79a9721d3d1986a415ebec08b2bde3ad8506994206d5b728ac5e51d41cc1a1e7

Sharing

Copy URL Twitter E-mail

General

Target
79a9721d3d1986a415ebec08b2bde3ad8506994206d5b728ac5e51d41cc1a1e7
Size 149KB
Sample260709-j54xtaey9m
SHA256 79a9721d3d1986a415ebec08b2bde3ad8506994206d5b728ac5e51d41cc1a1e7
MD5 6117c80bfafdba1052baf725d6038bcf
SHA1 891665e3adcc9484d2c97004e641d65317b2baa9
SHA512 b2155cf75cdae8762fec406660235503380a8ef84db9ea7d4b2e6ab9f85ba8470899e2da9461503e47153c7fa634161b5081e9ed902428dec7c013416bf549dc
SSDEEP 3072:hCAHnSq1PS62aXRY6S7pO8h57u5oR5b+yuCwgl9H5s9F+:hVj1K620mpOSxSoac55s9F+
TLSH
T1DBE38C41B5C0C076CD3F153098B6EBB50A3CB9200FA5AEDB73944D6EAE706C09775A6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
79a9721d3d1986a415ebec08b2bde3ad8506994206d5b728ac5e51d41cc1a1e7

File Explorer

79a9721d3d1986a415ebec08b2bde3ad8506994206d5b728ac5e51d41cc1a1e7

.dll 149KB

79a9721d3d1986a415ebec08b2bde3ad8506994206d5b728ac5e51d41cc1a1e7

IMPHASH c48ce63c2b008e1462c0dba4cd71a18b
SHA256 79a9721d3d1986a415ebec08b2bde3ad8506994206d5b728ac5e51d41cc1a1e7
MD5 6117c80bfafdba1052baf725d6038bcf
SHA1 891665e3adcc9484d2c97004e641d65317b2baa9
SHA512 b2155cf75cdae8762fec406660235503380a8ef84db9ea7d4b2e6ab9f85ba8470899e2da9461503e47153c7fa634161b5081e9ed902428dec7c013416bf549dc
SSDEEP 3072:hCAHnSq1PS62aXRY6S7pO8h57u5oR5b+yuCwgl9H5s9F+:hVj1K620mpOSxSoac55s9F+
TLSH
T1DBE38C41B5C0C076CD3F153098B6EBB50A3CB9200FA5AEDB73944D6EAE706C09775A6B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5560

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetProcessHeap ExitProcess WriteConsoleW HeapAlloc CloseHandle CreateFileA HeapFree GetModuleFileNameA SwitchToThread ReadFile UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW RtlUnwind InterlockedFlushSList RaiseException GetLastError SetLastError EncodePointer EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW GetModuleHandleExW GetModuleFileNameW SetFilePointerEx GetConsoleMode ReadConsoleW GetStdHandle GetFileType WideCharToMultiByte FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo GetCommandLineA GetCommandLineW MultiByteToWideChar GetEnvironmentStringsW FreeEnvironmentStringsW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect LCMapStringW SetStdHandle GetStringTypeW FlushFileBuffers WriteFile GetConsoleOutputCP CreateFileW HeapSize HeapReAlloc SetEndOfFile DecodePointer

advapi32

CryptCreateHash CryptHashData CryptDestroyHash CryptGetHashParam CryptReleaseContext CryptAcquireContextA

Name

.text

Size

92KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

".wplh"

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

".wplm"

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

".wpla"

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

".wpls"

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

".wpld"

Size

512B

Virtual Size

214B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

".wplx"

Size

512B

Virtual Size

81B

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

30KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

2KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

79a9721d3d1986a415ebec08b2bde3ad8506994206d5b728ac5e51d41cc1a1e7

kernel32

advapi32

generic