bf0eac63fdcf71727827ea88d076a3dd7f109dcf2bbffb67b7dacc7b42861a59

Sharing

Copy URL Twitter E-mail

General

Target
bf0eac63fdcf71727827ea88d076a3dd7f109dcf2bbffb67b7dacc7b42861a59
Size 1.0MB
Sample260706-ka3xpscv2w
SHA256 bf0eac63fdcf71727827ea88d076a3dd7f109dcf2bbffb67b7dacc7b42861a59
MD5 d83c09fb0310fbbd9ca29ab7d83e5030
SHA1 9e7e6570d316c7505efbb0c8443b443c5db7ff5e
SHA512 0c55797f7f19313beb26efc917a0bf132e531080751621b27960e3d577cbba8fba97463e17fe8e9474b6ed73acab1ddf6e51c3d2679f01933265c817e8a6e72b
SSDEEP 24576:UDXBTdx8xpdHZVN9WAVoWbAeEhMpHeG7C:sXBTdx8x/ZVNhodHhFGe
TLSH
T1DF350240D15D41E5F8E081B08AA2574171227920DB237BDF81B857666F24BDE2B3FBBE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
bf0eac63fdcf71727827ea88d076a3dd7f109dcf2bbffb67b7dacc7b42861a59

File Explorer

bf0eac63fdcf71727827ea88d076a3dd7f109dcf2bbffb67b7dacc7b42861a59

.exe 1.0MB

bf0eac63fdcf71727827ea88d076a3dd7f109dcf2bbffb67b7dacc7b42861a59

IMPHASH 5cee796b015e96daf41526d30b07771b
SHA256 bf0eac63fdcf71727827ea88d076a3dd7f109dcf2bbffb67b7dacc7b42861a59
MD5 d83c09fb0310fbbd9ca29ab7d83e5030
SHA1 9e7e6570d316c7505efbb0c8443b443c5db7ff5e
SHA512 0c55797f7f19313beb26efc917a0bf132e531080751621b27960e3d577cbba8fba97463e17fe8e9474b6ed73acab1ddf6e51c3d2679f01933265c817e8a6e72b
SSDEEP 24576:UDXBTdx8xpdHZVN9WAVoWbAeEhMpHeG7C:sXBTdx8x/ZVNhodHhFGe
TLSH
T1DF350240D15D41E5F8E081B08AA2574171227920DB237BDF81B857666F24BDE2B3FBBE
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

302540

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

CloseClipboard DefWindowProcW GetClipboardData OpenClipboard PostQuitMessage UnregisterHotKey

kernel32

CloseHandle CompareStringW CreateFileA CreateFileW CreateThread DeleteCriticalSection EncodePointer EnterCriticalSection ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FlushInstructionCache FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetExitCodeThread GetFileSize GetFileType GetLastError GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTimeAsFileTime GlobalLock GlobalUnlock HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage LCMapStringW LeaveCriticalSection LoadLibraryA LoadLibraryExW MultiByteToWideChar QueryPerformanceCounter RaiseException ReadFile RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwindEx RtlVirtualUnwind SetEnvironmentVariableW SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VirtualAlloc VirtualFree VirtualProtect WaitForSingleObject WideCharToMultiByte WriteConsoleW WriteFile lstrcpynW

shell32

Shell_NotifyIconW

ole32

CLSIDFromProgID CoCreateInstance

wininet

InternetCloseHandle InternetOpenUrlW InternetOpenW InternetReadFile

Name

.text

Size

351KB

Virtual Size

352KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

41KB

Virtual Size

44KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

5KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.retplne

Size

512B

Virtual Size

8KB

Characteristics

Name

.rsrc

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.bss

Size

641KB

Virtual Size

641KB

Characteristics

IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

bf0eac63fdcf71727827ea88d076a3dd7f109dcf2bbffb67b7dacc7b42861a59

user32

kernel32

shell32

ole32

wininet

generic