fedf3978d94cdc8dd467220c0cd669cee8f64b78f6e785fd9206a7e6c5c46f8b

Sharing

Copy URL Twitter E-mail

General

Target
fedf3978d94cdc8dd467220c0cd669cee8f64b78f6e785fd9206a7e6c5c46f8b
Size 2.6MB
Sample260719-3z2eaahs5q
SHA256 fedf3978d94cdc8dd467220c0cd669cee8f64b78f6e785fd9206a7e6c5c46f8b
MD5 90d4d75858b85c1b9ac32a280c200116
SHA1 88bc60ce8f2dfcdd03febc23c5a31f98c5ac5fc3
SHA512 707853d85860c35e2a55ed34db5441b7ac98160dcee18dccda47716aa6d2700a3555c68517b12e500a1fa912f1488d9452b16a60716ffe864bf4a4a2cfb1aafc
SSDEEP 49152:xHqCj/R80W18hmG+bil+oYtSf6ufR80W18hmG+bil+oYtSf6u:xHqaM9ocSCQM9ocSC
TLSH
T157C51229926592FAFD3780B449429284B966B43283792BFF43E0D7336F137C11E6DB16
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
fedf3978d94cdc8dd467220c0cd669cee8f64b78f6e785fd9206a7e6c5c46f8b

File Explorer

fedf3978d94cdc8dd467220c0cd669cee8f64b78f6e785fd9206a7e6c5c46f8b

.exe 2.6MB

fedf3978d94cdc8dd467220c0cd669cee8f64b78f6e785fd9206a7e6c5c46f8b

IMPHASH 3132b97acae9eb7f3053e4d14c497a51
SHA256 fedf3978d94cdc8dd467220c0cd669cee8f64b78f6e785fd9206a7e6c5c46f8b
MD5 90d4d75858b85c1b9ac32a280c200116
SHA1 88bc60ce8f2dfcdd03febc23c5a31f98c5ac5fc3
SHA512 707853d85860c35e2a55ed34db5441b7ac98160dcee18dccda47716aa6d2700a3555c68517b12e500a1fa912f1488d9452b16a60716ffe864bf4a4a2cfb1aafc
SSDEEP 49152:xHqCj/R80W18hmG+bil+oYtSf6ufR80W18hmG+bil+oYtSf6u:xHqaM9ocSCQM9ocSC
TLSH
T157C51229926592FAFD3780B449429284B966B43283792BFF43E0D7336F137C11E6DB16
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

276528

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

AcquireSRWLockExclusive CloseHandle CompareStringW CreateFileW DecodePointer DeleteCriticalSection EncodePointer EnterCriticalSection EnumSystemLocalesW ExitProcess FindClose FindFirstFileExW FindNextFileW FlsAlloc FlsFree FlsGetValue FlsSetValue FlushFileBuffers FreeConsole FreeEnvironmentStringsW FreeLibrary GetACP GetCPInfo GetCommandLineA GetCommandLineW GetConsoleMode GetConsoleOutputCP GetCurrentProcess GetCurrentProcessId GetCurrentThreadId GetEnvironmentStringsW GetFileSizeEx GetFileType GetLastError GetLocaleInfoW GetModuleFileNameW GetModuleHandleA GetModuleHandleExW GetModuleHandleW GetOEMCP GetProcAddress GetProcessHeap GetStartupInfoW GetStdHandle GetStringTypeW GetSystemTimeAsFileTime GetUserDefaultLCID HeapAlloc HeapFree HeapReAlloc HeapSize InitializeCriticalSectionAndSpinCount InitializeCriticalSectionEx InitializeSListHead IsDebuggerPresent IsProcessorFeaturePresent IsValidCodePage IsValidLocale LCMapStringEx LCMapStringW LeaveCriticalSection LoadLibraryExW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseException ReadConsoleW ReadFile ReleaseSRWLockExclusive RtlCaptureContext RtlLookupFunctionEntry RtlPcToFileHeader RtlUnwind RtlUnwindEx RtlVirtualUnwind SetEndOfFile SetEnvironmentVariableW SetFilePointerEx SetLastError SetStdHandle SetUnhandledExceptionFilter Sleep SleepConditionVariableSRW TerminateProcess TlsAlloc TlsFree TlsGetValue TlsSetValue UnhandledExceptionFilter WakeAllConditionVariable WideCharToMultiByte WriteConsoleW WriteFile

user32

AppendMenuW CreateMenu CreatePopupMenu CreateWindowExW DefWindowProcW DestroyWindow LoadCursorW LoadIconW MessageBoxA MessageBoxW PostQuitMessage RegisterClassExW SetMenu

Name

.text

Size

416KB

Virtual Size

420KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

65KB

Virtual Size

68KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

5KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

12KB

Virtual Size

12KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.gxfg

Size

9KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.world

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.world

Size

1.0MB

Virtual Size

1.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

fedf3978d94cdc8dd467220c0cd669cee8f64b78f6e785fd9206a7e6c5c46f8b

kernel32

user32

generic