp strcspn strlen wcscmp wcslen wcsrchr wcsstr

user32

BeginPaint CreateWindowExW DefWindowProcW DispatchMessageW DrawTextW EnableWindow EndPaint FillRect FindWindowExW GetAncestor GetClientRect GetDlgItem GetSysColor GetWindowLongW InvalidateRect MsgWaitForMultipleObjects PeekMessageW RegisterClassW RegisterDeviceNotificationW SendDlgItemMessageW SendMessageW SetWindowLongW ShowWindow TranslateMessage UnregisterClassW UnregisterDeviceNotification

xinput1_3

XInputSetState XInputGetCapabilities XInputGetStateEx

Name

.text

Size

36KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

712B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

24KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

384B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

4KB

Virtual Size

80B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

140KB

Virtual Size

136KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

e838202ca503049c05029cdbda5eec4571e39d85d3448bbbf57875a9bf54bfa1

advapi32

combase

comctl32

dinput8

gdi32

kernel32

ntdll

ole32

ucrtbase

user32

xinput1_3

generic