ff001c344d9d3ca272083be168e8cac3c85edcfda4cf6d328d9230f5bfbebd84

Sharing

Copy URL Twitter E-mail

General

Target
ff001c344d9d3ca272083be168e8cac3c85edcfda4cf6d328d9230f5bfbebd84
Size 364KB
Sample260721-se7epadm5z
SHA256 ff001c344d9d3ca272083be168e8cac3c85edcfda4cf6d328d9230f5bfbebd84
MD5 0633e2aa81e5f8e944355623899d36d4
SHA1 f4154a468129979d9408c95c248afeb09f2b90e3
SHA512 1a40c2a673cf21dcdc9896771f6cef91e7f6bd0cd35857fdacb1db47b17605118384ff842585538d3890ac1f818983679a48e0f0fd000bd8b580e1a6117e8bb4
SSDEEP 3072:4pxMuTzkNJq8gsHj0X+Zdn2AJqP/MZpJrqCqw/uFtQEsY5B5IAS:4Mu/kNJXD0XYpk4/umkI/
TLSH
T10584C73667F9C611F5F38B381D7687A52A36BC20FE21CB1F9A40664E1874970DE16F22
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ff001c344d9d3ca272083be168e8cac3c85edcfda4cf6d328d9230f5bfbebd84

File Explorer

ff001c344d9d3ca272083be168e8cac3c85edcfda4cf6d328d9230f5bfbebd84

.exe 364KB

ff001c344d9d3ca272083be168e8cac3c85edcfda4cf6d328d9230f5bfbebd84

IMPHASH ff77036b323b843908d7a463ecd4bd5e
SHA256 ff001c344d9d3ca272083be168e8cac3c85edcfda4cf6d328d9230f5bfbebd84
MD5 0633e2aa81e5f8e944355623899d36d4
SHA1 f4154a468129979d9408c95c248afeb09f2b90e3
SHA512 1a40c2a673cf21dcdc9896771f6cef91e7f6bd0cd35857fdacb1db47b17605118384ff842585538d3890ac1f818983679a48e0f0fd000bd8b580e1a6117e8bb4
SSDEEP 3072:4pxMuTzkNJq8gsHj0X+Zdn2AJqP/MZpJrqCqw/uFtQEsY5B5IAS:4Mu/kNJXD0XYpk4/umkI/
TLSH
T10584C73667F9C611F5F38B381D7687A52A36BC20FE21CB1F9A40664E1874970DE16F22
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

47040

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE

PDB paths

advapi32

RegCloseKey RegCreateKeyExW RegOpenKeyExW RegQueryValueExW RegQueryValueW RegSetValueExW

comctl32

CreateStatusWindowW CreateToolbarEx ImageList_Destroy ImageList_DrawEx ImageList_LoadImageW InitCommonControlsEx

comdlg32

ChooseFontW CommDlgExtendedError

gdi32

CreateFontIndirectW CreateFontW CreateRectRgn CreateRectRgnIndirect CreateSolidBrush DeleteObject ExtSelectClipRgn GetClipRgn GetDeviceCaps GetObjectW GetStockObject GetTextExtentPoint32W LineTo MoveToEx Rectangle SelectClipRgn SelectObject SetBkMode SetTextColor

kernel32

CloseHandle CompareFileTime CreateFileW FileTimeToLocalFileTime FileTimeToSystemTime FindClose FindFirstFileW FindNextFileW FormatMessageW GetCommandLineW GetCurrentDirectoryW GetDateFormatW GetDiskFreeSpaceExW GetDriveTypeW GetFileAttributesExW GetFileAttributesW GetFileInformationByHandle GetLogicalDriveStringsW GetModuleHandleW GetNumberFormatW GetProcAddress GetStartupInfoW GetTimeFormatW GetVolumeInformationW GlobalFree GlobalLock GlobalUnlock HeapAlloc HeapFree LocalFree MulDiv MultiByteToWideChar SetCurrentDirectoryW SetErrorMode lstrcmpW lstrcmpiW

mpr

WNetConnectionDialog WNetDisconnectDialog WNetGetLastErrorW

ole32

CoGetMalloc CoInitialize CoUninitialize

shell32

ord18 ord25 ExtractIconExW SHBindToParent SHFileOperationW SHGetDataFromIDListW SHGetDesktopFolder ShellAboutW ShellExecuteExW ShellExecuteW

shlwapi

StrFormatByteSizeW

ucrtbase

__p___argc __p___wargv __stdio_common_vswprintf _assert _configure_wide_argv _crt_atexit _get_initial_wide_environment _initialize_wide_environment _initterm _initterm_e _set_app_type _wsplitpath exit memcmp memcpy memmove memset qsort setlocale tolower wcsrchr

user32

BeginDeferWindowPos BeginPaint CallNextHookEx CallWindowProcW CharUpperW CheckMenuItem CreatePopupMenu CreateWindowExW DefFrameProcW DefMDIChildProcW DeferWindowPos DestroyIcon DestroyWindow DialogBoxParamW DispatchMessageW DrawIconEx DrawTextW EndDeferWindowPos EndDialog EndPaint FillRect GetCapture GetClientRect GetCursorPos GetDC GetDlgItem GetFocus GetKeyState GetMenuItemCount GetMessageW GetParent GetScrollPos GetSubMenu GetSystemMetrics GetWindow GetWindowInfo GetWindowLongW GetWindowPlacement GetWindowRect GetWindowTextW InvalidateRect IsIconic IsWindowVisible IsZoomed LoadAcceleratorsW LoadCursorW LoadIconW LoadImageW LoadMenuW LoadStringW MapWindowPoints MessageBoxW MoveWindow PostQuitMessage RedrawWindow RegisterClassExW RegisterClassW RegisterClipboardFormatW ReleaseCapture ReleaseDC ScreenToClient ScrollWindowEx SendMessageW SetCapture SetCursor SetDlgItemTextW SetFocus SetWindowLongW SetWindowPlacement SetWindowTextW SetWindowsHookExW ShowWindow TrackPopupMenu TranslateAcceleratorW TranslateMDISysAccel TranslateMessage UnhookWindowsHookEx UpdateWindow WinHelpW wsprintfW

version

GetFileVersionInfoSizeW GetFileVersionInfoW VerQueryValueW

Name

.text

Size

44KB

Virtual Size

42KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

64B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

52KB

Virtual Size

49KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

4KB

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

228KB

Virtual Size

226KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/14

Size

4KB

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

ff001c344d9d3ca272083be168e8cac3c85edcfda4cf6d328d9230f5bfbebd84

advapi32

comctl32

comdlg32

gdi32

kernel32

mpr

ole32

shell32

shlwapi

ucrtbase

user32

version

generic