23bca03e5fb649a3a1b6ef82b92fb795c20b3810ee7ec5fda75c9ed5545fd9bd

Sharing

Copy URL Twitter E-mail

General

Target
23bca03e5fb649a3a1b6ef82b92fb795c20b3810ee7ec5fda75c9ed5545fd9bd
Size 149KB
Sample260710-rytr9sbs9j
SHA256 23bca03e5fb649a3a1b6ef82b92fb795c20b3810ee7ec5fda75c9ed5545fd9bd
MD5 237d6969493532e31969f3ef8a88f6d4
SHA1 a6b4ada05b9fa6191f7eea416ef2855d02fc7940
SHA512 2da8e8b782ee9eb743b51879e2c048137eecc952089237faab0556da47e462f0f7f1ac0bd01eba2b7484f0058bc2a795a5b57d35368cace08c00997b32feb5da
SSDEEP 3072:NB35UiWNqCmUWDPuOS5FzR29h1E3kOqu6tirbXmzDQ92:NAozpDPuOjh1ECuAi/XN92
TLSH
T10CE3AF57F6CB40B0D993247206A22376A738F6389B978DFB53D49C4E8F659C0CA39253
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
23bca03e5fb649a3a1b6ef82b92fb795c20b3810ee7ec5fda75c9ed5545fd9bd

File Explorer

23bca03e5fb649a3a1b6ef82b92fb795c20b3810ee7ec5fda75c9ed5545fd9bd

.exe 149KB

23bca03e5fb649a3a1b6ef82b92fb795c20b3810ee7ec5fda75c9ed5545fd9bd

IMPHASH fe9d2d7aa3492569c1941b70c4fe2d63
SHA256 23bca03e5fb649a3a1b6ef82b92fb795c20b3810ee7ec5fda75c9ed5545fd9bd
MD5 237d6969493532e31969f3ef8a88f6d4
SHA1 a6b4ada05b9fa6191f7eea416ef2855d02fc7940
SHA512 2da8e8b782ee9eb743b51879e2c048137eecc952089237faab0556da47e462f0f7f1ac0bd01eba2b7484f0058bc2a795a5b57d35368cace08c00997b32feb5da
SSDEEP 3072:NB35UiWNqCmUWDPuOS5FzR29h1E3kOqu6tirbXmzDQ92:NAozpDPuOjh1ECuAi/XN92
TLSH
T10CE3AF57F6CB40B0D993247206A22376A738F6389B978DFB53D49C4E8F659C0CA39253
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

65025

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

CloseHandle CopyFileW CreateDirectoryW CreateFileW CreateMutexW CreatePipe CreateProcessW DeleteCriticalSection DeleteFileW DuplicateHandle EnterCriticalSection ExitProcess FindClose FindFirstFileW FreeLibrary GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetDiskFreeSpaceExW GetDriveTypeW GetFileAttributesW GetLastError GetModuleFileNameW GetModuleHandleW GetProcAddress GetStartupInfoW GetStdHandle GetSystemTimeAsFileTime GetVersionExW GetWindowsDirectoryW GlobalAlloc GlobalFree GlobalLock GlobalSize GlobalUnlock HeapAlloc HeapCreate HeapDestroy HeapFree HeapReAlloc InitializeCriticalSection InitializeCriticalSectionAndSpinCount InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent LeaveCriticalSection LoadLibraryExW LoadLibraryW MulDiv MultiByteToWideChar PeekNamedPipe QueryPerformanceCounter ReadFile RtlUnwind SetLastError SetUnhandledExceptionFilter Sleep TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter VerSetConditionMask VerifyVersionInfoW WaitForSingleObject WideCharToMultiByte WriteFile

