f6f0b83b580d57d864b7bd1b8bdf9a1b93dab3b3

General

Target
f6f0b83b580d57d864b7bd1b8bdf9a1b93dab3b3
Size 380KB
Sample260728-kenzcasejb
SHA256 c7b8b60ba2e6d8488060f3a49ce20e15098341f4283e9f080c84b68504ee22ce
MD5 819318a78ee28672ff8f21e9b3ae6761
SHA1 f6f0b83b580d57d864b7bd1b8bdf9a1b93dab3b3
SHA512 6e66295c43a7f63c21b9a3ae08f40f5f02f532b854f4c20242e473de839a4007fc4bc49d7e6dffde4ce9d1ed5b268795bad069c5fa2f60430369223848815f32
SSDEEP 3072:Xy6uFMXfcH8nhBG68jzw8F2sArNDVqNsXgR8oefRpsy9BRQh:i1w4eea60I
TLSH
T1EC843112B1474723EFA21335BC2CF6700B64BDBC6B56BB7EA1A9751E37703804A2B561
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
f6f0b83b580d57d864b7bd1b8bdf9a1b93dab3b3

File Explorer

f6f0b83b580d57d864b7bd1b8bdf9a1b93dab3b3

.exe 380KB

f6f0b83b580d57d864b7bd1b8bdf9a1b93dab3b3

IMPHASH 7078d9931b4b7b076fcca1da93f7c004
SHA256 c7b8b60ba2e6d8488060f3a49ce20e15098341f4283e9f080c84b68504ee22ce
MD5 819318a78ee28672ff8f21e9b3ae6761
SHA1 f6f0b83b580d57d864b7bd1b8bdf9a1b93dab3b3
SHA512 6e66295c43a7f63c21b9a3ae08f40f5f02f532b854f4c20242e473de839a4007fc4bc49d7e6dffde4ce9d1ed5b268795bad069c5fa2f60430369223848815f32
SSDEEP 3072:Xy6uFMXfcH8nhBG68jzw8F2sArNDVqNsXgR8oefRpsy9BRQh:i1w4eea60I
TLSH
T1EC843112B1474723EFA21335BC2CF6700B64BDBC6B56BB7EA1A9751E37703804A2B561
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

7248

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

F:\NBDTool\trunk\Lenovo\BootOrder\OS\Release\BT.pdb

winio32

WinIoTriggerSmi WinIoLinearToPhysical SetPortVal GetPortVal ShutdownWinIo InitializeWinIo

kernel32

RaiseException DecodePointer SetFilePointerEx WriteConsoleW GetStdHandle SetConsoleTextAttribute UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead IsDebuggerPresent GetStartupInfoW GetModuleHandleW GetLastError GetModuleFileNameW InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree FreeLibrary GetProcAddress LoadLibraryExW RtlUnwind SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection ExitProcess GetModuleHandleExW WriteFile GetModuleFileNameA MultiByteToWideChar WideCharToMultiByte GetCommandLineA GetCommandLineW GetACP GetConsoleMode HeapFree HeapAlloc CompareStringW LCMapStringW GetFileType CloseHandle WaitForSingleObject GetExitCodeProcess CreateProcessA GetFileAttributesExW FindClose FindFirstFileExA FindNextFileA IsValidCodePage GetOEMCP GetCPInfo GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableA SetStdHandle GetStringTypeW GetProcessHeap CreateFileW FlushFileBuffers GetConsoleCP HeapSize HeapReAlloc

advapi32

SystemFunction036

Sharing

General

Malware Config

Signatures

File Explorer

f6f0b83b580d57d864b7bd1b8bdf9a1b93dab3b3

winio32

kernel32

advapi32

generic