f4cc96e44e641e8904f15bf2ab73b874f5e63ec9420547c2092e7cf7878c71d3

General

Target
f4cc96e44e641e8904f15bf2ab73b874f5e63ec9420547c2092e7cf7878c71d3
Size 383KB
Sample260716-e2nn7scz5p
SHA256 f4cc96e44e641e8904f15bf2ab73b874f5e63ec9420547c2092e7cf7878c71d3
MD5 562db048777b3bd761e5338b0448cb06
SHA1 ce574547f682c9a1412df5d013c3b41d2541e300
SHA512 bcbc5e92f6d9fe81f5ae40e9444c0beeac3a059012aec528819a7c2b2a94326f21517245a9fac6355ae23c878f8c225f9f53b2966de7302e80826358d19f7b53
SSDEEP 6144:X438updun5N/hNE8LWoNr4yttyYEEyBESCFE73ZuFttUOdmRISE:X4s2g5N/sNEyLVYdUw
TLSH
T136845B70E1D844F1F097E5F8AD23A8CAE872B99693F1A38B27D04E460F36674467B351
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f4cc96e44e641e8904f15bf2ab73b874f5e63ec9420547c2092e7cf7878c71d3

File Explorer

f4cc96e44e641e8904f15bf2ab73b874f5e63ec9420547c2092e7cf7878c71d3

.dll 383KB

f4cc96e44e641e8904f15bf2ab73b874f5e63ec9420547c2092e7cf7878c71d3

IMPHASH 54c166e053e2fd43009742a04bb827f3
SHA256 f4cc96e44e641e8904f15bf2ab73b874f5e63ec9420547c2092e7cf7878c71d3
MD5 562db048777b3bd761e5338b0448cb06
SHA1 ce574547f682c9a1412df5d013c3b41d2541e300
SHA512 bcbc5e92f6d9fe81f5ae40e9444c0beeac3a059012aec528819a7c2b2a94326f21517245a9fac6355ae23c878f8c225f9f53b2966de7302e80826358d19f7b53
SSDEEP 6144:X438updun5N/hNE8LWoNr4yttyYEEyBESCFE73ZuFttUOdmRISE:X4s2g5N/sNEyLVYdUw
TLSH
T136845B70E1D844F1F097E5F8AD23A8CAE872B99693F1A38B27D04E460F36674467B351
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

155824

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

kernel32

ExpandEnvironmentStringsW OutputDebugStringA VirtualAlloc TerminateProcess GetModuleFileNameW SetFilePointer FindClose CreateFileW GetCurrentThreadId ResumeThread UnmapViewOfFile GetModuleHandleA CreateToolhelp32Snapshot MultiByteToWideChar Sleep GetLastError Process32NextW WriteFile Process32FirstW CloseHandle GetThreadContext GetProcAddress GetFileSize ExitProcess GetCurrentProcessId FreeLibrary CopyFileW WideCharToMultiByte CreateProcessA SetThreadContext FlushFileBuffers SetEndOfFile GetCurrentProcess FindNextFileW VirtualFree FindFirstFileW ReadFile OutputDebugStringW CreateDirectoryW WriteConsoleW HeapSize SetStdHandle GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage HeapReAlloc LocalFree FormatMessageA GetLocaleInfoEx FindFirstFileExW GetFileAttributesExW AreFileApisANSI GetModuleHandleW GetFileInformationByHandleEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetSystemTimeAsFileTime InitializeSListHead RtlUnwindEx RtlPcToFileHeader RaiseException InterlockedFlushSList SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree LoadLibraryExW GetModuleHandleExW GetFileSizeEx SetFilePointerEx GetStdHandle GetFileType GetConsoleCP GetConsoleMode HeapFree HeapAlloc LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW ReadConsoleW RtlUnwind

advapi32

RegCreateKeyExW RegSetValueExW RegOpenKeyExW RegQueryValueExW RegCloseKey

shell32

SHGetFolderPathW

ole32

CoCreateInstance CoInitializeEx CoUninitialize

Sharing

General

Malware Config

Signatures

File Explorer

f4cc96e44e641e8904f15bf2ab73b874f5e63ec9420547c2092e7cf7878c71d3

kernel32

advapi32

shell32

ole32

generic