5b5920b7b0dcdfea17b6b19d47d7971aa73ad78f8c45354c3bd93cbe45955832

Sharing

Copy URL Twitter E-mail

General

Target
5b5920b7b0dcdfea17b6b19d47d7971aa73ad78f8c45354c3bd93cbe45955832
Size 191KB
Sample260728-rf848sar2v
SHA256 5b5920b7b0dcdfea17b6b19d47d7971aa73ad78f8c45354c3bd93cbe45955832
MD5 190446a8a1962a3b5335c30887b2559f
SHA1 1fdc78b696a2b7b2e9d7916bc4758012f5827262
SHA512 938fc6f6f8587135b797eb33d0aaed55de22a4599a6c1ab9dc5d27859332e9d1a5c3c2c60bd566f005b94b1aaf153c76020592eb2e691c2849a39c35b9e64fe9
SSDEEP 1536:GJFhrZC1WQ8oz6588ugoK4B+Rwd/NHhxHx5vcMBCJ0OG5LU:2hNEWQnzGoKMa8/NHhxHx50MBCJd
TLSH
T15114B85127AD58F1E1768BF905F7DF620F3D79530AE5874A4B24EA0C2C769C0AEE0392
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
5b5920b7b0dcdfea17b6b19d47d7971aa73ad78f8c45354c3bd93cbe45955832

File Explorer

5b5920b7b0dcdfea17b6b19d47d7971aa73ad78f8c45354c3bd93cbe45955832

.dll 191KB

5b5920b7b0dcdfea17b6b19d47d7971aa73ad78f8c45354c3bd93cbe45955832

IMPHASH d13a79914f68ff6623f9e3462bbc5a2f
SHA256 5b5920b7b0dcdfea17b6b19d47d7971aa73ad78f8c45354c3bd93cbe45955832
MD5 190446a8a1962a3b5335c30887b2559f
SHA1 1fdc78b696a2b7b2e9d7916bc4758012f5827262
SHA512 938fc6f6f8587135b797eb33d0aaed55de22a4599a6c1ab9dc5d27859332e9d1a5c3c2c60bd566f005b94b1aaf153c76020592eb2e691c2849a39c35b9e64fe9
SSDEEP 1536:GJFhrZC1WQ8oz6588ugoK4B+Rwd/NHhxHx5vcMBCJ0OG5LU:2hNEWQnzGoKMa8/NHhxHx50MBCJd
TLSH
T15114B85127AD58F1E1768BF905F7DF620F3D79530AE5874A4B24EA0C2C769C0AEE0392
MD5 SHA1 SHA512 SSDEEP TLSH

regsvr32 windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

21008

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

advapi32

CredEnumerateW CredFree CredWriteW

comctl32

InitCommonControls ord410 ord412 ord413

kernel32

DeleteCriticalSection DisableThreadLibraryCalls EnterCriticalSection EnumResourceNamesW FindResourceW GetEnvironmentVariableW GetModuleFileNameW GetModuleHandleW GetProcAddress GetTickCount HeapAlloc HeapFree HeapReAlloc IsBadStringPtrA IsBadStringPtrW LeaveCriticalSection LoadLibraryW LoadResource MultiByteToWideChar RaiseException SizeofResource lstrcmpW

ntdll

_vsnprintf

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vswprintf _strdup _wcsicmp free fwrite getenv memcmp memcpy memmove strchr strcmp strcspn strlen wcschr wcsrchr

user32

CheckDlgButton CreateWindowExW DestroyWindow DialogBoxParamW EndDialog GetDlgItem GetDlgItemTextW GetFocus GetKeyState GetParent GetWindowLongW GetWindowRect GetWindowTextLengthW GetWindowTextW IsDlgButtonChecked LoadStringW LockSetForegroundWindow SendMessageW SetDlgItemTextW SetFocus SetTimer SetWindowLongW SetWindowPos SetWindowTextW ShowWindow

Name

.text

Size

20KB

Virtual Size

19KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

168B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rodata

Size

4KB

Virtual Size

308B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

196B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

4KB

Virtual Size

835B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

104KB

Virtual Size

100KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

4KB

Virtual Size

940B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

5b5920b7b0dcdfea17b6b19d47d7971aa73ad78f8c45354c3bd93cbe45955832

advapi32

comctl32

kernel32

ntdll

ucrtbase

user32

generic