f2dac02ea299efd59fe72ca011f9acc3f9e59f46caa216ab6d1fd3e88a15e450

Sharing

Copy URL Twitter E-mail

General

Target
f2dac02ea299efd59fe72ca011f9acc3f9e59f46caa216ab6d1fd3e88a15e450
Size 278KB
Sample260706-n3f57aev81
SHA256 f2dac02ea299efd59fe72ca011f9acc3f9e59f46caa216ab6d1fd3e88a15e450
MD5 3f6e9f47f177512d159632875ccf3ae8
SHA1 948c8e003d45cbd80a6ae7ebf51bfa87fb70dcd1
SHA512 c3b6baa8a49cf521deb505a16b23134239f4f2dd130400eafdd0f7e4fd91cbed361b3a02936d528ab085557adef1e501419ecf8e95fc6e9a400767b8508a3248
SSDEEP 6144:cUKIzSHW93ckpF0eRNF5QNHiqqsVADtx3JY:cUKYSuckD0OFJqqsVAh4
TLSH
T198547DD176D18030F4B201728668AB22497EBC719B7699DF7BCC1D4A2EB46C1E739723
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f2dac02ea299efd59fe72ca011f9acc3f9e59f46caa216ab6d1fd3e88a15e450

File Explorer

f2dac02ea299efd59fe72ca011f9acc3f9e59f46caa216ab6d1fd3e88a15e450

.dll 278KB

f2dac02ea299efd59fe72ca011f9acc3f9e59f46caa216ab6d1fd3e88a15e450

IMPHASH 385aae479fc69218bf21f0bdbb968102
SHA256 f2dac02ea299efd59fe72ca011f9acc3f9e59f46caa216ab6d1fd3e88a15e450
MD5 3f6e9f47f177512d159632875ccf3ae8
SHA1 948c8e003d45cbd80a6ae7ebf51bfa87fb70dcd1
SHA512 c3b6baa8a49cf521deb505a16b23134239f4f2dd130400eafdd0f7e4fd91cbed361b3a02936d528ab085557adef1e501419ecf8e95fc6e9a400767b8508a3248
SSDEEP 6144:cUKIzSHW93ckpF0eRNF5QNHiqqsVADtx3JY:cUKYSuckD0OFJqqsVAh4
TLSH
T198547DD176D18030F4B201728668AB22497EBC719B7699DF7BCC1D4A2EB46C1E739723
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

48150

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\RDBuildPool\20250430-14989\Release\SKUtil.pdb

shlwapi

StrCmpIW PathFileExistsW StrTrimA

advapi32

OpenProcessToken RegSetValueExW RegFlushKey RegCreateKeyExA RegCloseKey RegOpenKeyExW RegQueryValueExW AdjustTokenPrivileges LookupPrivilegeValueA GetUserNameA

wininet

InternetSetOptionA InternetGetLastResponseInfoW InternetSetOptionW InternetOpenW InternetCloseHandle InternetOpenUrlW InternetReadFile

kernel32

GetStringTypeW HeapReAlloc InterlockedExchange OutputDebugStringA OutputDebugStringW CreateFileA CreateFileW DeleteFileW FindClose FindFirstFileA FindFirstFileW FindNextFileA FindNextFileW GetFileAttributesA GetFileAttributesW GetFileSize LockFile ReadFile RemoveDirectoryW SetFileAttributesA SetFileAttributesW SetFilePointer UnlockFile WriteFile CloseHandle GetLastError InitializeCriticalSectionEx WaitForSingleObject Sleep SetStdHandle GetCurrentProcess GetCurrentProcessId TerminateProcess GetExitCodeProcess CreateProcessA CreateProcessW OpenProcess GetLocalTime GetVersionExA GetVersionExW FreeLibrary GetProcAddress LoadLibraryExW LocalAlloc LocalFree lstrcmpA lstrcpyA LoadLibraryA LoadLibraryW GetPrivateProfileStringW GetPrivateProfileSectionW QueryDosDeviceA MultiByteToWideChar WideCharToMultiByte CreateToolhelp32Snapshot Process32First Process32Next K32GetProcessImageFileNameA GetStartupInfoW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW SetConsoleCtrlHandler SetFilePointerEx GetConsoleMode WriteConsoleW FlushFileBuffers lstrlenA lstrlenW TlsGetValue TlsSetValue TlsFree InterlockedDecrement FatalAppExitA TlsAlloc InitializeCriticalSectionAndSpinCount SetLastError SetUnhandledExceptionFilter UnhandledExceptionFilter HeapSize GetConsoleCP LeaveCriticalSection EnterCriticalSection FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter AreFileApisANSI GetModuleHandleExW ExitProcess GetModuleFileNameW GetStdHandle GetCurrentThreadId GetCommandLineA RtlUnwind GetModuleFileNameA DeleteCriticalSection GetFileType GetProcessHeap GetCurrentThread GetCPInfo GetOEMCP GetACP IsValidCodePage InterlockedIncrement CreateSemaphoreW GetModuleHandleW EncodePointer DecodePointer IsDebuggerPresent IsProcessorFeaturePresent HeapFree HeapAlloc GetFileAttributesExW GetSystemTimeAsFileTime RaiseException

user32

LoadStringW wsprintfA PostMessageA GetDC ReleaseDC FindWindowW FindWindowExW GetClassNameA GetTopWindow GetWindowThreadProcessId GetWindow

gdi32

StretchDIBits SetStretchBltMode SelectObject GetDIBits DeleteDC CreateCompatibleDC CreateCompatibleBitmap GetObjectA

shell32

ord526 SHChangeNotify ShellExecuteExA ShellExecuteExW SHGetFolderPathA

ole32

CoInitialize CoCreateInstance CoSetProxyBlanket CoUninitialize CoInitializeSecurity

oleaut32

VariantClear VariantInit SafeArrayPutElement SafeArrayCreate SysFreeString SysAllocStringLen SysAllocString SetErrorInfo CreateErrorInfo VariantChangeType GetErrorInfo

msi

ord112

gdiplus

GdipCreateBitmapFromFile GdipFree GdiplusStartup GdiplusShutdown GdipCloneImage GdipCreateBitmapFromFileICM GdipCreateHBITMAPFromBitmap GdipAlloc GdipDisposeImage

Sharing

General

Malware Config

Signatures

File Explorer

f2dac02ea299efd59fe72ca011f9acc3f9e59f46caa216ab6d1fd3e88a15e450

shlwapi

advapi32

wininet

kernel32

user32

gdi32

shell32

ole32

oleaut32

msi

gdiplus

generic