e6a400af31594066b329c2923592673480085d940fcdc2dced85ea410c3fff3a

Sharing

Copy URL Twitter E-mail

General

Target
e6a400af31594066b329c2923592673480085d940fcdc2dced85ea410c3fff3a
Size 761KB
Sample260716-pp6dlaht61
SHA256 e6a400af31594066b329c2923592673480085d940fcdc2dced85ea410c3fff3a
MD5 83428a68c9008304e24ccb2a6f146102
SHA1 0214c7c9c187b93f4f9c60592cf2541bb3b24e5e
SHA512 c043279df8f72d54453e0393b6180bf8bedad0ef972a3932a44eff4abd9e90d32c43e0fcacb32ebb675cd578deb50b2f4a12198f03e7607036b30c6b073517cb
SSDEEP 12288:Swn1Ofx0GO+tuN0A8rzyqsuXshqx+jxpHBRbxpY7q24Do4LWJz:t8fh+LEIHg54Do4Lc
TLSH
T161F43A207541D233E8A308B697BC0E5FC52CEE72072965DB83E808BA55ADDF27B3551B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
e6a400af31594066b329c2923592673480085d940fcdc2dced85ea410c3fff3a

File Explorer

e6a400af31594066b329c2923592673480085d940fcdc2dced85ea410c3fff3a

.exe 761KB

e6a400af31594066b329c2923592673480085d940fcdc2dced85ea410c3fff3a

IMPHASH 31649d11406d14ec427d5a659ca067a2
SHA256 e6a400af31594066b329c2923592673480085d940fcdc2dced85ea410c3fff3a
MD5 83428a68c9008304e24ccb2a6f146102
SHA1 0214c7c9c187b93f4f9c60592cf2541bb3b24e5e
SHA512 c043279df8f72d54453e0393b6180bf8bedad0ef972a3932a44eff4abd9e90d32c43e0fcacb32ebb675cd578deb50b2f4a12198f03e7607036b30c6b073517cb
SSDEEP 12288:Swn1Ofx0GO+tuN0A8rzyqsuXshqx+jxpHBRbxpY7q24Do4LWJz:t8fh+LEIHg54Do4Lc
TLSH
T161F43A207541D233E8A308B697BC0E5FC52CEE72072965DB83E808BA55ADDF27B3551B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

360566

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\Project\general_use\common\UpdateFileModle\Release\UpdateFileModle.pdb

kernel32

LeaveCriticalSection EnterCriticalSection OutputDebugStringW HeapFree InitializeCriticalSectionEx HeapSize HeapReAlloc HeapAlloc DecodePointer HeapDestroy GetProcessHeap Sleep GetCommandLineW GetTempPathW GetTempFileNameW FindFirstFileW FindNextFileW FindClose InitializeCriticalSection DeleteCriticalSection RemoveDirectoryW DeleteFileW MoveFileExW CopyFileW GetModuleFileNameW GetPrivateProfileSectionNamesW GetPrivateProfileStringW WideCharToMultiByte GetLocalTime GetCurrentProcessId GetCurrentThreadId GetFileSize CreateFileW MultiByteToWideChar SetFilePointer CloseHandle WriteConsoleW SetEndOfFile ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineA GetOEMCP GetACP IsValidCodePage SetFilePointerEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale WriteFile ReadFile CreateFileA GetFileAttributesW GetLocaleInfoW LCMapStringW GetLastError CreateDirectoryW CompareStringW VirtualProtect FlsFree FlsSetValue InitOnceBeginInitialize InitOnceComplete FormatMessageA GetStringTypeW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive LocalFree GetLocaleInfoEx FindFirstFileExW GetFileAttributesExW AreFileApisANSI DeviceIoControl GetModuleHandleW GetProcAddress GetFileInformationByHandleEx EncodePointer LCMapStringEx QueryPerformanceCounter GetSystemTimeAsFileTime GetCPInfo IsDebuggerPresent RaiseException InitializeCriticalSectionAndSpinCount GetCurrentProcess FreeLibrary LoadLibraryW lstrcpynW lstrcpyW lstrlenW WakeAllConditionVariable SleepConditionVariableSRW IsProcessorFeaturePresent UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess GetStartupInfoW InitializeSListHead GetSystemWindowsDirectoryW GetVersionExW FreeResource LoadLibraryExW LoadResource LockResource SizeofResource FindResourceW lstrcmpA GetStdHandle GetFileType GetModuleHandleA GetFileSizeEx FindResourceExW RtlUnwind SetLastError TlsAlloc TlsGetValue TlsSetValue TlsFree CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess FlsAlloc FlsGetValue

user32

PostMessageW MessageBoxA GetProcessWindowStation GetUserObjectInformationW

advapi32

RegisterEventSourceA DeregisterEventSource RegEnumKeyExW CryptAcquireContextW CryptCreateHash CryptHashData RegCloseKey RegOpenKeyExW RegQueryValueExW OpenProcessToken GetTokenInformation RegCreateKeyExW RegSetValueExW CryptGetHashParam CryptReleaseContext CryptDestroyHash ReportEventA

shell32

SHGetFolderPathW

ole32

CoInitializeEx CoInitialize CoCreateGuid CoSetProxyBlanket CoInitializeSecurity CoUninitialize CoCreateInstance

oleaut32

VariantClear VariantInit SysAllocString SysAllocStringLen SysFreeString SysStringLen

shlwapi

StrStrIW PathCombineW StrTrimA StrCmpNIW StrStrIA PathFileExistsW PathAppendW PathRemoveFileSpecW StrCmpIW

winhttp

WinHttpCloseHandle WinHttpQueryHeaders WinHttpCrackUrl WinHttpOpen WinHttpSetTimeouts WinHttpConnect WinHttpOpenRequest WinHttpReceiveResponse WinHttpSendRequest WinHttpReadData

cabinet

ord23 ord22 ord20

wininet

InternetGetConnectedState

iphlpapi

GetAdaptersInfo

urlmon

URLDownloadToCacheFileW URLDownloadToFileW

version

GetFileVersionInfoSizeW VerQueryValueW GetFileVersionInfoW

Name

.text

Size

584KB

Virtual Size

583KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

142KB

Virtual Size

142KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

6KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

26KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

e6a400af31594066b329c2923592673480085d940fcdc2dced85ea410c3fff3a

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

winhttp

cabinet

wininet

iphlpapi

urlmon

version

generic