user32

AdjustWindowRectEx CallWindowProcW CharLowerW CreateAcceleratorTableW CreateWindowExW DefFrameProcW DefWindowProcW DestroyAcceleratorTable DestroyIcon DestroyMenu DestroyWindow DispatchMessageW DrawFocusRect DrawStateW DrawTextW EnableWindow EnumChildWindows EnumPropsExW EnumWindows FillRect FindWindowExW FrameRect GetActiveWindow GetAsyncKeyState GetClassNameW GetClientRect GetCursorPos GetDC GetFocus GetForegroundWindow GetIconInfo GetKeyState GetMenuItemCount GetMenuItemInfoW GetMessageW GetParent GetPropW GetSysColor GetSysColorBrush GetSystemMetrics GetWindow GetWindowLongW GetWindowRect GetWindowTextLengthW GetWindowTextW GetWindowThreadProcessId IntersectRect InvalidateRect IsChild IsIconic IsWindowEnabled IsWindowVisible IsZoomed KillTimer LoadCursorW LoadIconW MessageBoxW MoveWindow MsgWaitForMultipleObjects PeekMessageW PostMessageW RedrawWindow RegisterClassW RegisterWindowMessageW ReleaseDC RemovePropW ScreenToClient SendMessageW SetActiveWindow SetFocus SetForegroundWindow SetMenu SetPropW SetRect SetWindowLongW SetWindowPos SetWindowTextW ShowWindow SystemParametersInfoW TrackPopupMenu TranslateAcceleratorW TranslateMessage UnregisterClassW UpdateWindow ValidateRect keybd_event

advapi32

RegCloseKey RegOpenKeyExW RegQueryValueExW

ole32

CLSIDFromString CoInitialize CoUninitialize OleInitialize OleUninitialize RegisterDragDrop ReleaseStgMedium RevokeDragDrop

shell32

DragQueryFileW ExtractIconExW ShellExecuteExW Shell_NotifyIconW

shlwapi

PathAddBackslashW PathFileExistsW

ntdll

NtQuerySystemInformation

gdi32

BitBlt CreateCompatibleBitmap CreateCompatibleDC CreateDCW CreateDIBSection CreateFontIndirectW CreateRectRgn CreateSolidBrush DeleteDC DeleteObject GetDIBits GetDeviceCaps GetObjectType GetObjectW GetStockObject GetTextExtentPoint32W IntersectClipRect SelectClipRgn SelectObject SetBkColor SetTextColor

comctl32

CreateStatusWindowW InitCommonControlsEx

api-ms-win-crt-string-l1-1-0

_wcsdup _wcsicmp _wcsnicmp tolower wcscat wcscmp wcscpy wcslen wcsncmp wcsncpy

comdlg32

GetOpenFileNameW GetSaveFileNameW

api-ms-win-crt-locale-l1-1-0

_configthreadlocale setlocale

winmm

timeBeginPeriod

api-ms-win-crt-stdio-l1-1-0

__p__commode __stdio_common_vswprintf _set_fmode fread fseek ftell

gdiplus

GdipDeleteFont GdipDeleteGraphics GdipDeleteMatrix GdipDeletePath GdipDeletePen GdipDeleteStringFormat GdipFree

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free

uxtheme

IsAppThemed

api-ms-win-crt-math-l1-1-0

__setusermatherr floor pow

api-ms-win-crt-runtime-l1-1-0

_c_exit _cexit _configure_narrow_argv _controlfp_s _crt_atexit _exit _get_narrow_winmain_command_line _initialize_narrow_environment _initialize_onexit_table _initterm _initterm_e _register_onexit_function _register_thread_local_exe_atexit_callback _seh_filter_exe _set_app_type abort exit terminate

Name

.text

Size

64KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

3KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.code

Size

9KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rsrc

Size

55KB

Virtual Size

54KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

5KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

23bca03e5fb649a3a1b6ef82b92fb795c20b3810ee7ec5fda75c9ed5545fd9bd

kernel32

user32

advapi32

ole32

shell32

shlwapi

ntdll

gdi32

comctl32

api-ms-win-crt-string-l1-1-0

comdlg32

api-ms-win-crt-locale-l1-1-0

winmm

api-ms-win-crt-stdio-l1-1-0

gdiplus

api-ms-win-crt-heap-l1-1-0

uxtheme

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-runtime-l1-1-0

generic