a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19

Sharing

Copy URL Twitter E-mail

General

Target
a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19
Size 1020KB
Sample260722-w4ebzssamd
SHA256 a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19
MD5 8a135aadedb0ee518d3f47ffba65b79a
SHA1 a456eacab4c267643e7a8942e03a8b1802b66dfa
SHA512 70c290f3904db8ecd8c6f65d65123913126e18c7be36e06e501aa9db8bb3f52320f9ec01045e07adee08c59e038d8b7c4068b6d6e698738e64aeb7c2135f97a9
SSDEEP 24576:c2qhwlsCakI3vvhCGpgpCedZWMkt+DzcnQC3ua:pqSYRCGcQQnGh
TLSH
T1EA2533A1674128A4C6B9E57682A0F7B74642F960126E363CC6F163793F3CD724ECC927
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19

File Explorer

a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19

.exe 1020KB

a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19

IMPHASH 8cb3f576cb47496aefd773d479b668e0
SHA256 a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19
MD5 8a135aadedb0ee518d3f47ffba65b79a
SHA1 a456eacab4c267643e7a8942e03a8b1802b66dfa
SHA512 70c290f3904db8ecd8c6f65d65123913126e18c7be36e06e501aa9db8bb3f52320f9ec01045e07adee08c59e038d8b7c4068b6d6e698738e64aeb7c2135f97a9
SSDEEP 24576:c2qhwlsCakI3vvhCGpgpCedZWMkt+DzcnQC3ua:pqSYRCGcQQnGh
TLSH
T1EA2533A1674128A4C6B9E57682A0F7B74642F960126E363CC6F163793F3CD724ECC927
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

GetUserNameA RegCloseKey RegOpenKeyExA RegQueryValueExA

kernel32

AddVectoredExceptionHandler DeleteCriticalSection EnterCriticalSection FindResourceA FlushInstructionCache GetComputerNameA GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentVariableA GetLastError GetModuleHandleA GetProcAddress GetStartupInfoA GetSystemInfo GetThreadContext GetTickCount GetVersionExA InitializeCriticalSection IsDBCSLeadByte LeaveCriticalSection LoadLibraryA LoadResource LockResource QueryPerformanceFrequency SetThreadContext SetUnhandledExceptionFilter SizeofResource Sleep TlsGetValue VirtualAlloc VirtualFree VirtualProtect VirtualQuery __C_specific_handler

api-ms-win-crt-environment-l1-1-0

__p__environ

api-ms-win-crt-heap-l1-1-0

_set_new_mode calloc free malloc

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-private-l1-1-0

memcpy

api-ms-win-crt-runtime-l1-1-0

__p___argc __p___argv __p__acmdln _cexit _configure_narrow_argv _crt_atexit _exit _initialize_narrow_environment _set_app_type _initterm _initterm_e _set_invalid_parameter_handler abort exit signal

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func __p__commode __p__fmode __stdio_common_vfprintf fflush setvbuf

api-ms-win-crt-string-l1-1-0

strlen strncmp

Name

.text

Size

9KB

Virtual Size

9KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

512B

Virtual Size

160B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

1024B

Virtual Size

588B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

480B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

416B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

999KB

Virtual Size

999KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

a265f9db4e74dad02ab0df7cc67acf1196766819a381f6a71ba393f00fa22f19

advapi32

kernel32

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-private-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

generic