46d710e998906373da660d2f8408a7ef9bfa1663f43817adf6b99613a6a7525b

Sharing

Copy URL Twitter E-mail

General

Target
46d710e998906373da660d2f8408a7ef9bfa1663f43817adf6b99613a6a7525b
Size 359KB
Sample260727-qlb61stvcx
SHA256 46d710e998906373da660d2f8408a7ef9bfa1663f43817adf6b99613a6a7525b
MD5 9504cc5183fc8513fb6aa070eddf2011
SHA1 5000638a1dc099b05fa35f84b52ef3e633784560
SHA512 99b58d09a0d150906da4150c487f1155d023768553f37ab2772e66b3d815daa8c31007cadbafed83b60aef64e2de8cd5cc03a14386b9bedc356bac03ff1b2678
SSDEEP 6144:kjfEhvswNPuRbTFq0/CA55555555555555555555555555555553X:uEhvRj0VX
TLSH
T16274B0002D82847DD1ABD63B7C7B9A70B63B6D508BF869C733C479A92A3D1C1BE34645
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
46d710e998906373da660d2f8408a7ef9bfa1663f43817adf6b99613a6a7525b

File Explorer

46d710e998906373da660d2f8408a7ef9bfa1663f43817adf6b99613a6a7525b

.dll 359KB

46d710e998906373da660d2f8408a7ef9bfa1663f43817adf6b99613a6a7525b

IMPHASH 5cb12398d41df981ca20331639d8f794
SHA256 46d710e998906373da660d2f8408a7ef9bfa1663f43817adf6b99613a6a7525b
MD5 9504cc5183fc8513fb6aa070eddf2011
SHA1 5000638a1dc099b05fa35f84b52ef3e633784560
SHA512 99b58d09a0d150906da4150c487f1155d023768553f37ab2772e66b3d815daa8c31007cadbafed83b60aef64e2de8cd5cc03a14386b9bedc356bac03ff1b2678
SSDEEP 6144:kjfEhvswNPuRbTFq0/CA55555555555555555555555555555553X:uEhvRj0VX
TLSH
T16274B0002D82847DD1ABD63B7C7B9A70B63B6D508BF869C733C479A92A3D1C1BE34645
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

41399

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

kernel32

GetProcAddress LoadLibraryExW LoadResource SizeofResource FindResourceW GlobalUnlock GlobalLock lstrcmpiW MultiByteToWideChar DecodePointer RaiseException EncodePointer GetModuleHandleW SetThreadLocale SetEndOfFile GetConsoleOutputCP WriteFile FlushFileBuffers SetStdHandle CreateFileW GetStringTypeW GetProcessHeap GetModuleFileNameW GetModuleFileNameA FreeLibrary CreateProcessA DeleteCriticalSection InitializeCriticalSectionEx LeaveCriticalSection EnterCriticalSection GetLastError CloseHandle GetThreadLocale WideCharToMultiByte LCMapStringW VirtualProtect FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetCPInfo GetOEMCP GetACP IsValidCodePage FindNextFileW FindFirstFileExW WriteConsoleW FindClose IsDebuggerPresent OutputDebugStringW IsProcessorFeaturePresent SetUnhandledExceptionFilter GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead RtlUnwind InterlockedFlushSList SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree ReadFile UnhandledExceptionFilter GetCurrentProcess TerminateProcess ExitProcess GetModuleHandleExW HeapFree GetConsoleMode ReadConsoleW SetFilePointerEx GetStdHandle GetFileType HeapAlloc HeapSize HeapReAlloc

user32

CharNextW CreatePopupMenu DestroyMenu AppendMenuA InsertMenuItemA MessageBoxA LoadImageA LoadStringA

advapi32

RegSetValueExW RegQueryInfoKeyW RegOpenKeyExW RegEnumKeyExW RegDeleteValueW RegDeleteKeyW RegCreateKeyExW RegGetValueA RegOpenKeyExA RegOpenCurrentUser RegCloseKey

shell32

DragQueryFileW DragQueryFileA SHGetPathFromIDListA

ole32

CoCreateInstance ReleaseStgMedium CoTaskMemFree StringFromGUID2 CoTaskMemRealloc CoTaskMemAlloc

oleaut32

VarUI4FromStr SysFreeString UnRegisterTypeLi RegisterTypeLi SysAllocString LoadRegTypeLi LoadTypeLi SysStringLen

shlwapi

PathRemoveFileSpecA PathFileExistsA

Name

.text

Size

103KB

Virtual Size

102KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

35KB

Virtual Size

34KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.fptable

Size

512B

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

208KB

Virtual Size

208KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

7KB

Virtual Size

6KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

46d710e998906373da660d2f8408a7ef9bfa1663f43817adf6b99613a6a7525b

kernel32

user32

advapi32

shell32

ole32

oleaut32

shlwapi

generic