6b720cba9c5e07ee53401d5bfaea4ec5c937a0f66360fb0631a4655de7554b73

Sharing

Copy URL Twitter E-mail

General

Target
6b720cba9c5e07ee53401d5bfaea4ec5c937a0f66360fb0631a4655de7554b73
Size 4.8MB
Sample260707-gd99eaay7s
SHA256 6b720cba9c5e07ee53401d5bfaea4ec5c937a0f66360fb0631a4655de7554b73
MD5 6f37c1324411e6ebb75be794ab59b32a
SHA1 efae7b6a00d8d6a4961a4a0e7dc4753d93adda20
SHA512 cc7692e2088d34a53d7b0f78c03559f4a864d03ae1b3b4db633b26fc251118912e091f83dae3b6c6755abddfc93b1cdb641ef4347840aec147ebbaaea6c4744e
SSDEEP 98304:G1SxVUlHZI45L5d8h5nPShmQLvGN5G8sy:G1Sx2HRhXLvGNo8sy
TLSH
T19836E041E5C111F3C1628A3AC39741F7E2226C3E92764A4F1ED4BC2B7A73981AD5BBD1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
6b720cba9c5e07ee53401d5bfaea4ec5c937a0f66360fb0631a4655de7554b73

File Explorer

6b720cba9c5e07ee53401d5bfaea4ec5c937a0f66360fb0631a4655de7554b73

.exe 4.8MB

6b720cba9c5e07ee53401d5bfaea4ec5c937a0f66360fb0631a4655de7554b73

IMPHASH 22115a73008c7a19259ac9d4ab645ae0
SHA256 6b720cba9c5e07ee53401d5bfaea4ec5c937a0f66360fb0631a4655de7554b73
MD5 6f37c1324411e6ebb75be794ab59b32a
SHA1 efae7b6a00d8d6a4961a4a0e7dc4753d93adda20
SHA512 cc7692e2088d34a53d7b0f78c03559f4a864d03ae1b3b4db633b26fc251118912e091f83dae3b6c6755abddfc93b1cdb641ef4347840aec147ebbaaea6c4744e
SSDEEP 98304:G1SxVUlHZI45L5d8h5nPShmQLvGN5G8sy:G1Sx2HRhXLvGNo8sy
TLSH
T19836E041E5C111F3C1628A3AC39741F7E2226C3E92764A4F1ED4BC2B7A73981AD5BBD1
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

97052

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

SetLastError OpenEventW GetCurrentProcessId GetCurrentThreadId InitializeCriticalSectionAndSpinCount SetEvent ResetEvent CreateEventW TerminateThread WaitForMultipleObjects CreateFileW GetCurrentProcess OpenProcess VirtualAlloc VirtualFree GetModuleFileNameW GetProcAddress WideCharToMultiByte TerminateProcess GetACP CreateToolhelp32Snapshot Process32FirstW Process32NextW WriteFile OpenFileMappingW MapViewOfFile UnmapViewOfFile DecodePointer RaiseException HeapAlloc HeapReAlloc HeapFree HeapSize GetProcessHeap InitializeCriticalSectionEx GetSystemTime GetSystemTimeAsFileTime SystemTimeToFileTime MultiByteToWideChar ReadFile FreeLibrary GetModuleFileNameA GetModuleHandleExW FindNextFileA FindFirstFileExA FindClose SetFilePointerEx GetConsoleCP ReadConsoleW GetConsoleMode EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetFileType GetStdHandle ExitProcess FreeLibraryAndExitThread ExitThread CreateThread GetFileAttributesExW CreateDirectoryW LoadLibraryExW RtlUnwindEx RtlPcToFileHeader OutputDebugStringW InitializeSListHead QueryPerformanceCounter IsProcessorFeaturePresent GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter IsDebuggerPresent FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage lstrcpyW GetModuleHandleW GetSystemDirectoryW GetTickCount64 Sleep CreateMutexW ReleaseMutex GetLastError CloseHandle SetFileAttributesW GetFileAttributesW DeleteFileW WaitForSingleObject DeleteCriticalSection LeaveCriticalSection EnterCriticalSection InitializeCriticalSection DeviceIoControl QueryDosDeviceW SetStdHandle FlushFileBuffers WriteConsoleW SetEndOfFile RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WaitForSingleObjectEx GetCPInfo GetLocaleInfoW LCMapStringW GetStringTypeW EncodePointer TlsAlloc TlsGetValue TlsSetValue TlsFree

user32

LoadImageW GetCursorPos GetWindowRect SetWindowTextW SetForegroundWindow TrackPopupMenu RemoveMenu AppendMenuW InsertMenuW GetMenuItemCount GetMenuItemID EnableMenuItem CreatePopupMenu GetSystemMetrics SetDlgItemTextW EndDialog SetWindowPos DestroyWindow CreateWindowExW RegisterClassW PostQuitMessage DefWindowProcW PostMessageW DispatchMessageW TranslateMessage GetMessageW MessageBoxW DialogBoxParamW

shell32

ShellExecuteW ShellExecuteExW SHGetFolderPathW Shell_NotifyIconW

advapi32

RegQueryValueExW RegOpenKeyExW RegCloseKey LookupPrivilegeValueW GetTokenInformation AdjustTokenPrivileges OpenProcessToken StartServiceW OpenServiceW OpenSCManagerW DeleteService CreateServiceW ControlService CloseServiceHandle ChangeServiceConfigW

shlwapi

SHDeleteValueW SHSetValueW PathRemoveFileSpecW

Name

.text

Size

212KB

Virtual Size

211KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

103KB

Virtual Size

102KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

14KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

305B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

420B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.7ut

Size

3.6MB

Virtual Size

3.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

954KB

Virtual Size

953KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

6b720cba9c5e07ee53401d5bfaea4ec5c937a0f66360fb0631a4655de7554b73

kernel32

user32

shell32

advapi32

shlwapi

generic