a47b9278fcbe694c0a00b5817cfc18f78d608e23965586b42c86e852a2f511fe

Sharing

Copy URL Twitter E-mail

General

Target
a47b9278fcbe694c0a00b5817cfc18f78d608e23965586b42c86e852a2f511fe
Size 644KB
Sample260729-e8h3asea73
SHA256 a47b9278fcbe694c0a00b5817cfc18f78d608e23965586b42c86e852a2f511fe
MD5 8b2bea742aeb7c676cd5d90dbc4c091f
SHA1 8a62318bbea17aaafad504763b77c157472c778b
SHA512 9a65c9b88cf6b7e7c55d80b445175e03376db67f6f4a918913b01fac7a4ea94d95391ddfff94c4a67fe5fcefd56f228aaf748833c4adc056aa71866c5c4daae8
SSDEEP 3072:KokF22ijCf+AllmJOMK3/olz+hsi/qdcsAghV0ezVRxaz0bNIESdtBwj6ftHB9KE:JkF2GMiixBVebH1N49j+
TLSH
T1B6E4959033E45893F536833848F6D2313B39BB815766CB1BD500A92D1E37BC3AE99B56
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
a47b9278fcbe694c0a00b5817cfc18f78d608e23965586b42c86e852a2f511fe

File Explorer

a47b9278fcbe694c0a00b5817cfc18f78d608e23965586b42c86e852a2f511fe

.dll 644KB

a47b9278fcbe694c0a00b5817cfc18f78d608e23965586b42c86e852a2f511fe

IMPHASH 204874338c62b6d9578c1ef8571913ed
SHA256 a47b9278fcbe694c0a00b5817cfc18f78d608e23965586b42c86e852a2f511fe
MD5 8b2bea742aeb7c676cd5d90dbc4c091f
SHA1 8a62318bbea17aaafad504763b77c157472c778b
SHA512 9a65c9b88cf6b7e7c55d80b445175e03376db67f6f4a918913b01fac7a4ea94d95391ddfff94c4a67fe5fcefd56f228aaf748833c4adc056aa71866c5c4daae8
SSDEEP 3072:KokF22ijCf+AllmJOMK3/olz+hsi/qdcsAghV0ezVRxaz0bNIESdtBwj6ftHB9KE:JkF2GMiixBVebH1N49j+
TLSH
T1B6E4959033E45893F536833848F6D2313B39BB815766CB1BD500A92D1E37BC3AE99B56
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

10176

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED IMAGE_FILE_DLL

PDB paths

advapi32

RegCloseKey RegEnumKeyExW RegEnumKeyW RegEnumValueW RegOpenKeyExW RegOpenKeyW RegQueryValueW

comctl32

PropertySheetW

kernel32

DisableThreadLibraryCalls EnumResourceNamesW FindResourceW GetEnvironmentVariableW GetModuleFileNameW GetModuleHandleW GetProcAddress GetTickCount GetUserDefaultLCID HeapAlloc HeapFree HeapReAlloc IsBadStringPtrW LoadLibraryW LoadResource MultiByteToWideChar SizeofResource WideCharToMultiByte

ntdll

_vsnprintf

ole32

CLSIDFromProgID CLSIDFromString CoCreateInstance CoTaskMemAlloc CoTaskMemFree ProgIDFromCLSID StringFromGUID2

