00468e5f4e1bfc0d6d34716f0a51853712d1d09ea1cbddb18a67e84cafda9250

Sharing

Copy URL Twitter E-mail

General

Target
00468e5f4e1bfc0d6d34716f0a51853712d1d09ea1cbddb18a67e84cafda9250
Size 1.0MB
Sample260724-x451da1elf
SHA256 00468e5f4e1bfc0d6d34716f0a51853712d1d09ea1cbddb18a67e84cafda9250
MD5 9316f70e87043b4f4eb72c6da4a6954a
SHA1 0ef64559b3902214ccb7756308a0224d5fa150df
SHA512 f391ccf15bad73214ad0cab0be5753c930e8648c91f4ce258968d839a05974ce62ee86ef6af33f01161afc724478a130d17c14782c746125cdd6c687865a45a3
SSDEEP 24576:CMsdNXsQXoUr8NY9bpKe4aL4vwbcKxray:9svXsotrLj4JKx2y
TLSH
T1BC257D29B65402FDD0A6CAB4CA438417E67378454736BBE743E05A6B3F336F09A3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
00468e5f4e1bfc0d6d34716f0a51853712d1d09ea1cbddb18a67e84cafda9250

File Explorer

00468e5f4e1bfc0d6d34716f0a51853712d1d09ea1cbddb18a67e84cafda9250

.exe 1.0MB

00468e5f4e1bfc0d6d34716f0a51853712d1d09ea1cbddb18a67e84cafda9250

IMPHASH ed260618c59e58caf0f0052f86ed0301
SHA256 00468e5f4e1bfc0d6d34716f0a51853712d1d09ea1cbddb18a67e84cafda9250
MD5 9316f70e87043b4f4eb72c6da4a6954a
SHA1 0ef64559b3902214ccb7756308a0224d5fa150df
SHA512 f391ccf15bad73214ad0cab0be5753c930e8648c91f4ce258968d839a05974ce62ee86ef6af33f01161afc724478a130d17c14782c746125cdd6c687865a45a3
SSDEEP 24576:CMsdNXsQXoUr8NY9bpKe4aL4vwbcKxray:9svXsotrLj4JKx2y
TLSH
T1BC257D29B65402FDD0A6CAB4CA438417E67378454736BBE743E05A6B3F336F09A3A711
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

456832

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\tgtelethon\dhmbot_win32\x64\Release\dhmbot_win32.pdb

kernel32

GlobalUnlock MultiByteToWideChar WideCharToMultiByte SetEndOfFile WriteConsoleW HeapSize GetProcessHeap SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation FreeLibrary ReadFile EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetLastError VirtualProtect FlsFree FlsSetValue FlsGetValue FlsAlloc HeapAlloc HeapReAlloc HeapFree GetConsoleMode GlobalLock SetCurrentDirectoryW LoadLibraryW GlobalAlloc GetModuleFileNameW GetEnvironmentVariableW GlobalFree ReadConsoleW MoveFileExW GetConsoleOutputCP FlushFileBuffers GetFileType SetFilePointerEx GetFileSizeEx ExitProcess WriteFile GetStdHandle GetModuleHandleExW FreeLibraryAndExitThread ExitThread CreateThread LoadLibraryExW TlsFree TlsSetValue TlsGetValue GetTickCount64 FormatMessageA GetStringTypeW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId WakeConditionVariable WakeAllConditionVariable SleepConditionVariableSRW CreateFileW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFinalPathNameByHandleW GetFullPathNameW AreFileApisANSI CloseHandle GetModuleHandleW GetProcAddress GetFileInformationByHandleEx LocalFree GetLocaleInfoEx QueryPerformanceCounter QueryPerformanceFrequency Sleep WaitForSingleObjectEx GetExitCodeThread CompareStringEx EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetCPInfo GetSystemTimeAsFileTime RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent GetCurrentProcessId InitializeSListHead IsDebuggerPresent GetStartupInfoW RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError InitializeCriticalSectionAndSpinCount TlsAlloc RtlUnwind

user32

GetWindowTextW EnableWindow ReleaseDC UpdateWindow SystemParametersInfoW GetSysColorBrush PostQuitMessage KillTimer GetDlgItem GetClientRect SetClipboardData LoadCursorW LoadIconW TranslateMessage MoveWindow GetSysColor EmptyClipboard GetWindowTextLengthW GetMessageW DefWindowProcW PostMessageW DestroyWindow GetDC MessageBoxW EnumChildWindows CreateWindowExW SendMessageW SetWindowTextW RegisterClassExW ShowWindow OpenClipboard DispatchMessageW SetTimer CloseClipboard

gdi32

GetStockObject GetTextExtentPoint32W SetTextColor SetBkMode SetBkColor SelectObject

comdlg32

GetOpenFileNameW

ole32

CoCreateGuid StringFromGUID2

winhttp

WinHttpReceiveResponse WinHttpOpen WinHttpQueryHeaders WinHttpCrackUrl WinHttpQueryDataAvailable WinHttpConnect WinHttpSetTimeouts WinHttpSendRequest WinHttpGetProxyForUrl WinHttpGetIEProxyConfigForCurrentUser WinHttpCloseHandle WinHttpSetOption WinHttpOpenRequest WinHttpReadData

comctl32

InitCommonControlsEx

Name

.text

Size

634KB

Virtual Size

634KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

168KB

Virtual Size

168KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

10KB

Virtual Size

16KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

27KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

185KB

Virtual Size

185KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

00468e5f4e1bfc0d6d34716f0a51853712d1d09ea1cbddb18a67e84cafda9250

kernel32

user32

gdi32

comdlg32

ole32

winhttp

comctl32

generic