c5bae6391242f986d51bed08a74bf4107490fd7ba7f6231bbd14b0b02e8fb1f8

Sharing

Copy URL Twitter E-mail

General

Target
c5bae6391242f986d51bed08a74bf4107490fd7ba7f6231bbd14b0b02e8fb1f8
Size 144KB
Sample260716-e5g1tsc15n
SHA256 c5bae6391242f986d51bed08a74bf4107490fd7ba7f6231bbd14b0b02e8fb1f8
MD5 7e1fde35bbbb38f25b2248fb5034fb6e
SHA1 c7da96027464f719d294e4e978c192de4b8d9e95
SHA512 4c98314017598cbd7ccd30ca82cf712d0274345031753e2427c47abe6198e5c05d0063cdf6212a4da1f83fc69e68d3eeedc22117c1118aef2381e467c19eb6eb
SSDEEP 3072:WDwVxUonFnBJggJ+0rtooo13BT1usUzS:5UqnP+0g1u
TLSH
T193E30802B7E329DCD537C6358AB66333EB32BC105930AB2F1E54D9660E71E94AD29F11
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
c5bae6391242f986d51bed08a74bf4107490fd7ba7f6231bbd14b0b02e8fb1f8

File Explorer

c5bae6391242f986d51bed08a74bf4107490fd7ba7f6231bbd14b0b02e8fb1f8

.exe 144KB

c5bae6391242f986d51bed08a74bf4107490fd7ba7f6231bbd14b0b02e8fb1f8

IMPHASH a1cb83dd6d977722823f6a0eb4cc2880
SHA256 c5bae6391242f986d51bed08a74bf4107490fd7ba7f6231bbd14b0b02e8fb1f8
MD5 7e1fde35bbbb38f25b2248fb5034fb6e
SHA1 c7da96027464f719d294e4e978c192de4b8d9e95
SHA512 4c98314017598cbd7ccd30ca82cf712d0274345031753e2427c47abe6198e5c05d0063cdf6212a4da1f83fc69e68d3eeedc22117c1118aef2381e467c19eb6eb
SSDEEP 3072:WDwVxUonFnBJggJ+0rtooo13BT1usUzS:5UqnP+0g1u
TLSH
T193E30802B7E329DCD537C6358AB66333EB32BC105930AB2F1E54D9660E71E94AD29F11
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

72224

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

RegCloseKey RegCreateKeyExW RegGetValueW RegOpenKeyW RegQueryValueExW RegSetValueExA RegSetValueExW

gdi32

CreateCompatibleDC CreateDIBSection CreateFontIndirectW DeleteDC DeleteObject GetDeviceCaps GetTextExtentPointA GetTextExtentPointW GetTextMetricsW SelectObject SetBkMode SetTextColor

kernel32

CloseHandle CompareStringW CreateEventW CreateFileW CreateMutexW CreateProcessW CreateThread DelayLoadFailureHook DuplicateHandle EnterCriticalSection ExitProcess ExpandEnvironmentStringsW FindClose FindFirstFileW FindNextFileW FreeLibrary GetCommandLineW GetFullPathNameW GetModuleHandleW GetOverlappedResult GetProcAddress GetStartupInfoW GetTickCount HeapAlloc HeapReAlloc InitializeCriticalSectionEx IsBadStringPtrA IsBadStringPtrW LeaveCriticalSection LoadLibraryW MapViewOfFile MulDiv MultiByteToWideChar OpenProcess ReadDirectoryChangesW ResolveDelayLoadedAPI SetThreadDescription UnmapViewOfFile WaitForMultipleObjects WaitForSingleObject lstrcmpiW

ntdll

NtSetInformationProcess _vsnprintf

rpcrt4

UuidCreate

ucrtbase

__acrt_iob_func __p___argc __p___wargv __stdio_common_vsprintf __stdio_common_vswprintf _assert _configure_wide_argv _get_initial_wide_environment _initialize_wide_environment _set_app_type _strdup _wcsicmp _wcsnicmp calloc exit free fwrite getenv iswspace malloc memcmp memcpy memmove memset realloc strchr strcmp strcspn strlen wcschr wcscmp wcscpy wcslen wcstoul

user32

AdjustWindowRect AppendMenuW BeginPaint ChangeDisplaySettingsExW ClientToScreen ClipCursor CopyIcon CreateDesktopW CreateIcon CreatePopupMenu CreateWindowExW DefWindowProcW DestroyIcon DestroyMenu DestroyWindow DispatchMessageW DrawCaptionTempW DrawFrameControl DrawIconEx DrawTextW EndPaint EnumDisplayDevicesW EnumDisplaySettingsExW ExitWindowsEx GetAncestor GetClientRect GetDC GetDesktopWindow GetForegroundWindow GetMenuInfo GetMenuItemCount GetMenuItemInfoW GetMessageW GetProcessWindowStation GetSystemMetrics GetThreadDesktop GetUserObjectInformationW GetWindow GetWindowLongPtrW GetWindowLongW GetWindowRect GetWindowThreadProcessId InsertMenuItemW IntersectRect InvalidateRect IsIconic IsWindowEnabled IsWindowVisible KillTimer LoadCursorA LoadCursorW LoadIconW LoadStringW MessageBoxW MsgWaitForMultipleObjects PaintDesktop PeekMessageW PostMessageW PostQuitMessage RegisterClassExW RegisterClassW ReleaseDC SendMessageW SendNotifyMessageW SetCursor SetForegroundWindow SetMenuInfo SetMenuItemInfoW SetParent SetShellWindow SetThreadDesktop SetTimer SetWindowLongPtrW SetWindowLongW SetWindowPos SetWindowTextW ShowWindow SubtractRect SystemParametersInfoW TrackPopupMenuEx TranslateMessage UnregisterClassW UpdateLayeredWindow UpdateWindow

win32u

NtUserMessageCall

Name

.text

Size

68KB

Virtual Size

66KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

32KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

16KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

572B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

c5bae6391242f986d51bed08a74bf4107490fd7ba7f6231bbd14b0b02e8fb1f8

advapi32

gdi32

kernel32

ntdll

rpcrt4

ucrtbase

user32

win32u

generic