8a47cdcbb02293943dba247ef22ec28ad981f5782a15352135f8d11deee54424

General

Target
8a47cdcbb02293943dba247ef22ec28ad981f5782a15352135f8d11deee54424
Size 156KB
Sample260729-bj98psdc76
SHA256 8a47cdcbb02293943dba247ef22ec28ad981f5782a15352135f8d11deee54424
MD5 ce3a367e9d928b6e02705d77a43eae47
SHA1 9bade44d29c4cecd96f1752e23639845beafdd75
SHA512 9c7ec23d8fb5ad8b1b702f1f9b1407c37337d09972f05e56c981349634dd58a9d13ea637bc6825cc6e562948ba79b29ce2427f2c5379174ebcee7ab34c056ca7
SSDEEP 1536:1KWqhrWpSYKonM3v1/aQxx4oJa243tN3C760Y2enc1vWWGcQAwmKn2jLcW0:U3rWS7onfsx6NdZC7g2encYmKngLcx
TLSH
T116F3A641BBF65021F5B72BB81EBC48B5D36EBEA19F3488DF0220928906775C198747B7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
8a47cdcbb02293943dba247ef22ec28ad981f5782a15352135f8d11deee54424

File Explorer

8a47cdcbb02293943dba247ef22ec28ad981f5782a15352135f8d11deee54424

.dll 156KB

8a47cdcbb02293943dba247ef22ec28ad981f5782a15352135f8d11deee54424

IMPHASH df94e7c8995a1db2b713368622cf2c1f
SHA256 8a47cdcbb02293943dba247ef22ec28ad981f5782a15352135f8d11deee54424
MD5 ce3a367e9d928b6e02705d77a43eae47
SHA1 9bade44d29c4cecd96f1752e23639845beafdd75
SHA512 9c7ec23d8fb5ad8b1b702f1f9b1407c37337d09972f05e56c981349634dd58a9d13ea637bc6825cc6e562948ba79b29ce2427f2c5379174ebcee7ab34c056ca7
SSDEEP 1536:1KWqhrWpSYKonM3v1/aQxx4oJa243tN3C760Y2enc1vWWGcQAwmKn2jLcW0:U3rWS7onfsx6NdZC7g2encYmKngLcx
TLSH
T116F3A641BBF65021F5B72BB81EBC48B5D36EBEA19F3488DF0220928906775C198747B7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

50912

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

spoolss

EnumPortsW

user32

LoadStringW wsprintfW

advapi32

RegCloseKey RegCreateKeyExW RegCreateKeyW RegDeleteKeyW RegDeleteTreeW RegDeleteValueW RegEnumKeyExW RegEnumKeyW RegEnumValueW RegOpenKeyExW RegOpenKeyW RegQueryInfoKeyW RegQueryValueExW RegSetKeyValueW RegSetValueExW

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vswprintf _strdup _wcsdup _wcsicmp _wcsnicmp calloc free fwrite getenv isalpha malloc memcpy memmove strchr strcmp strcpy strcspn strlen wcscat wcschr wcscmp wcscpy wcslen wcsncmp wcsrchr wcstoul

kernel32

CloseHandle CopyFileW CreateDirectoryW CreateFileW DeleteCriticalSection DeleteFileW DisableThreadLibraryCalls EnterCriticalSection FreeLibrary GetComputerNameW GetDefaultCommConfigW GetModuleHandleW GetProcAddress GetSystemDirectoryW GetTickCount GetUserDefaultLangID GetVersion HeapAlloc HeapReAlloc InitializeCriticalSection IsBadStringPtrW LeaveCriticalSection LoadLibraryW RaiseException ReadFile SetDefaultCommConfigW SetFilePointerEx WideCharToMultiByte WriteFile lstrcmpW lstrcmpiW

ntdll

LdrGetDllHandle NtQueryVirtualMemory RtlFindExportedRoutineByName _chkstk _vsnprintf

Sharing

General

Malware Config

Signatures

File Explorer

8a47cdcbb02293943dba247ef22ec28ad981f5782a15352135f8d11deee54424

spoolss

user32

advapi32

ucrtbase

kernel32

ntdll

generic