9d912da194510bba0125eacbf69fab61a088cc6130761cc608ab52a14dfe3030

Sharing

Copy URL Twitter E-mail

General

Target
9d912da194510bba0125eacbf69fab61a088cc6130761cc608ab52a14dfe3030
Size 273KB
Sample260728-yvhddsbf29
SHA256 9d912da194510bba0125eacbf69fab61a088cc6130761cc608ab52a14dfe3030
MD5 052331ed6d60d0cfc2e52f485d558562
SHA1 c25ac05c6148bdfc67d46bf10e59550b84fa5361
SHA512 478e19e7624bd1f84313667465997769053447fb9e4cc204677f7eae79d30d83f5231cbf2fb7c2eaa548bca4b68b9a2294f4e2c21b44b888bcad1f2eb677c809
SSDEEP 6144:LLGrZfqoCclXhYWJQRqm4SJAOBUb7V6b1:LLGrEoZlXhXDmvGp81
TLSH
T1BB548D21B5E1C876D573193608F9A7B1567DBD304E3A863F63D41B2E5F30882AA31B63
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
9d912da194510bba0125eacbf69fab61a088cc6130761cc608ab52a14dfe3030

File Explorer

9d912da194510bba0125eacbf69fab61a088cc6130761cc608ab52a14dfe3030

.exe 273KB

9d912da194510bba0125eacbf69fab61a088cc6130761cc608ab52a14dfe3030

IMPHASH f34771a159d8a1fbc211930f0b552d88
SHA256 9d912da194510bba0125eacbf69fab61a088cc6130761cc608ab52a14dfe3030
MD5 052331ed6d60d0cfc2e52f485d558562
SHA1 c25ac05c6148bdfc67d46bf10e59550b84fa5361
SHA512 478e19e7624bd1f84313667465997769053447fb9e4cc204677f7eae79d30d83f5231cbf2fb7c2eaa548bca4b68b9a2294f4e2c21b44b888bcad1f2eb677c809
SSDEEP 6144:LLGrZfqoCclXhYWJQRqm4SJAOBUb7V6b1:LLGrEoZlXhXDmvGp81
TLSH
T1BB548D21B5E1C876D573193608F9A7B1567DBD304E3A863F63D41B2E5F30882AA31B63
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

70307

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

shell32

Shell_NotifyIconW ShellExecuteExW SHFileOperationW

comctl32

InitCommonControlsEx

shlwapi

PathRemoveFileSpecW PathFileExistsW

kernel32

GetLocalTime GetPrivateProfileIntW GetPrivateProfileStringW WritePrivateProfileStringW GetLastError GetStringTypeW EnterCriticalSection LeaveCriticalSection DeleteCriticalSection EncodePointer DecodePointer SetLastError InitializeCriticalSectionAndSpinCount CreateEventW TlsAlloc TlsGetValue TlsSetValue TlsFree GetSystemTimeAsFileTime GetModuleHandleW GetProcAddress LCMapStringW GetLocaleInfoW GetCPInfo CloseHandle SetEvent ResetEvent WaitForSingleObjectEx UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW QueryPerformanceCounter GetCurrentProcessId WideCharToMultiByte InitializeSListHead GetConsoleMode GetConsoleCP HeapSize SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW GetCommandLineA GetOEMCP IsValidCodePage FindNextFileW FindFirstFileExW FindClose GetProcessHeap EnumSystemLocalesW GetUserDefaultLCID IsValidLocale MultiByteToWideChar GetFileType GetACP WriteFile GetStdHandle GetModuleHandleExW ExitProcess HeapReAlloc HeapFree HeapAlloc LoadLibraryExW FreeLibrary RtlUnwind RaiseException GetComputerNameW GetComputerNameExW GetFileAttributesW GetModuleFileNameW GetDiskFreeSpaceExW GetCurrentDirectoryW SetCurrentDirectoryW SetFilePointerEx FlushFileBuffers WriteConsoleW GetCurrentThreadId CreateFileW

user32

LoadCursorW GetClassNameW SetWindowLongW GetWindowLongW PtInRect FillRect MapWindowPoints ClientToScreen GetCursorPos SetCursor AdjustWindowRect GetWindowRect GetClientRect GetWindowTextLengthW GetWindowTextW SetWindowTextW InvalidateRect EndPaint BeginPaint GetDC SetForegroundWindow LoadIconW DrawTextW TrackPopupMenu AppendMenuW DestroyMenu CreatePopupMenu GetSystemMetrics EnableWindow GetDlgCtrlID ShowWindow DestroyWindow CreateWindowExW RegisterClassExW CallWindowProcW PostQuitMessage DefWindowProcW PostMessageW SendMessageW TrackMouseEvent MessageBoxW DispatchMessageW TranslateMessage GetMessageW DestroyIcon UpdateWindow ReleaseDC

gdi32

GetStockObject DeleteObject CreateSolidBrush CreateFontW SetBkColor SetBkMode SelectObject GetObjectW SetTextColor

advapi32

RegOpenKeyExW RegCreateKeyExW RegCloseKey RegSetValueExW RegQueryValueExW

Name

.text

Size

164KB

Virtual Size

164KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

71KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

7KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.gfids

Size

512B

Virtual Size

412B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

21KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

10KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

9d912da194510bba0125eacbf69fab61a088cc6130761cc608ab52a14dfe3030

shell32

comctl32

shlwapi

kernel32

user32

gdi32

advapi32

generic