99bda4887c96cedec4140e766e98d167dad52fdd85135a97b32cd68aae64c6a3

General

Target
99bda4887c96cedec4140e766e98d167dad52fdd85135a97b32cd68aae64c6a3
Size 343KB
Sample260709-phfvcsbt4s
SHA256 99bda4887c96cedec4140e766e98d167dad52fdd85135a97b32cd68aae64c6a3
MD5 c4b9e5af6c6ed818c230cdf4afc1ab67
SHA1 40ca76ffcbe247c0f18b3c7f0dbe74af4e2c135a
SHA512 a798ec0b06bc1de0f19114a78223fa25e3dbb88dd70aecbfa9fd4231ce5307ef2a0fbb20d93c1830060190125577dcaf5080d480c43bb9dd24a6a84d8918f6d4
SSDEEP 6144:vhjzHCLKVI3xdIJql3ProSEE2eS0JE2akcuuRVPZ1K49K/llvFbO5:vhiGexfXEES0J4kwRRfK44/lBF
TLSH
T1EE74BE2766E032E2E77F25318347DE8EA7337E304244DB9B46D25F940E326915DA9E23
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
99bda4887c96cedec4140e766e98d167dad52fdd85135a97b32cd68aae64c6a3

File Explorer

99bda4887c96cedec4140e766e98d167dad52fdd85135a97b32cd68aae64c6a3

.exe 343KB

99bda4887c96cedec4140e766e98d167dad52fdd85135a97b32cd68aae64c6a3

IMPHASH 08d2e8def3bf9cbd7f590ec604622dec
SHA256 99bda4887c96cedec4140e766e98d167dad52fdd85135a97b32cd68aae64c6a3
MD5 c4b9e5af6c6ed818c230cdf4afc1ab67
SHA1 40ca76ffcbe247c0f18b3c7f0dbe74af4e2c135a
SHA512 a798ec0b06bc1de0f19114a78223fa25e3dbb88dd70aecbfa9fd4231ce5307ef2a0fbb20d93c1830060190125577dcaf5080d480c43bb9dd24a6a84d8918f6d4
SSDEEP 6144:vhjzHCLKVI3xdIJql3ProSEE2eS0JE2akcuuRVPZ1K49K/llvFbO5:vhiGexfXEES0J4kwRRfK44/lBF
TLSH
T1EE74BE2766E032E2E77F25318347DE8EA7337E304244DB9B46D25F940E326915DA9E23
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

6392

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

wsprintfA

kernel32

WriteFile WriteConsoleW GetDiskFreeSpaceExA GetFileAttributesA CloseHandle HeapAlloc HeapFree GetProcessHeap WaitForSingleObject CreateEventA Sleep GlobalMemoryStatusEx GetSystemInfo GetTickCount GetModuleHandleA GetProcAddress RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW CreateFileW RtlUnwindEx GetLastError SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary LoadLibraryExW EncodePointer RaiseException RtlPcToFileHeader GetStdHandle GetModuleFileNameW ExitProcess GetModuleHandleExW GetCommandLineA GetCommandLineW FindClose FindFirstFileExW FindNextFileW IsValidCodePage GetACP GetOEMCP GetCPInfo MultiByteToWideChar WideCharToMultiByte GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle GetFileType GetStringTypeW FlsAlloc FlsGetValue FlsSetValue FlsFree InitializeCriticalSectionEx VirtualProtect CompareStringW LCMapStringW HeapSize HeapReAlloc FlushFileBuffers GetConsoleOutputCP GetConsoleMode SetFilePointerEx

Name

.text

Size

58KB

Virtual Size

57KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

39KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

228KB

Virtual Size

232KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

99bda4887c96cedec4140e766e98d167dad52fdd85135a97b32cd68aae64c6a3

user32

kernel32

generic