3b4c7d81913869d57ea2b4227807635cecd5c34afa168a868b2e2d27b666f477

Sharing

Copy URL Twitter E-mail

General

Target
3b4c7d81913869d57ea2b4227807635cecd5c34afa168a868b2e2d27b666f477
Size 1.3MB
Sample260729-e2g7esea47
SHA256 3b4c7d81913869d57ea2b4227807635cecd5c34afa168a868b2e2d27b666f477
MD5 fa37e1fa5715d47ca065e36b75907d4e
SHA1 4089ef23b61ece6370de1161b99b46adc989dc8b
SHA512 cdbd61b432c38b6a993edfdf82d84ea283ee63d45c1cc9b4156c005cc7665c2139931ee793eeb11bb0696f7d906ac196bcc64038842edd95a421a5371a5857d3
SSDEEP 12288:hYSocePlfVOG1nUq/ZxNq2mhrEycSK3kKNQ8JcbQAcngzb9UtYSE:hYTPR1nUq/ZKhrQSK3kwQGdgzbIYB
TLSH
T13355C58076ED5897F6A3833918F2D3213679BC526722CF0F9200992C4D767C3BEA5B56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3b4c7d81913869d57ea2b4227807635cecd5c34afa168a868b2e2d27b666f477

File Explorer

3b4c7d81913869d57ea2b4227807635cecd5c34afa168a868b2e2d27b666f477

.exe 1.3MB

3b4c7d81913869d57ea2b4227807635cecd5c34afa168a868b2e2d27b666f477

IMPHASH 86a1841927eec4c35108861b059160e5
SHA256 3b4c7d81913869d57ea2b4227807635cecd5c34afa168a868b2e2d27b666f477
MD5 fa37e1fa5715d47ca065e36b75907d4e
SHA1 4089ef23b61ece6370de1161b99b46adc989dc8b
SHA512 cdbd61b432c38b6a993edfdf82d84ea283ee63d45c1cc9b4156c005cc7665c2139931ee793eeb11bb0696f7d906ac196bcc64038842edd95a421a5371a5857d3
SSDEEP 12288:hYSocePlfVOG1nUq/ZxNq2mhrEycSK3kKNQ8JcbQAcngzb9UtYSE:hYTPR1nUq/ZKhrQSK3kwQGdgzbIYB
TLSH
T13355C58076ED5897F6A3833918F2D3213679BC526722CF0F9200992C4D767C3BEA5B56
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

53088

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

advapi32

RegCloseKey RegCreateKeyW RegEnumKeyW RegEnumValueW RegGetValueW RegOpenKeyW RegQueryValueW RegSetValueExW

comctl32

InitCommonControls CreateStatusWindowW CreateToolbarEx

comdlg32

GetOpenFileNameW GetSaveFileNameW

kernel32

CloseHandle CreateFileW CreateProcessW FormatMessageW GetCommandLineA GetCurrentDirectoryW GetModuleHandleA GetModuleHandleW GetProcAddress GetStartupInfoA GetTickCount GetWindowsDirectoryW GlobalAlloc GlobalLock GlobalUnlock HeapAlloc HeapReAlloc LocalFree MultiByteToWideChar WideCharToMultiByte WriteFile lstrcmpW

ntdll

_vsnprintf

ole32

CLSIDFromString CoCreateInstance CoCreateInstanceEx OleInitialize OleUninitialize StringFromGUID2

oleaut32

SysFreeString SysStringLen VariantInit VariantChangeType LoadTypeLib

shell32

ShellAboutW

ucrtbase

__acrt_iob_func __p___argc __p___argv __stdio_common_vsprintf _configure_narrow_argv _get_initial_narrow_environment _initialize_narrow_environment _set_app_type _strdup calloc exit free fwrite getenv malloc memcmp memcpy memmove memset realloc strchr strcmp strcspn strlen wcscmp wcsncmp

user32

CheckDlgButton CheckMenuItem CloseClipboard CreateWindowExW DefWindowProcW DestroyWindow DialogBoxParamW DispatchMessageW EmptyClipboard EnableMenuItem EndDialog GetCapture GetClientRect GetCursorPos GetDC GetDlgItem GetMenu GetMessageW GetWindowTextLengthW GetWindowTextW InvertRect IsDlgButtonChecked IsWindowVisible LoadAcceleratorsW LoadCursorW LoadStringW MessageBoxW MoveWindow OpenClipboard PostQuitMessage RegisterClassW ReleaseCapture ReleaseDC ScreenToClient SendMessageW SetCapture SetClipboardData SetCursor SetFocus SetWindowTextW ShowWindow TranslateAcceleratorW TranslateMessage UpdateWindow wsprintfW

Name

.text

Size

52KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

384B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

68KB

Virtual Size

65KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

4KB

Virtual Size

876B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

4KB

Virtual Size

1016B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

272KB

Virtual Size

268KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

3b4c7d81913869d57ea2b4227807635cecd5c34afa168a868b2e2d27b666f477

advapi32

comctl32

comdlg32

kernel32

ntdll

ole32

oleaut32

shell32

ucrtbase

user32

generic