d7116c32dc5f2125ee489559eb4fce80adef00ea1fb4af24fdc949c0a1d89fa2

General

Target
d7116c32dc5f2125ee489559eb4fce80adef00ea1fb4af24fdc949c0a1d89fa2
Size 22KB
Sample260714-e7dq7aet5r
SHA256 d7116c32dc5f2125ee489559eb4fce80adef00ea1fb4af24fdc949c0a1d89fa2
MD5 45f1eaf9dbc1fd3872fa895155d60272
SHA1 61247b1525f5c14139a84cb7c5b1e1040f79d717
SHA512 529a6145d4204b34f96a3902ce3739b04e86b2eeb06b86629d00a8b1260ca0fbd8dfcc571630b41bc9f110f16d7d4c655fc7162c967ac23439c3f2c21b97f902
SSDEEP 384:WIpDdbKqWGUueJldLbv6rZ88YnFQtqlsA8X5ZwvBiUE7rSeBed2n:bGGUNld/v6rZd0JOAw5wBi1SeBed
TLSH
T19BA22B12B5809216F8E241FFD2FA8EE5D67EAA600F2D41D7E7C15CACD9306D2B435A0D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
d7116c32dc5f2125ee489559eb4fce80adef00ea1fb4af24fdc949c0a1d89fa2

File Explorer

d7116c32dc5f2125ee489559eb4fce80adef00ea1fb4af24fdc949c0a1d89fa2

.exe 22KB

d7116c32dc5f2125ee489559eb4fce80adef00ea1fb4af24fdc949c0a1d89fa2

IMPHASH ce173cc309e648b3f21754b83100e27f
SHA256 d7116c32dc5f2125ee489559eb4fce80adef00ea1fb4af24fdc949c0a1d89fa2
MD5 45f1eaf9dbc1fd3872fa895155d60272
SHA1 61247b1525f5c14139a84cb7c5b1e1040f79d717
SHA512 529a6145d4204b34f96a3902ce3739b04e86b2eeb06b86629d00a8b1260ca0fbd8dfcc571630b41bc9f110f16d7d4c655fc7162c967ac23439c3f2c21b97f902
SSDEEP 384:WIpDdbKqWGUueJldLbv6rZ88YnFQtqlsA8X5ZwvBiUE7rSeBed2n:bGGUNld/v6rZd0JOAw5wBi1SeBed
TLSH
T19BA22B12B5809216F8E241FFD2FA8EE5D67EAA600F2D41D7E7C15CACD9306D2B435A0D
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

7408

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_RELOCS_STRIPPED IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

E:\Project\Dual personality\Debug\Dual personality.pdb

kernel32

VirtualAlloc VirtualProtect GetModuleHandleA FreeLibrary VirtualQuery GetProcessHeap HeapFree HeapAlloc GetLastError GetModuleHandleW GetStartupInfoW InitializeSListHead GetSystemTimeAsFileTime GetCurrentProcessId QueryPerformanceCounter IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter WideCharToMultiByte MultiByteToWideChar RaiseException IsDebuggerPresent GetCurrentThreadId GetProcAddress

vcruntime140d

__std_type_info_destroy_list __current_exception __current_exception_context memset _except_handler4_common __vcrt_GetModuleFileNameW __vcrt_GetModuleHandleW __vcrt_LoadLibraryExW memcmp memcpy

ucrtbased

_initialize_narrow_environment strcpy_s strcat_s __stdio_common_vsprintf_s _seh_filter_dll _initialize_onexit_table _register_onexit_function _execute_onexit_table _crt_atexit _crt_at_quick_exit _controlfp_s terminate _configthreadlocale _wsplitpath_s wcscpy_s _register_thread_local_exe_atexit_callback _configure_narrow_argv __setusermatherr _set_app_type _seh_filter_exe _CrtDbgReportW _CrtDbgReport exit __stdio_common_vfscanf puts __acrt_iob_func _set_new_mode _c_exit _cexit __p___argv __p___argc _set_fmode _exit _initterm_e _initterm _wmakepath_s _get_initial_narrow_environment __p__commode

Sharing

General

Malware Config

Signatures

File Explorer

d7116c32dc5f2125ee489559eb4fce80adef00ea1fb4af24fdc949c0a1d89fa2

kernel32

vcruntime140d

ucrtbased

generic