0ac353587bc627ee00e607675d08fbfc84e02ff14a6edd5c889a7c354a9454b1

Sharing

Copy URL Twitter E-mail

General

Target
0ac353587bc627ee00e607675d08fbfc84e02ff14a6edd5c889a7c354a9454b1
Size 996KB
Sample260729-e3spjswxcv
SHA256 0ac353587bc627ee00e607675d08fbfc84e02ff14a6edd5c889a7c354a9454b1
MD5 8cb9c8a8b39f413a3797bb5eb3ab7670
SHA1 3229ba2c792d4b2cf6355948def1bf1398d8e07c
SHA512 7e5d76dcbf7394cfd46872b3959fbd33a6c8a795384bd40540c7ef535359a5be79dd8c26b2b094d290aab9ce17f11918cfe44b7cb6382c37c06d1a4d657b7148
SSDEEP 6144:9dS733juNgfnCN2Tba1inCTv3WBMJdS733juNgfnCwF1ML:9dQOJQALv3WBMJdQOcHML
TLSH
T11825F680B7E55452E47387385CBAE6B1173DBA9156798F0F9304AA0D0E337D32D92B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
0ac353587bc627ee00e607675d08fbfc84e02ff14a6edd5c889a7c354a9454b1

File Explorer

0ac353587bc627ee00e607675d08fbfc84e02ff14a6edd5c889a7c354a9454b1

.dll 996KB

0ac353587bc627ee00e607675d08fbfc84e02ff14a6edd5c889a7c354a9454b1

IMPHASH c865fe980789ce58e9035ea1e8178148
SHA256 0ac353587bc627ee00e607675d08fbfc84e02ff14a6edd5c889a7c354a9454b1
MD5 8cb9c8a8b39f413a3797bb5eb3ab7670
SHA1 3229ba2c792d4b2cf6355948def1bf1398d8e07c
SHA512 7e5d76dcbf7394cfd46872b3959fbd33a6c8a795384bd40540c7ef535359a5be79dd8c26b2b094d290aab9ce17f11918cfe44b7cb6382c37c06d1a4d657b7148
SSDEEP 6144:9dS733juNgfnCN2Tba1inCTv3WBMJdS733juNgfnCwF1ML:9dQOJQALv3WBMJdQOcHML
TLSH
T11825F680B7E55452E47387385CBAE6B1173DBA9156798F0F9304AA0D0E337D32D92B2B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

8656

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

advapi32

RegCloseKey RegCreateKeyExW RegCreateKeyW RegDeleteKeyW RegDeleteTreeW RegDeleteValueW RegEnumKeyExW RegEnumKeyW RegEnumValueW RegOpenKeyExW RegOpenKeyW RegQueryInfoKeyW RegQueryValueExW RegSetKeyValueW RegSetValueExW

kernel32

CloseHandle CopyFileW CreateDirectoryW CreateFileW DeleteCriticalSection DeleteFileW DisableThreadLibraryCalls EnterCriticalSection FreeLibrary GetComputerNameW GetDefaultCommConfigW GetModuleHandleW GetProcAddress GetSystemDirectoryW GetTickCount GetUserDefaultLangID GetVersion HeapAlloc HeapReAlloc InitializeCriticalSection IsBadStringPtrW LeaveCriticalSection LoadLibraryW RaiseException ReadFile SetDefaultCommConfigW SetFilePointerEx WideCharToMultiByte WriteFile lstrcmpW lstrcmpiW

ntdll

LdrGetDllHandle NtQueryVirtualMemory RtlFindExportedRoutineByName _vsnprintf

spoolss

EnumPortsW

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vswprintf _strdup _wcsdup _wcsicmp _wcsnicmp calloc free fwrite getenv isalpha malloc memcmp memcpy memmove strchr strcmp strcspn strlen wcscat wcschr wcscmp wcscpy wcslen wcsncmp wcsrchr wcstoul

user32

LoadStringW wsprintfW

Name

.text

Size

72KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

556B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

16KB

Virtual Size

15KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

200B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

68KB

Virtual Size

67KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/14

Size

4KB

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/29

Size

4KB

Virtual Size

36B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/41

Size

4KB

Virtual Size

20B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/55

Size

4KB

Virtual Size

88B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/67

Size

4KB

Virtual Size

56B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/80

Size

4KB

Virtual Size

152B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/91

Size

4KB

Virtual Size

138B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

0ac353587bc627ee00e607675d08fbfc84e02ff14a6edd5c889a7c354a9454b1

advapi32

kernel32

ntdll

spoolss

ucrtbase

user32

generic