a5d02cd7577a2355cac8371f950fd88cc47f3031b1e45377d2e944c07e67e20c

Sharing

Copy URL Twitter E-mail

General

Target
a5d02cd7577a2355cac8371f950fd88cc47f3031b1e45377d2e944c07e67e20c
Size 396KB
Sample260722-xsen2sba72
SHA256 a5d02cd7577a2355cac8371f950fd88cc47f3031b1e45377d2e944c07e67e20c
MD5 b3eae4208ae3faea350b703aa5fb8366
SHA1 f9c9d501ed860f991243d5080a5c3ee11a08b3f6
SHA512 e884d2d9ea51adfaf092d448fea291d116b8dd785ce5aa1b7a3148b2306d470f8161f3e26ea63bb2806672aab549bbd30e18da4b449cbe2b7b152fbf42ff20c7
SSDEEP 6144:9rg/5azqkEqb2Ai7anXfO/ooKmWkmE6DE3i:9fq1cWW2
TLSH
T1BC8429157BD8801BE57E2B31DCBB47A93632FD96AAE4CD4E8F14132C5961BE0CD22712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a5d02cd7577a2355cac8371f950fd88cc47f3031b1e45377d2e944c07e67e20c

File Explorer

a5d02cd7577a2355cac8371f950fd88cc47f3031b1e45377d2e944c07e67e20c

.dll 396KB

a5d02cd7577a2355cac8371f950fd88cc47f3031b1e45377d2e944c07e67e20c

IMPHASH a12f1cb19da9f50d7d1ecc50b237749a
SHA256 a5d02cd7577a2355cac8371f950fd88cc47f3031b1e45377d2e944c07e67e20c
MD5 b3eae4208ae3faea350b703aa5fb8366
SHA1 f9c9d501ed860f991243d5080a5c3ee11a08b3f6
SHA512 e884d2d9ea51adfaf092d448fea291d116b8dd785ce5aa1b7a3148b2306d470f8161f3e26ea63bb2806672aab549bbd30e18da4b449cbe2b7b152fbf42ff20c7
SSDEEP 6144:9rg/5azqkEqb2Ai7anXfO/ooKmWkmE6DE3i:9fq1cWW2
TLSH
T1BC8429157BD8801BE57E2B31DCBB47A93632FD96AAE4CD4E8F14132C5961BE0CD22712
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

7408

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

comctl32

PropertySheetW

gdi32

CreateCompatibleDC DeleteDC GetTextExtentPoint32A GetTextExtentPoint32W

kernel32

GlobalLock GlobalReAlloc GlobalUnlock HeapAlloc HeapReAlloc IsBadStringPtrW

kernelbase

DisableThreadLibraryCalls GetLocaleInfoA GetLocaleInfoEx GetModuleHandleW GetProcAddress GetTickCount GlobalAlloc GlobalFree MulDiv MultiByteToWideChar RegCloseKey RegCreateKeyExA RegGetValueA RegOpenKeyExA RegSetValueExA

ntdll

LdrGetDllHandle NtQueryVirtualMemory RtlFindExportedRoutineByName _vsnprintf

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vswprintf _strdup _wcsdup atoi calloc free fwrite getenv malloc memcmp memcpy memmove memset realloc strchr strcmp strcpy strcspn strlen strncmp wcscmp wcstombs

user32

CreateDialogParamW DestroyWindow DispatchMessageW EnableWindow GetDialogBaseUnits GetDlgCtrlID GetDlgItem GetScrollInfo GetWindowRect IsDialogMessageW IsWindowEnabled LoadStringW MessageBoxW PeekMessageW SendDlgItemMessageW SendMessageA SendMessageW SetDlgItemInt SetDlgItemTextW SetWindowPos SetWindowTextA SetWindowTextW ShowWindow TranslateMessage

Name

.text

Size

44KB

Virtual Size

43KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

412B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.buildid

Size

4KB

Virtual Size

53B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

4KB

Virtual Size

52B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1000B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

4KB

Virtual Size

80B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

60KB

Virtual Size

56KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/14

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/29

Size

116KB

Virtual Size

113KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/41

Size

12KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/55

Size

40KB

Virtual Size

38KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/67

Size

8KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/80

Size

4KB

Virtual Size

840B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/91

Size

64KB

Virtual Size

61KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/102

Size

8KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

a5d02cd7577a2355cac8371f950fd88cc47f3031b1e45377d2e944c07e67e20c

comctl32

gdi32

kernel32

kernelbase

ntdll

ucrtbase

user32

generic