10b549f8512f784e16dd460902c29e7f7286630500abbce5df361ec8890f80d1

General

Target
10b549f8512f784e16dd460902c29e7f7286630500abbce5df361ec8890f80d1
Size 47.2MB
Sample260719-3affhsfv2p
SHA256 10b549f8512f784e16dd460902c29e7f7286630500abbce5df361ec8890f80d1
MD5 28ef3fd013f10ad984ee49e33ef6836c
SHA1 b5cb727c4e7b2354e3d15db146e05d85a736bc9a
SHA512 4f00c8fa367e51886dc502a6e92d8b93919290febc0bca27e3c1fc84b38b50e59d5e023397b9a2bd6f93c3fc3dce1e837645e031071613d920e5adaa11d42225
SSDEEP 786432:9tw43g5G7fE9H31TANrtXG9L2LHvRxVD5pJw5B1EPmWsfEowjAUL1p+TMhbh40NA:w438ucB3G5tXG9LePFDwB0dsMtjAUL16
TLSH
T1B9B72320274EC52BDAE705B0296D9A9F10286E650B7D98C7F3CC7D6E16F74C21631E2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
10b549f8512f784e16dd460902c29e7f7286630500abbce5df361ec8890f80d1

File Explorer

10b549f8512f784e16dd460902c29e7f7286630500abbce5df361ec8890f80d1

.exe 47.2MB

10b549f8512f784e16dd460902c29e7f7286630500abbce5df361ec8890f80d1

IMPHASH 836688c7d21e39394af41ce9a8c2d728
SHA256 10b549f8512f784e16dd460902c29e7f7286630500abbce5df361ec8890f80d1
MD5 28ef3fd013f10ad984ee49e33ef6836c
SHA1 b5cb727c4e7b2354e3d15db146e05d85a736bc9a
SHA512 4f00c8fa367e51886dc502a6e92d8b93919290febc0bca27e3c1fc84b38b50e59d5e023397b9a2bd6f93c3fc3dce1e837645e031071613d920e5adaa11d42225
SSDEEP 786432:9tw43g5G7fE9H31TANrtXG9L2LHvRxVD5pJw5B1EPmWsfEowjAUL1p+TMhbh40NA:w438ucB3G5tXG9LePFDwB0dsMtjAUL16
TLSH
T1B9B72320274EC52BDAE705B0296D9A9F10286E650B7D98C7F3CC7D6E16F74C21631E2B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

1668884

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\JobRelease\win\Release\stubs\x86\ExternalUi.pdb

kernel32

CreateFileW CloseHandle WriteFile DeleteFileW HeapDestroy HeapSize HeapReAlloc HeapFree HeapAlloc GetProcessHeap SizeofResource LockResource LoadResource FindResourceW FindResourceExW RemoveDirectoryW GetTempPathW GetTempFileNameW CreateDirectoryW MoveFileW GetLastError EnterCriticalSection LeaveCriticalSection GetModuleFileNameW DeleteCriticalSection InitializeCriticalSectionAndSpinCount GetCurrentThreadId RaiseException SetLastError GlobalUnlock GlobalLock GlobalAlloc MulDiv lstrcmpW CreateEventW FindClose FindFirstFileW GetFullPathNameW SetEvent InitializeCriticalSection lstrcpynW CreateThread WaitForSingleObject GetProcAddress LoadLibraryExW Sleep GetDiskFreeSpaceExW DecodePointer GetExitCodeThread GetCurrentProcessId FreeLibrary GetSystemDirectoryW lstrlenW VerifyVersionInfoW VerSetConditionMask lstrcmpiW GetModuleHandleW LoadLibraryW GetDriveTypeW CompareStringW FindNextFileW GetLogicalDriveStringsW GetFileSize GetFileAttributesW GetShortPathNameW SetFileAttributesW GetFileTime CopyFileW ReadFile SetFilePointer SystemTimeToFileTime MultiByteToWideChar WideCharToMultiByte GetCurrentProcess GetSystemInfo WaitForMultipleObjects VirtualProtect VirtualQuery LoadLibraryExA GetStringTypeW SetUnhandledExceptionFilter FormatMessageW FileTimeToSystemTime GetEnvironmentVariableW GetEnvironmentStringsW LocalFree InitializeCriticalSectionEx LoadLibraryA GetModuleFileNameA GetCurrentThread GetConsoleOutputCP FlushFileBuffers SetConsoleTextAttribute GetStdHandle GetConsoleScreenBufferInfo OutputDebugStringW CreateProcessW GetExitCodeProcess GetTickCount GetCommandLineW SetCurrentDirectoryW SetEndOfFile EnumResourceLanguagesW GetLocaleInfoW GetSystemDefaultLangID GetUserDefaultLangID GetWindowsDirectoryW GetSystemTime GetDateFormatW GetTimeFormatW CreateToolhelp32Snapshot Process32FirstW Process32NextW ResetEvent GlobalFree GetPrivateProfileStringW GetPrivateProfileSectionNamesW WritePrivateProfileStringW GetLocalTime CreateNamedPipeW ConnectNamedPipe Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection IsWow64Process TerminateThread LocalAlloc CompareFileTime CopyFileExW OpenEventW PeekNamedPipe QueryPerformanceCounter QueryPerformanceFrequency EncodePointer LCMapStringEx GetSystemTimeAsFileTime CompareStringEx GetCPInfo IsDebuggerPresent InitializeSListHead InterlockedPopEntrySList InterlockedPushEntrySList FlushInstructionCache IsProcessorFeaturePresent VirtualAlloc VirtualFree WaitForSingleObjectEx UnhandledExceptionFilter TerminateProcess GetStartupInfoW RtlUnwind TlsAlloc TlsGetValue TlsSetValue TlsFree ExitProcess GetModuleHandleExW GetFileType GetTimeZoneInformation LCMapStringW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetConsoleMode IsValidCodePage GetACP GetOEMCP GetFileSizeEx SetFilePointerEx FindFirstFileExW GetCommandLineA FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle ReadConsoleW WriteConsoleW

Sharing

General

Malware Config

Signatures

File Explorer

10b549f8512f784e16dd460902c29e7f7286630500abbce5df361ec8890f80d1

kernel32

generic