40413fe739178e64ba546b3ad910c3c1a194ae6d86981aa9a4227bcfa6f01c91

Sharing

Copy URL Twitter E-mail

General

Target
40413fe739178e64ba546b3ad910c3c1a194ae6d86981aa9a4227bcfa6f01c91
Size 766KB
Sample260729-e234wswwgz
SHA256 40413fe739178e64ba546b3ad910c3c1a194ae6d86981aa9a4227bcfa6f01c91
MD5 b9a3ce6a1066b1597bd16a76b3d11162
SHA1 1e1ce13d1cf97a08fbe011418848f19ccb97bb03
SHA512 59a8e529d1adb1b50fd33dc67ef81e5bb43e15905e8d486e086fe34bf71da61c36316368d3d24b22bc4da573c4bd2dd2ffbdd17d99c287db02068ecd2564e33b
SSDEEP 6144:KWXnfcbMPi1/H1MlOBP/SVD/xz1d0mcV1uKUcVA9yvYwqqIV27PQ4c:K+UwIHOlO5SVD/xz1HU1FrA91q2iQ5
TLSH
T1D6F4C721B6E94595F5B31F741DBE93BA1B36BE20D934CE0ED704E94D1A32EA0DA14323
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
40413fe739178e64ba546b3ad910c3c1a194ae6d86981aa9a4227bcfa6f01c91

File Explorer

40413fe739178e64ba546b3ad910c3c1a194ae6d86981aa9a4227bcfa6f01c91

.dll 766KB

40413fe739178e64ba546b3ad910c3c1a194ae6d86981aa9a4227bcfa6f01c91

IMPHASH d619e0c4a6ca9ec02a1d47ea49a48a5b
SHA256 40413fe739178e64ba546b3ad910c3c1a194ae6d86981aa9a4227bcfa6f01c91
MD5 b9a3ce6a1066b1597bd16a76b3d11162
SHA1 1e1ce13d1cf97a08fbe011418848f19ccb97bb03
SHA512 59a8e529d1adb1b50fd33dc67ef81e5bb43e15905e8d486e086fe34bf71da61c36316368d3d24b22bc4da573c4bd2dd2ffbdd17d99c287db02068ecd2564e33b
SSDEEP 6144:KWXnfcbMPi1/H1MlOBP/SVD/xz1d0mcV1uKUcVA9yvYwqqIV27PQ4c:K+UwIHOlO5SVD/xz1HU1FrA91q2iQ5
TLSH
T1D6F4C721B6E94595F5B31F741DBE93BA1B36BE20D934CE0ED704E94D1A32EA0DA14323
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5120

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

advapi32

RegEnumKeyW RegOpenKeyExW RegQueryValueW

comdlg32

GetOpenFileNameA

kernel32

DisableThreadLibraryCalls FindResourceA FindResourceW FormatMessageW FreeLibrary GetModuleHandleW GetProcAddress GetTickCount GlobalFree GlobalLock GlobalUnlock HeapAlloc HeapFree HeapReAlloc IsBadStringPtrA IsBadStringPtrW LoadLibraryA LoadResource LockResource MultiByteToWideChar WideCharToMultiByte

ntdll

_vsnprintf

ole32

CLSIDFromString CoTaskMemFree GetClassFile OleCreate OleCreateFromFile OleGetClipboard OleRegGetUserType

ucrtbase

__acrt_iob_func __stdio_common_vsprintf _strdup _wcsdup free fwrite getenv malloc memcmp memcpy memmove memset strcat strchr strcmp strcspn strlen wcslen wcsstr

user32

CheckDlgButton CheckRadioButton CreatePopupMenu DialogBoxIndirectParamA DialogBoxIndirectParamW EnableWindow EndDialog GetDlgItem GetForegroundWindow GetPropW InsertMenuW LoadStringA LoadStringW MessageBoxW PostMessageW RegisterClipboardFormatW RegisterWindowMessageW RemoveMenu RemovePropW SendMessageA SendMessageW SetDlgItemTextW SetFocus SetPropW SetWindowTextA SetWindowTextW ShowWindow wsprintfW

Name

.text

Size

24KB

Virtual Size

21KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

112B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.eh_fram

Size

4KB

Virtual Size

612B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

224B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

4KB

Virtual Size

704B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

144KB

Virtual Size

143KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

40413fe739178e64ba546b3ad910c3c1a194ae6d86981aa9a4227bcfa6f01c91

advapi32

comdlg32

kernel32

ntdll

ole32

ucrtbase

user32

generic