3fe131a2293049e7f604dcae2b4387dadb57923139595ef67d6508b68a0f9fe9

Sharing

Copy URL Twitter E-mail

General

Target
3fe131a2293049e7f604dcae2b4387dadb57923139595ef67d6508b68a0f9fe9
Size 1.4MB
Sample260729-ed1nvstdqc
SHA256 3fe131a2293049e7f604dcae2b4387dadb57923139595ef67d6508b68a0f9fe9
MD5 922c6ff1f434b3a892892c60c19e17bc
SHA1 df97203ca508db968efa3a52e839023a77f714c2
SHA512 9dc425cfd4ba48adc363190b769bb5effc08c585dbe59052fbbbc8414fedd6c39cb9abbec3a41c73d551995dce007b543f8c9796df3f9aacac465b0f2346010f
SSDEEP 12288:JPZeentIKlrJPZeentIKlrJPZeentIKlrn:JTtIKlrJTtIKlrJTtIKlrn
TLSH
T1C965B59072E45CA3F626833858E3E2313779B6515363CB1BC204993D1E3B7D36ED6A1A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
3fe131a2293049e7f604dcae2b4387dadb57923139595ef67d6508b68a0f9fe9

File Explorer

3fe131a2293049e7f604dcae2b4387dadb57923139595ef67d6508b68a0f9fe9

.exe 1.4MB

3fe131a2293049e7f604dcae2b4387dadb57923139595ef67d6508b68a0f9fe9

IMPHASH d02a02c8ecedb70823a9d0178cd7b7fc
SHA256 3fe131a2293049e7f604dcae2b4387dadb57923139595ef67d6508b68a0f9fe9
MD5 922c6ff1f434b3a892892c60c19e17bc
SHA1 df97203ca508db968efa3a52e839023a77f714c2
SHA512 9dc425cfd4ba48adc363190b769bb5effc08c585dbe59052fbbbc8414fedd6c39cb9abbec3a41c73d551995dce007b543f8c9796df3f9aacac465b0f2346010f
SSDEEP 12288:JPZeentIKlrJPZeentIKlrJPZeentIKlrn:JTtIKlrJTtIKlrJTtIKlrn
TLSH
T1C965B59072E45CA3F626833858E3E2313779B6515363CB1BC204993D1E3B7D36ED6A1A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

16736

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

advapi32

ConvertSidToStringSidW GetTokenInformation GetUserNameW OpenProcessToken RegCloseKey RegCreateKeyExW RegCreateKeyW RegDeleteValueW RegEnumValueW RegOpenKeyExW RegOpenKeyW RegQueryInfoKeyW RegQueryValueExW RegSetValueExW

kernel32

CreateToolhelp32Snapshot DelayLoadFailureHook GetComputerNameW GetPrivateProfileSectionW GetProcAddress HeapReAlloc IsBadStringPtrA IsBadStringPtrW Process32FirstW Process32NextW ResolveDelayLoadedAPI

kernelbase

CloseHandle CreateEventW CreateFileA CreateFileW CreateProcessW DeleteFileW ExitProcess FindClose FindFirstFileW FindNextFileW GetCommandLineW GetExitCodeProcess GetModuleHandleW GetSystemDirectoryW GetSystemFirmwareTable GetSystemWow64Directory2W GetTickCount GetWindowsDirectoryW HeapAlloc IsWow64Process LocalFree MapViewOfFile MoveFileExW MultiByteToWideChar OpenProcess ReadFile RemoveDirectoryW ResetEvent SetComputerNameExA SetCurrentDirectoryW SetEvent Sleep TerminateProcess UnmapViewOfFile VerFindFileW WaitForMultipleObjects WaitForSingleObject Wow64DisableWow64FsRedirection Wow64RevertWow64FsRedirection lstrcmpiW

ntdll

NtClose NtCreateDirectoryObject NtCreateEvent NtCreateSection NtCreateSymbolicLinkObject NtOpenFile NtOpenSection NtPowerInformation NtQuerySystemInformation NtQuerySystemInformationEx RtlGetSystemTimePrecise RtlGetVersion RtlImageDirectoryEntryToData RtlInitUnicodeString _vsnprintf

ucrtbase

__acrt_iob_func __p___argc __p___argv __stdio_common_vsprintf __stdio_common_vswprintf _chsize _close _configure_narrow_argv _errno _fstat64i32 _get_initial_narrow_environment _initialize_narrow_environment _lseek _putenv _read _set_app_type _strdup _stricmp _wcsicmp _wgetenv _wopen _write exit free fwrite getenv malloc memcmp memmove memset qsort realloc strchr strcmp strcpy strcspn strerror strlen strncmp strtoul wcscat wcschr wcscmp wcscpy wcslen wcsncmp wcsstr

ws2_32

gethostname freeaddrinfo getaddrinfo

Name

.text

Size

36KB

Virtual Size

32KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

4KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

72KB

Virtual Size

71KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

4KB

Virtual Size

696B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

4KB

Virtual Size

660B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

8KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

32KB

Virtual Size

31KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

4KB

Virtual Size

128B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

4KB

Virtual Size

48B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

4KB

Virtual Size

40B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

4KB

Virtual Size

20B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

4KB

Virtual Size

92B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

4KB

Virtual Size

72B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

4KB

Virtual Size

156B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

4KB

Virtual Size

142B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

3fe131a2293049e7f604dcae2b4387dadb57923139595ef67d6508b68a0f9fe9

advapi32

kernel32

kernelbase

ntdll

ucrtbase

ws2_32

generic