051dc1df4ea14c71a25fea528090dd8cfd2c4e02030e6d2f91f6f2f9bad90ec3

Sharing

Copy URL Twitter E-mail

General

Target
051dc1df4ea14c71a25fea528090dd8cfd2c4e02030e6d2f91f6f2f9bad90ec3
Size 2.3MB
Sample260727-1xjeksde39
SHA256 051dc1df4ea14c71a25fea528090dd8cfd2c4e02030e6d2f91f6f2f9bad90ec3
MD5 e90e39072e1d96bc1be0fe64bd1163e5
SHA1 e50b2c974b5571c8591538057f8888f6477f24a4
SHA512 f1b3d344d9a7aa9e3fc7eff4563b450d7eb22e717a93da680f7a2d0451b6aa5de969fcaf2189e29572133993b0deadf828d1d394c0a17fd232f47da58cc81c05
SSDEEP 49152:DfjVQztgGlKeaPrr8iPi6YiQ/0nCD92ifF8enNqobdIVxTgHUoJOI0:L+zqa4UNqtVs0
TLSH
T1F9B50847E5E191ACC1BDC1B5830AB233B731784D8960BAFF5BE49E212F72B50AB19705
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
051dc1df4ea14c71a25fea528090dd8cfd2c4e02030e6d2f91f6f2f9bad90ec3

File Explorer

051dc1df4ea14c71a25fea528090dd8cfd2c4e02030e6d2f91f6f2f9bad90ec3

.exe 2.3MB

051dc1df4ea14c71a25fea528090dd8cfd2c4e02030e6d2f91f6f2f9bad90ec3

IMPHASH bd6560ceeded44def402d5b848f3b09c
SHA256 051dc1df4ea14c71a25fea528090dd8cfd2c4e02030e6d2f91f6f2f9bad90ec3
MD5 e90e39072e1d96bc1be0fe64bd1163e5
SHA1 e50b2c974b5571c8591538057f8888f6477f24a4
SHA512 f1b3d344d9a7aa9e3fc7eff4563b450d7eb22e717a93da680f7a2d0451b6aa5de969fcaf2189e29572133993b0deadf828d1d394c0a17fd232f47da58cc81c05
SSDEEP 49152:DfjVQztgGlKeaPrr8iPi6YiQ/0nCD92ifF8enNqobdIVxTgHUoJOI0:L+zqa4UNqtVs0
TLSH
T1F9B50847E5E191ACC1BDC1B5830AB233B731784D8960BAFF5BE49E212F72B50AB19705
MD5 SHA1 SHA512 SSDEEP TLSH

windows:10 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5072

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressAll WakeByAddressSingle

bcryptprimitives

ProcessPrng

advapi32

SystemFunction036

bcrypt

BCryptGenRandom

comctl32

InitCommonControlsEx

comdlg32

GetOpenFileNameW

dwmapi

DwmExtendFrameIntoClientArea DwmGetWindowAttribute DwmIsCompositionEnabled DwmSetWindowAttribute

gdi32

CreateCompatibleDC DeleteDC GetDeviceCaps GetStockObject

imm32

ImmGetContext ImmReleaseContext

kernel32

AddVectoredExceptionHandler CloseHandle CreateFileMappingA CreateFileW CreateThread CreateToolhelp32Snapshot DeleteCriticalSection DuplicateHandle EnterCriticalSection FormatMessageW GetConsoleMode GetConsoleOutputCP GetCurrentDirectoryW GetCurrentProcess GetCurrentThread GetCurrentThreadId GetEnvironmentVariableW GetFileInformationByHandle GetFileInformationByHandleEx GetFullPathNameW GetLastError GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessHeap GetStdHandle GetSystemInfo HeapAlloc HeapFree HeapReAlloc InitOnceBeginInitialize InitOnceComplete InitializeCriticalSection LeaveCriticalSection MapViewOfFile Module32FirstW Module32NextW MultiByteToWideChar QueryPerformanceCounter QueryPerformanceFrequency RaiseException RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetFileInformationByHandle SetFileTime SetLastError SetThreadStackGuarantee SetUnhandledExceptionFilter Sleep TlsAlloc TlsFree TlsGetValue TlsSetValue UnmapViewOfFile VirtualProtect VirtualQuery WaitForSingleObject WriteConsoleW __C_specific_handler

mfplat

MFCreateMemoryBuffer MFShutdown MFStartup

msvcrt

__getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _cexit _commode _errno _fmode _fpreset _initterm _onexit abort calloc exit fprintf free fwrite ldexp malloc memcmp memcpy memmove memset signal strlen strncmp vfprintf

ntdll

NtWriteFile RtlNtStatusToDosError

ole32

CoCreateInstance CoInitializeEx CoUninitialize PropVariantClear

oleaut32

SysAllocString SysFreeString VariantInit

propsys

PSGetPropertyDescription

shell32

SHGetFolderPathW SHGetKnownFolderPath ShellExecuteW

shlwapi

PathCombineW PathFileExistsW

user32

GetDC GetDesktopWindow GetSystemMetrics MessageBoxW ReleaseDC

uxtheme

IsAppThemed IsThemeActive

version

GetFileVersionInfoSizeW GetFileVersionInfoW

winmm

timeGetTime

winspool.drv

EnumPrintersW

ws2_32

WSACleanup WSAStartup

Name

.text

Size

2.0MB

Virtual Size

2.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

272KB

Virtual Size

271KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

31KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

576B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

6KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

11KB

Virtual Size

11KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

051dc1df4ea14c71a25fea528090dd8cfd2c4e02030e6d2f91f6f2f9bad90ec3

api-ms-win-core-synch-l1-2-0

bcryptprimitives

advapi32

bcrypt

comctl32

comdlg32

dwmapi

gdi32

imm32

kernel32

mfplat

msvcrt

ntdll

ole32

oleaut32

propsys

shell32

shlwapi

user32

uxtheme

version

winmm

winspool.drv

ws2_32

generic