oleaut32

SysAllocString SysAllocStringLen SysFreeString SysStringLen VariantInit VariantClear VariantCopy VariantChangeType SafeArrayCreate SafeArrayDestroy SafeArrayGetUBound SafeArrayAccessData SafeArrayUnaccessData SafeArrayPutElement VarI2FromUI1 VarI2FromI4 VarI2FromR4 VarI2FromR8 VarI2FromCy VarI2FromDate VarI2FromStr VarI2FromBool VarI4FromUI1 VarI4FromI2 VarI4FromR4 VarI4FromR8 VarI4FromCy VarI4FromDate VarI4FromStr VarI4FromBool VarR4FromUI1 VarR4FromI2 VarR4FromI4 VarR4FromR8 VarR4FromCy VarR4FromDate VarR4FromStr VarR4FromBool VarR8FromUI1 VarR8FromI2 VarR8FromI4 VarR8FromR4 VarR8FromCy VarR8FromDate VarR8FromStr VarR8FromBool VarDateFromUI1 VarDateFromI2 VarDateFromI4 VarDateFromR4 VarDateFromR8 VarDateFromCy VarDateFromStr VarDateFromBool VarCyFromUI1 VarCyFromI2 VarCyFromI4 VarCyFromR4 VarCyFromR8 VarCyFromDate VarCyFromStr VarCyFromBool VarBstrFromUI1 VarBstrFromI2 VarBstrFromI4 VarBstrFromR4 VarBstrFromR8 VarBstrFromCy VarBstrFromDate VarBstrFromBool VarBoolFromUI1 VarBoolFromI2 VarBoolFromI4 VarBoolFromR4 VarBoolFromR8 VarBoolFromDate VarBoolFromCy VarBoolFromStr VarUI1FromI2 VarUI1FromI4 VarUI1FromR4 VarUI1FromR8 VarUI1FromCy VarUI1FromDate VarUI1FromStr VarUI1FromBool SystemTimeToVariantTime VariantTimeToSystemTime VarI2FromI1 VarI2FromUI2 VarI2FromUI4 VarI2FromDec VarI4FromI1 VarI4FromUI2 VarI4FromUI4 VarI4FromDec VarR4FromI1 VarR4FromUI2 VarR4FromUI4 VarR4FromDec VarR8FromI1 VarR8FromUI2 VarR8FromUI4 VarR8FromDec VarDateFromI1 VarDateFromUI2 VarDateFromUI4 VarDateFromDec VarCyFromI1 VarCyFromUI2 VarCyFromUI4 VarCyFromDec VarBstrFromI1 VarBstrFromUI2 VarBstrFromUI4 VarBstrFromDec VarBoolFromI1 VarBoolFromUI2 VarBoolFromUI4 VarBoolFromDec VarUI1FromI1 VarUI1FromUI2 VarUI1FromUI4 VarUI1FromDec VarI1FromUI1 VarI1FromI2 VarI1FromI4 VarI1FromR4 VarI1FromR8 VarI1FromDate VarI1FromCy VarI1FromStr VarI1FromBool VarI1FromUI2 VarI1FromUI4 VarI1FromDec VarUI2FromUI1 VarUI2FromI2 VarUI2FromI4 VarUI2FromR4 VarUI2FromR8 VarUI2FromDate VarUI2FromCy VarUI2FromStr VarUI2FromBool VarUI2FromI1 VarUI2FromUI4 VarUI2FromDec VarUI4FromUI1 VarUI4FromI2 VarUI4FromI4 VarUI4FromR4 VarUI4FromR8 VarUI4FromDate VarUI4FromCy VarUI4FromStr VarUI4FromBool VarUI4FromI1 VarUI4FromUI2 VarUI4FromDec VarI8FromStr VarI2FromI8 VarI2FromUI8 VarI4FromI8 VarI4FromUI8 VarR4FromI8 VarR4FromUI8 VarR8FromI8 VarR8FromUI8 VarDateFromI8 VarDateFromUI8 VarCyFromI8 VarCyFromUI8 VarBstrFromI8 VarBstrFromUI8 VarBoolFromI8 VarBoolFromUI8 VarUI1FromI8 VarUI1FromUI8 VarDecFromI8 VarI1FromI8 VarI1FromUI8 VarUI2FromI8 VarUI2FromUI8 VarUI4FromI8 VarUI4FromUI8 VarUI8FromI8 VarUI8FromUI1 VarUI8FromI2 VarUI8FromR4 VarUI8FromR8 VarUI8FromCy VarUI8FromDate VarUI8FromStr VarUI8FromBool VarUI8FromI1 VarUI8FromUI2 VarUI8FromUI4 VarUI8FromDec

ucrtbase

__acrt_iob_func __stdio_common_vsprintf __stdio_common_vswprintf __stdio_common_vswscanf _strdup _wcsdup _wcsicmp bsearch calloc free fwrite getenv iswspace malloc memcmp memcpy memmove memset realloc strchr strcmp strcspn strlen wcscat wcschr wcscpy wcsstr

user32

CharLowerW EnableWindow GetDlgItem GetParent GetWindowRect LoadStringW MessageBoxA MessageBoxW SendMessageA SendMessageW SetWindowLongPtrW wsprintfW

Name

.text

Size

68KB

Virtual Size

64KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

272B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

80KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

4KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

368B

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

4KB

Virtual Size

172B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

12KB

Virtual Size

10KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

116KB

Virtual Size

114KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

356B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

a47b9278fcbe694c0a00b5817cfc18f78d608e23965586b42c86e852a2f511fe

advapi32

comctl32

kernel32

ntdll

ole32

oleaut32

ucrtbase

user32

generic