7b3dec2ff721772c4be2f12ea7453a20a350842631230fd0abaf808eb58f633e

Sharing

Copy URL Twitter E-mail

General

Target
7b3dec2ff721772c4be2f12ea7453a20a350842631230fd0abaf808eb58f633e
Size 1.7MB
Sample260729-cd8ncstydw
SHA256 7b3dec2ff721772c4be2f12ea7453a20a350842631230fd0abaf808eb58f633e
MD5 f61ba45c105b099007e9f3300c03e4a6
SHA1 2d1b67f551c2a559ebf03a7eb51635c627f378e5
SHA512 01dad49ef867dca47441c15d06c611f3a130878510b4e4f58bdb5e3e5a0ca7515f77c9857a8874159ba5a498896b65c33ff446ad330c42a4b9e012b3f334385c
SSDEEP 49152:n89aq41nnc3ZB3IvxRUNmUhmUqrUzz7Ql8Rs:8LUA3q+Z
TLSH
T1EA85AD26ABD401FDE0BBC1B9C9568842E772780A07709BDF17D456722F676E44E3E322
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7b3dec2ff721772c4be2f12ea7453a20a350842631230fd0abaf808eb58f633e

File Explorer

7b3dec2ff721772c4be2f12ea7453a20a350842631230fd0abaf808eb58f633e

.exe 1.7MB

7b3dec2ff721772c4be2f12ea7453a20a350842631230fd0abaf808eb58f633e

IMPHASH f12be9195da949caa8dda2b60370698e
SHA256 7b3dec2ff721772c4be2f12ea7453a20a350842631230fd0abaf808eb58f633e
MD5 f61ba45c105b099007e9f3300c03e4a6
SHA1 2d1b67f551c2a559ebf03a7eb51635c627f378e5
SHA512 01dad49ef867dca47441c15d06c611f3a130878510b4e4f58bdb5e3e5a0ca7515f77c9857a8874159ba5a498896b65c33ff446ad330c42a4b9e012b3f334385c
SSDEEP 49152:n89aq41nnc3ZB3IvxRUNmUhmUqrUzz7Ql8Rs:8LUA3q+Z
TLSH
T1EA85AD26ABD401FDE0BBC1B9C9568842E772780A07709BDF17D456722F676E44E3E322
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

653636

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

WideCharToMultiByte MultiByteToWideChar UnmapViewOfFile CreateFileMappingW MapViewOfFile Sleep GetCurrentProcessId LoadLibraryW GetProcAddress GetModuleHandleA LoadLibraryA InitializeCriticalSectionEx DeleteCriticalSection GetModuleHandleW DecodePointer GetModuleFileNameW HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap GetTempPathW WaitNamedPipeW ReadFile WritePrivateProfileStringW GetCurrentProcess FindResourceW LoadResource SizeofResource LockResource LoadLibraryExW GetFileAttributesW FreeLibrary GetProcessTimes GetSystemTimeAsFileTime IsWow64Process SetLastError GetFileSizeEx ResumeThread WaitForSingleObject LocalFree CreateDirectoryW SetEndOfFile WriteConsoleW SetStdHandle SetEnvironmentVariableW FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW WriteFile CreateFileW GetLastError GetPrivateProfileStringW CloseHandle GetCommandLineA GetOEMCP GetACP IsValidCodePage GetTimeZoneInformation EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW FlsFree FlsSetValue FlsGetValue FlsAlloc ReadConsoleW GetConsoleMode FormatMessageA GetLocaleInfoEx GetStringTypeW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW AreFileApisANSI GetFileInformationByHandleEx QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObjectEx GetExitCodeThread EnterCriticalSection LeaveCriticalSection EncodePointer CompareStringEx GetCPInfo LCMapStringEx WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead OutputDebugStringW RaiseException RtlUnwindEx RtlPcToFileHeader InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetStdHandle GetFileType SetFilePointerEx FlushFileBuffers GetConsoleOutputCP RtlUnwind

user32

MessageBoxW SetProcessDPIAware MessageBoxA

advapi32

SetEntriesInAclW ConvertStringSidToSidW GetNamedSecurityInfoW SetNamedSecurityInfoW

shell32

SHGetFolderPathW

ole32

CoInitializeEx CoUninitialize

oleaut32

SysFreeString SysAllocString VariantInit SafeArrayUnaccessData SafeArrayAccessData SafeArrayCreate

mscoree

CLRCreateInstance

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

winmm

PlaySoundW

Sharing

General

Malware Config

Signatures

File Explorer

7b3dec2ff721772c4be2f12ea7453a20a350842631230fd0abaf808eb58f633e

kernel32

user32

advapi32

shell32

ole32

oleaut32

mscoree

version

winmm

generic