1a9cfd79ec916da0cb12d24b9024f5b033ebbe044cb0b9baaff3b625bd757eee

Sharing

Copy URL Twitter E-mail

General

Target
1a9cfd79ec916da0cb12d24b9024f5b033ebbe044cb0b9baaff3b625bd757eee
Size 292KB
Sample260723-ftrlkaek2t
SHA256 1a9cfd79ec916da0cb12d24b9024f5b033ebbe044cb0b9baaff3b625bd757eee
MD5 8aa5bc90be43cfc9efca693ee08da53c
SHA1 f46de2109e7c689675edfb993c5fdb66783b4c7e
SHA512 e4611b08c755bb02017c7991706bbcb8798ca55d4974ab63418dbc93129bedf8c06d0c22a98feb466c13be427f60643a6a33450ebef4cc7da295d2346fc28952
SSDEEP 3072:6BnNQO/yDFdAZErD312sPe2E/PscDeOT2lvgh8sWq4qrAkE/0PS5WD+:6By/dbtnbsWwE8qWC
TLSH
T1DC54B41587A940E9F537E9729EB36332BD32B4890A24493BDE38D9884570B0E793DF17
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1a9cfd79ec916da0cb12d24b9024f5b033ebbe044cb0b9baaff3b625bd757eee

File Explorer

1a9cfd79ec916da0cb12d24b9024f5b033ebbe044cb0b9baaff3b625bd757eee

.exe 292KB

1a9cfd79ec916da0cb12d24b9024f5b033ebbe044cb0b9baaff3b625bd757eee

IMPHASH 60d1dd08fb9b7c846b876a4da23af096
SHA256 1a9cfd79ec916da0cb12d24b9024f5b033ebbe044cb0b9baaff3b625bd757eee
MD5 8aa5bc90be43cfc9efca693ee08da53c
SHA1 f46de2109e7c689675edfb993c5fdb66783b4c7e
SHA512 e4611b08c755bb02017c7991706bbcb8798ca55d4974ab63418dbc93129bedf8c06d0c22a98feb466c13be427f60643a6a33450ebef4cc7da295d2346fc28952
SSDEEP 3072:6BnNQO/yDFdAZErD312sPe2E/PscDeOT2lvgh8sWq4qrAkE/0PS5WD+:6By/dbtnbsWwE8qWC
TLSH
T1DC54B41587A940E9F537E9729EB36332BD32B4890A24493BDE38D9884570B0E793DF17
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

23744

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

comdlg32

GetOpenFileNameA

gdi32

DeleteObject GetObjectW GetStockObject

kernel32

GetCommandLineA GetCurrentDirectoryA GetModuleHandleA GetPrivateProfileIntA GetPrivateProfileStringA GetStartupInfoA LocalAlloc LocalFree LocalLock LocalReAlloc OpenFile WinExec WritePrivateProfileStringA _lclose _lcreat _llseek _lopen _lread _lwrite lstrcmpA lstrcmpiA

shell32

ExtractIconA ShellAboutA

ucrtbase

__p___argc __p___argv __stdio_common_vsprintf __stdio_common_vsscanf _configure_narrow_argv _get_initial_narrow_environment _initialize_narrow_environment _set_app_type exit memcpy strcmp strcpy strlen

user32

ArrangeIconicWindows BeginPaint CheckDlgButton CheckMenuItem CheckRadioButton CloseWindow CreateIcon CreateWindowExW DefFrameProcW DefMDIChildProcW DefWindowProcW DestroyMenu DestroyWindow DialogBoxParamW DispatchMessageW DrawIcon EnableMenuItem EndDialog EndPaint GetClientRect GetDlgItemTextA GetIconInfo GetMessageW GetSubMenu GetWindowLongPtrW IsDlgButtonChecked IsIconic IsZoomed LoadAcceleratorsW LoadCursorW LoadIconW LoadMenuW LoadStringA MessageBoxA OpenIcon PostQuitMessage RegisterClassW SendDlgItemMessageA SendDlgItemMessageW SendMessageA SendMessageW SetDlgItemTextA SetMenu SetWindowLongPtrW SetWindowPos SetWindowTextA ShowWindow TranslateAcceleratorW TranslateMessage UpdateWindow WinHelpA wsprintfA

Name

.text

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

4KB

Virtual Size

684B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

4KB

Virtual Size

732B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

416B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

4KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

220KB

Virtual Size

219KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

12B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

4KB

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

4KB

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

4KB

Virtual Size

20B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

4KB

Virtual Size

92B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

4KB

Virtual Size

72B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

4KB

Virtual Size

231B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

4KB

Virtual Size

219B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

1a9cfd79ec916da0cb12d24b9024f5b033ebbe044cb0b9baaff3b625bd757eee

comdlg32

gdi32

kernel32

shell32

ucrtbase

user32

generic