b66edb0aea00b04936c0cbf4917a221db4387fe2f658921e461b2db7dba4aed1

Sharing

Copy URL Twitter E-mail

General

Target
b66edb0aea00b04936c0cbf4917a221db4387fe2f658921e461b2db7dba4aed1
Size 137KB
Sample260706-kagdpsct7t
SHA256 b66edb0aea00b04936c0cbf4917a221db4387fe2f658921e461b2db7dba4aed1
MD5 1a94dab175da3439cd87aebad0614765
SHA1 da41c32204ffc19416d3528ab8d92be1a7ab8df7
SHA512 979a1754b1930d149cd6fe8c29350085dc355ae2747c79af1b26b063a79ec13bbc68b1497a4b43e79f6b91a136146a548b7db9bb1d21538abb7855bf025379f5
SSDEEP 3072:RAG6wcgJMW4/sxETD1mAWUSj1Y+FU1fVT4XZ:t6uaWoTDYAPG1Y9tT8
TLSH
T191D3390732A438F9D07286788BB246C5D776BC3A0731DB8F17A0521A5F6B2D17E3A761
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b66edb0aea00b04936c0cbf4917a221db4387fe2f658921e461b2db7dba4aed1

File Explorer

b66edb0aea00b04936c0cbf4917a221db4387fe2f658921e461b2db7dba4aed1

.exe 137KB

b66edb0aea00b04936c0cbf4917a221db4387fe2f658921e461b2db7dba4aed1

IMPHASH 4e0b07432e2a5ad07ad0f062e1a8ec6f
SHA256 b66edb0aea00b04936c0cbf4917a221db4387fe2f658921e461b2db7dba4aed1
MD5 1a94dab175da3439cd87aebad0614765
SHA1 da41c32204ffc19416d3528ab8d92be1a7ab8df7
SHA512 979a1754b1930d149cd6fe8c29350085dc355ae2747c79af1b26b063a79ec13bbc68b1497a4b43e79f6b91a136146a548b7db9bb1d21538abb7855bf025379f5
SSDEEP 3072:RAG6wcgJMW4/sxETD1mAWUSj1Y+FU1fVT4XZ:t6uaWoTDYAPG1Y9tT8
TLSH
T191D3390732A438F9D07286788BB246C5D776BC3A0731DB8F17A0521A5F6B2D17E3A761
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

26240

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

GetTempPathA DeleteFileW GetDiskFreeSpaceExW GetFileAttributesW GetTempPathW SetUnhandledExceptionFilter SetErrorMode WaitForSingleObject CreateThread GlobalMemoryStatusEx GetModuleFileNameA GetModuleHandleA LoadLibraryA lstrcatW lstrlenW GetLogicalDriveStringsA MultiByteToWideChar WideCharToMultiByte GetACP CreateFileW GetStringTypeW WriteConsoleW FlushFileBuffers SetStdHandle GetProcAddress Sleep GetLastError GetFileAttributesA DeleteFileA lstrcpyW GetCurrentProcessId HeapReAlloc GetModuleHandleW TlsFree TlsSetValue TlsGetValue TlsAlloc TerminateProcess GetCurrentProcess UnhandledExceptionFilter RtlVirtualUnwind RtlCaptureContext LCMapStringW EncodePointer DecodePointer RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx ReadFile HeapAlloc GetCommandLineA GetStdHandle WriteFile GetModuleFileNameW IsProcessorFeaturePresent HeapFree ExitProcess GetModuleHandleExW AreFileApisANSI HeapSize IsDebuggerPresent SetLastError GetCurrentThreadId EnterCriticalSection LeaveCriticalSection CloseHandle InitializeCriticalSectionAndSpinCount GetConsoleCP GetConsoleMode ReadConsoleW SetFilePointer SetFilePointerEx GetFileType DeleteCriticalSection GetStartupInfoW IsValidCodePage GetOEMCP GetCPInfo GetProcessHeap QueryPerformanceCounter GetSystemTimeAsFileTime GetEnvironmentStringsW FreeEnvironmentStringsW OutputDebugStringW LoadLibraryExW LoadLibraryW SetEndOfFile

user32

GetWindowTextA ShowWindow GetWindowThreadProcessId EnumWindows

advapi32

RegQueryValueExA RegOpenKeyExA RegCloseKey RegEnumKeyExA

shell32

ShellExecuteExW

wininet

InternetSetOptionA InternetQueryOptionA InternetConnectA HttpOpenRequestA InternetReadFile HttpQueryInfoA InternetCloseHandle InternetOpenA HttpSendRequestA InternetOpenUrlA

ws2_32

WSAStartup gethostname ntohl gethostbyname

shlwapi

PathFindFileNameA

Sharing

General

Malware Config

Signatures

File Explorer

b66edb0aea00b04936c0cbf4917a221db4387fe2f658921e461b2db7dba4aed1

kernel32

user32

advapi32

shell32

wininet

ws2_32

shlwapi

generic