1d27f5cfc232e515e85de7c01c2500820c5ee48fab617a838c45c1ddc883c241

Sharing

Copy URL Twitter E-mail

General

Target
1d27f5cfc232e515e85de7c01c2500820c5ee48fab617a838c45c1ddc883c241
Size 1.6MB
Sample260729-cdbcvstycw
SHA256 1d27f5cfc232e515e85de7c01c2500820c5ee48fab617a838c45c1ddc883c241
MD5 bdde8e4a364c297ed255d2ffc0254131
SHA1 4e3008a55f20d33f4e1762e9a75cc487df66b8be
SHA512 9388ba442a6d20e07c857ca833f9f3ef8654a8876fbccfbad68458f15377a3cf0f00d335297e79099b9580b12d66c41052bb05f6debe009f04e4e784e7721c2a
SSDEEP 49152:Gt/KkoxwpgTNDYB8cfBODQKI1hiqYK9mIKgMtRs7:Vk2wQDYaWKI1hiq76X+
TLSH
T1B285AE17AB9501FDE0B7C1B9CE468802E772780A07719BDF57D096A22F676E04E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1d27f5cfc232e515e85de7c01c2500820c5ee48fab617a838c45c1ddc883c241

File Explorer

1d27f5cfc232e515e85de7c01c2500820c5ee48fab617a838c45c1ddc883c241

.exe 1.6MB

1d27f5cfc232e515e85de7c01c2500820c5ee48fab617a838c45c1ddc883c241

IMPHASH fce36c797b3b3054d8eae8567a00e621
SHA256 1d27f5cfc232e515e85de7c01c2500820c5ee48fab617a838c45c1ddc883c241
MD5 bdde8e4a364c297ed255d2ffc0254131
SHA1 4e3008a55f20d33f4e1762e9a75cc487df66b8be
SHA512 9388ba442a6d20e07c857ca833f9f3ef8654a8876fbccfbad68458f15377a3cf0f00d335297e79099b9580b12d66c41052bb05f6debe009f04e4e784e7721c2a
SSDEEP 49152:Gt/KkoxwpgTNDYB8cfBODQKI1hiqYK9mIKgMtRs7:Vk2wQDYaWKI1hiq76X+
TLSH
T1B285AE17AB9501FDE0B7C1B9CE468802E772780A07719BDF57D096A22F676E04E3E712
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

653380

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

WideCharToMultiByte MultiByteToWideChar UnmapViewOfFile CreateFileMappingW MapViewOfFile Sleep GetCurrentProcessId LoadLibraryW GetProcAddress GetModuleHandleA LoadLibraryA InitializeCriticalSectionEx DeleteCriticalSection GetModuleHandleW DecodePointer GetModuleFileNameW HeapAlloc HeapFree HeapReAlloc HeapSize GetProcessHeap GetTempPathW WaitNamedPipeW ReadFile WritePrivateProfileStringW GetCurrentProcess FindResourceW LoadResource SizeofResource LockResource LoadLibraryExW GetFileAttributesW FreeLibrary GetProcessTimes GetSystemTimeAsFileTime IsWow64Process SetLastError ResumeThread WaitForSingleObject GetFileSizeEx LocalFree CreateDirectoryW SetEndOfFile WriteConsoleW SetStdHandle FreeEnvironmentStringsW GetEnvironmentStringsW GetCommandLineW WriteFile CreateFileW GetLastError GetPrivateProfileStringW CloseHandle GetCommandLineA GetOEMCP GetACP IsValidCodePage EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW FlsFree FlsSetValue FlsGetValue FlsAlloc ReadConsoleW GetConsoleMode GetConsoleOutputCP FormatMessageA GetLocaleInfoEx GetStringTypeW ReleaseSRWLockExclusive AcquireSRWLockExclusive TryAcquireSRWLockExclusive GetCurrentThreadId FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW AreFileApisANSI GetFileInformationByHandleEx QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObjectEx GetExitCodeThread EnterCriticalSection LeaveCriticalSection EncodePointer CompareStringEx GetCPInfo LCMapStringEx WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetStartupInfoW InitializeSListHead OutputDebugStringW RaiseException RtlUnwindEx RtlPcToFileHeader InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW ExitProcess GetStdHandle GetFileType SetFilePointerEx FlushFileBuffers RtlUnwind

user32

MessageBoxA SetProcessDPIAware MessageBoxW

advapi32

SetEntriesInAclW ConvertStringSidToSidW GetNamedSecurityInfoW SetNamedSecurityInfoW

shell32

SHGetFolderPathW

ole32

CoInitializeEx CoUninitialize

oleaut32

SysFreeString SysAllocString VariantInit SafeArrayUnaccessData SafeArrayAccessData SafeArrayCreate

mscoree

CorBindToRuntime CLRCreateInstance

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

winmm

PlaySoundW

Sharing

General

Malware Config

Signatures

File Explorer

1d27f5cfc232e515e85de7c01c2500820c5ee48fab617a838c45c1ddc883c241

kernel32

user32

advapi32

shell32

ole32

oleaut32

mscoree

version

winmm

generic