1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6

General

Target
1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6
Size 286KB
Sample260708-eme4hsat8x
SHA256 1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6
MD5 a05389640c9d49b208eac7308baf0631
SHA1 a08786260b150c96d04ba5ed5ade2fc148d40173
SHA512 4cf00413df395c86f6235a683c644514c1b9f860afdb2c3b39691e2ff779104fdfaebbcbfba6782b6fdaeeecd8d0727230559695229df0a53fa054e91e01d6bf
SSDEEP 6144:dh2cD2G4rW3XdlQlPAHPOsnowtP2qO4TmhOqx:ZD2FcXdlQlPAHRn1PrRyF
TLSH
T119547D15F7A914FAE977857CC9424502EAB27C1647B0E6DF03A00B972F27AE09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6

File Explorer

1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6

.exe 286KB

1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6

IMPHASH c2e05f60091c1495bb928ba798511eeb
SHA256 1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6
MD5 a05389640c9d49b208eac7308baf0631
SHA1 a08786260b150c96d04ba5ed5ade2fc148d40173
SHA512 4cf00413df395c86f6235a683c644514c1b9f860afdb2c3b39691e2ff779104fdfaebbcbfba6782b6fdaeeecd8d0727230559695229df0a53fa054e91e01d6bf
SSDEEP 6144:dh2cD2G4rW3XdlQlPAHPOsnowtP2qO4TmhOqx:ZD2FcXdlQlPAHRn1PrRyF
TLSH
T119547D15F7A914FAE977857CC9424502EAB27C1647B0E6DF03A00B972F27AE09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

54416

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpOpen WinHttpCloseHandle WinHttpConnect WinHttpReceiveResponse WinHttpSendRequest WinHttpOpenRequest WinHttpSetOption WinHttpReadData WinHttpCrackUrl

bcrypt

BCryptGenRandom

kernel32

RtlUnwindEx WriteConsoleW HeapSize ReadConsoleW GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW FindNextFileW FindFirstFileExW FindClose CreateFileW CloseHandle GetLastError ReleaseMutex CreateMutexW Sleep GetCurrentProcessId GetExitCodeProcess CreateProcessW GetTickCount CreateFileMappingW MapViewOfFile UnmapViewOfFile GetProcAddress LoadLibraryA QueryFullProcessImageNameW CreateToolhelp32Snapshot Process32FirstW Process32NextW VirtualProtect WideCharToMultiByte MultiByteToWideChar GetStringTypeW EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo QueryPerformanceCounter GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwind SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree IsProcessorFeaturePresent GetStdHandle WriteFile GetModuleFileNameW GetCurrentProcess ExitProcess TerminateProcess FreeLibrary GetModuleHandleExW GetCommandLineA GetCommandLineW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter HeapAlloc HeapFree GetFileType LoadLibraryExW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW IsValidCodePage GetACP GetOEMCP GetFileSizeEx SetFilePointerEx FlushFileBuffers GetConsoleOutputCP GetConsoleMode ReadFile HeapReAlloc

Name

.text

Size

186KB

Virtual Size

186KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

79KB

Virtual Size

79KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

11KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6

winhttp

bcrypt

kernel32

generic